Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
n still login. This problem will affect users that have PAM enabled. Currently there is no authorization (e.g. check for expired or disabled accounts), but only plain authentication (i.e. check if username and password match). Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 implement the authorization check that was previously missing. The only workaround is to make sure that authentication fails if the user is not authorized. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bareos/bareos/security/advisories/GHSA-4979-8ffj-4q26 - https://github.com/bareos/bareos/pull/1115 - https://github.com/bareos/bareos/pull/1119 - https://gi
SA-4979-8ffj-4q26 - https://github.com/bareos/bareos/pull/1115 - https://github.com/bareos/bareos/pull/1119 - https://github.com/bareos/bareos/pull/1121 - https://huntr.dev/bounties/480121f2-bc3c-427e-986e-5acffb1606c5/
CVE ID: CVE-2022-24756 State: PUBLISHED Published: 2022-03-15T14:40:21.000Z Last Updated: 2025-04-22T18:18:06.913Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: bareos Products: bareos Problem Types: CWE-401 Description: Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, a failed PAM authentication will leak a small amount of memory. An attacker that is able to use the PAM Console (i.e. by knowing the shared secret or via the WebUI) can flood the Director with failing login attempts which will ev
le (i.e. by knowing the shared secret or via the WebUI) can flood the Director with failing login attempts which will eventually lead to an out-of-memory condition in which the Director will not work anymore. Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 contain a Bugfix for this problem. Users who are unable to upgrade may disable PAM authentication as a workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bareos/bareos/pull/1115 - https://github.com/bareos/bareos/pull/1119 - https://github.com/bareos/bareos/pull/1121 - https://huntr.dev/bounties/480121f2-bc3c-427e-986e-5acffb1606c5/ - https://github.com/bareos/bareos
s/bareos/pull/1121 - https://huntr.dev/bounties/480121f2-bc3c-427e-986e-5acffb1606c5/ - https://github.com/bareos/bareos/security/advisories/GHSA-jh55-4wgw-xc9j
CVE ID: CVE-2022-24757 State: PUBLISHED Published: 2022-03-23T20:20:09.000Z Last Updated: 2025-04-23T18:44:36.814Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: jupyter-server Products: jupyter_server Problem Types: CWE-532 Description: The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, ste
pyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter Server version 1.15.4 contains a patch for this issue. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-p737-p57g-4cpr - https://github.com/jupyter-server/jupyter_server/commit/a5683aca0b0e412672ac6218d09f74d44ca0de5a
CVE ID: CVE-2022-24758 State: PUBLISHED Published: 2022-03-31T22:35:09.000Z Last Updated: 2025-04-23T18:43:02.027Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: jupyter Products: notebook Problem Types: CWE-532 Description: The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain acce
s do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter notebook version 6.4.x contains a patch for this issue. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jupyter/notebook/security/advisories/GHSA-m87f-39q9-6f55
CVE ID: CVE-2022-24759 State: PUBLISHED Published: 2022-03-17T16:40:11.000Z Last Updated: 2025-04-23T18:46:39.631Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: ChainSafe Products: js-libp2p-noise Problem Types: CWE-347 Description: `@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. `@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and get those peers banned. Users should upgrade to version 4.1.2 or 5.0.3 to receