Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
3817-1/ - https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/ - https://access.redhat.com/errata/RHBA-2019:0327 - https://access.redhat.com/errata/RHSA-2019:1260 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us - https://access.redhat.com
tps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us - https://access.redhat.com/errata/RHSA-2019:3725 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
CVE ID: CVE-2018-1062 State: PUBLISHED Published: 2018-03-06T15:00:00Z Last Updated: 2024-09-17T02:16:32.159Z Vendors: oVirt Products: oVirt Problem Types: CWE-212 Description: A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1549944 - https
tional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1549944 - https://access.redhat.com/errata/RHBA-2018:0135 - https://gerrit.ovirt.org/#/c/84875/ - https://gerrit.ovirt.org/#/c/84861/ - http://www.securityfocus.com/bid/103433
CVE ID: CVE-2018-1063 State: PUBLISHED Published: 2018-03-02T15:00:00Z Last Updated: 2024-08-05T03:51:47.327Z Vendors: SELinux Project Products: policycoreutils Problem Types: CWE-59 Description: Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=
ls 2.5-11. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1550122 - https://access.redhat.com/errata/RHSA-2018:0913
CVE ID: CVE-2018-1064 State: PUBLISHED Published: 2018-03-28T18:00:00Z Last Updated: 2024-09-17T01:51:12.642Z Vendors: libvirt Products: libvirt Problem Types: CWE-400 Description: libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3680-1/ - https://access.redhat.com/errata/RHSA-2018:1396 - https://www.debian.org/security/2018/dsa-4137 - https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=fbf31e1a4cd19d6f6e33e0937a009775cd7d9513 - https://access.redhat.com/errata
ibvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=fbf31e1a4cd19d6f6e33e0937a009775cd7d9513 - https://access.redhat.com/errata/RHSA-2018:1929 - https://bugzilla.redhat.com/show_bug.cgi?id=1550672 - https://lists.debian.org/debian-lts-announce/2018/03/msg00018.html
CVE ID: CVE-2018-1065 State: PUBLISHED Published: 2018-03-02T08:00:00 Last Updated: 2024-08-05T03:51:47.324Z Vendors: n/a Products: Linux kernel 4.15.0-rc9 Problem Types: NULL pointer dereference Description: The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c. Additional Analyst Notes: - CVE Program C
4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040446 - https://usn.ubuntu.com/3654-1/ - https://www.debian.org/security/2018/dsa-4188 - https://access.redhat.com/errata/RHSA-2018:2948 - https://bugzilla.redhat.com/show_bug.cgi?id=1547824 - https://usn.ubuntu.com/3654-2/ - http://lists.openwall.net/netdev/2018/01/27/46 - https://usn.ubuntu.com/3656-1/ - http://patchwork.ozlabs.org/patch/870355/ - https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a9
8a97d7c5b1e1afb937c2db22beba3c1f8 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8
CVE ID: CVE-2018-1066 State: PUBLISHED Published: 2018-03-02T08:00:00 Last Updated: 2024-08-05T03:51:47.336Z Vendors: n/a Products: Linux kernel 4.11 Problem Types: NULL pointer dereference Description: The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html - https://www.debian.
rogram Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html - https://www.debian.org/security/2018/dsa-4187 - https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html - https://github.com/torvalds/linux/commit/cabfb3680f78981d26c078a26e5c748531257ebb - https://www.debian.org/security/2018/dsa-4188 - https://usn.ubuntu.com/3880-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=1539599 - https://usn.ubuntu.com/3880-2/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cabfb3680f78981d26c078a26e5c748531257ebb - https://patchwork.kernel.org/patch/10187633/ - http://www.securityfocus.com/bid/103378
CVE ID: CVE-2018-1067 State: PUBLISHED Published: 2018-05-21T17:00:00 Last Updated: 2024-08-05T03:51:47.329Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: undertow Problem Types: CWE-113 Description: In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-201
header value. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1248 - https://access.redhat.com/errata/RHSA-2018:1251 - https://access.redhat.com/errata/RHSA-2018:2643 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1067 - https://access.redhat.com/errata/RHSA-2018:1247 - https://access.redhat.com/errata/RHSA-2018:1249 - https://access.redhat.com/errata/RHSA-2019:0877
CVE ID: CVE-2018-1068 State: PUBLISHED Published: 2018-03-16T16:00:00Z Last Updated: 2024-09-16T16:13:09.145Z Vendors: Linux Kernel Organization, Inc. Products: Linux Kernel Problem Types: CWE-119 Description: A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4187 - https://usn.ubuntu.com/3654-1/ - https://usn.ubuntu.com/3674-1/ - https://usn.ubuntu.com/3677-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=1552048 - https://www.debian.org/security/201
tps://usn.ubuntu.com/3677-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=1552048 - https://www.debian.org/security/2018/dsa-4188 - https://marc.info/?l=linux-netdev&m=152023808817590&w=2 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b71812168571fa55e44cdd0254471331b9c4c4c6 - https://github.com/torvalds/linux/commit/b71812168571fa55e44cdd0254471331b9c4c4c6 - https://usn.ubuntu.com/3674-2/ - https://access.redhat.com/errata/RHSA-2018:1355 - https://access.redhat.com/errata/RHSA-2018:2948 - http://www.securityfocus.com/bid/103459 - https://access.redhat.com/errata/RHSA-2018:1318 - https://usn.ubuntu.com/3677-2/ - https://usn.ubuntu.com/3654-2/ - https://marc.
ccess.redhat.com/errata/RHSA-2018:1318 - https://usn.ubuntu.com/3677-2/ - https://usn.ubuntu.com/3654-2/ - https://marc.info/?l=linux-netdev&m=152025888924151&w=2 - https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html - https://usn.ubuntu.com/3656-1/ - https://access.redhat.com/errata/RHSA-2019:1170 - https://access.redhat.com/errata/RHSA-2019:1190 - https://access.redhat.com/errata/RHSA-2019:4159
CVE ID: CVE-2018-1069 State: PUBLISHED Published: 2018-03-09T14:00:00Z Last Updated: 2024-08-05T03:51:47.337Z Vendors: Red Hat, Inc. Products: OpenShift Enterprise Problem Types: CWE-284 Description: Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. An attacker could override the UserId and GroupId for GlusterFS and NFS to read and write any data on the network filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1552987 - http://www.securityfocus.com/bid/103364
CVE ID: CVE-2018-1070 State: PUBLISHED Published: 2018-06-12T13:00:00 Last Updated: 2024-08-05T03:51:47.334Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: routing Problem Types: CWE-20 Description: routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which can cause an entire shard to be brought down. A malicious user can use this vulnerability to cause a Denial of Service attack for other users of the router shard. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2013 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2
ainer: References: - https://access.redhat.com/errata/RHSA-2018:2013 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1070
CVE ID: CVE-2018-1071 State: PUBLISHED Published: 2018-03-09T15:00:00Z Last Updated: 2024-08-05T03:51:48.907Z Vendors: zsh Products: zsh Problem Types: CWE-121 Description: zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1553531 - https://usn.ubuntu.com/3608-1/ - http://www.securityfocus.com/bid/103359 - https://security.gentoo.org/glsa/201805-10 - https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html - https://access.redhat.com/errata/RHSA-2018:307
10 - https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html - https://access.redhat.com/errata/RHSA-2018:3073 - https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
CVE ID: CVE-2018-1072 State: PUBLISHED Published: 2018-06-26T18:00:00 Last Updated: 2024-08-05T03:51:48.552Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: ovirt-engine-setup Problem Types: CWE-532 Description: ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2071 - https://bugzilla.
nalyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2071 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1072
CVE ID: CVE-2018-1073 State: PUBLISHED Published: 2018-06-19T12:00:00 Last Updated: 2024-08-05T03:51:47.320Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: ovirt-engine Problem Types: CWE-209 Description: The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1073 - http://www.securityfocus.com/bid/104189 - https://access.redhat.com/errata/RHSA-2018:1525
CVE ID: CVE-2018-1074 State: PUBLISHED Published: 2018-04-26T17:00:00 Last Updated: 2024-08-05T03:51:48.452Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: unspecified Products: ovirt-engine Problem Types: CWE-200 Description: ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1074 - https:/
nalyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1074 - https://access.redhat.com/errata/RHBA-2018:1219
CVE ID: CVE-2018-1075 State: PUBLISHED Published: 2018-06-12T13:00:00 Last Updated: 2024-08-05T03:51:48.553Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: ovirt-engine Problem Types: CWE-532 Description: ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords. Additional Analyst Notes: - CVE Program Container: References: - https://b
might inadvertently leak database passwords. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1075 - https://gerrit.ovirt.org/#/c/91653/ - https://access.redhat.com/errata/RHSA-2018:2071
CVE ID: CVE-2018-1076 State: REJECTED Published: 2022-08-05T16:44:55 Last Updated: 2022-08-05T16:44:55 Description: No description available.
CVE ID: CVE-2018-1077 State: PUBLISHED Published: 2018-03-14T18:00:00Z Last Updated: 2024-09-17T01:21:18.539Z Vendors: spacewalk Products: spacewalk Problem Types: CWE-611 Description: Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1555429
CVE ID: CVE-2018-1078 State: PUBLISHED Published: 2018-03-16T20:00:00 Last Updated: 2024-08-05T03:51:48.375Z Vendors: OpenDayLight Products: OpenDayLight Problem Types: CWE-20 Description: OpenDayLight version Carbon SR3 and earlier contain a vulnerability during node reconciliation that can result in traffic flows that should be expired or should expire shortly being re-installed and their timers reset resulting in traffic being allowed that should be expired. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1533501 - https://jira.opendaylight.org/browse/OPNFLWPLUG-971
CVE ID: CVE-2018-1079 State: PUBLISHED Published: 2018-04-12T17:00:00 Last Updated: 2024-08-05T03:51:48.682Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: unspecified Products: pcs Problem Types: CWE-552 Description: pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.
overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1060 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1079
CVE ID: CVE-2018-1080 State: PUBLISHED Published: 2018-07-02T18:00:00 Last Updated: 2024-08-05T03:51:48.562Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: pki-core Problem Types: CWE-284 Description: Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences. Additional Ana
will grant access. This may result in an escalation of privileges or have other unintended consequences. Additional Analyst Notes: - CVE Program Container: References: - https://pagure.io/freeipa/issue/7453 - https://access.redhat.com/errata/RHSA-2018:1979 - https://review.gerrithub.io/c/dogtagpki/pki/+/404435 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1080
CVE ID: CVE-2018-1081 State: PUBLISHED Published: 2018-04-04T21:00:00Z Last Updated: 2024-09-16T19:55:57.284Z Vendors: Red Hat, Inc. Products: Moodle Problem Types: CWE-79 Description: A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed. Additional Analyst Notes: - CVE Program Container: References: - https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392 - https://moodle.org/mod/forum/di
rences: - https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392 - https://moodle.org/mod/forum/discuss.php?d=367938 - http://www.securityfocus.com/bid/103728
CVE ID: CVE-2018-1082 State: PUBLISHED Published: 2018-04-04T21:00:00Z Last Updated: 2024-09-16T16:43:01.540Z Vendors: Red Hat, Inc. Products: Moodle Problem Types: CWE-285 Description: A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-60101 - http://www.securityfocus.com/bid/103725 - https://moodle.org/mod/forum/discuss.php?d=367939
CVE ID: CVE-2018-1083 State: PUBLISHED Published: 2018-03-28T13:00:00Z Last Updated: 2024-09-16T18:13:29.080Z Vendors: zsh Products: zsh Problem Types: CWE-120 Description: Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3608-1/ - http://www.securityfocus.com/bid/103572 - https://s
VE Program Container: References: - https://usn.ubuntu.com/3608-1/ - http://www.securityfocus.com/bid/103572 - https://security.gentoo.org/glsa/201805-10 - https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7 - https://access.redhat.com/errata/RHSA-2018:1932 - https://bugzilla.redhat.com/show_bug.cgi?id=1557382 - https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html - https://access.redhat.com/errata/RHSA-2018:3073 - https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
CVE ID: CVE-2018-1084 State: PUBLISHED Published: 2018-04-12T17:00:00 Last Updated: 2024-08-05T03:51:48.451Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: unspecified Products: corosync Problem Types: CWE-190 Description: corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103758 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1084 - https://www.debian.org/security/2018/dsa-4174 - https://access.redhat.com/errata/RHSA-2018:1169 - https://usn.ubuntu.com/4000-1/ - https://security.gentoo.org/glsa/202107-01
CVE ID: CVE-2018-1085 State: PUBLISHED Published: 2018-06-15T13:00:00 Last Updated: 2024-08-05T03:51:48.271Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: openshift-ansible Problem Types: CWE-592 Description: openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCD_CLIENT_CERT_AUTH and ETCD_PEER_CLIENT_CERT_AUTH in etcd.conf result in etcd being configured to allow remote users to connect without any authentication if they can access the etcd server bound to the network on the master nodes. An attacker cou
without any authentication if they can access the etcd server bound to the network on the master nodes. An attacker could use this flaw to read and modify all the data about the Openshift cluster in the etcd datastore, potentially adding another compute node, or bringing down the entire cluster. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1085 - https://access.redhat.com/errata/RHSA-2018:2013
CVE ID: CVE-2018-1086 State: PUBLISHED Published: 2018-04-12T16:00:00 Last Updated: 2024-08-05T03:51:48.471Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: redhat Products: pcs Problem Types: CWE-20 Description: pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1086 - https
Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1086 - https://access.redhat.com/errata/RHSA-2018:1060 - https://access.redhat.com/errata/RHSA-2018:1927 - https://www.debian.org/security/2018/dsa-4169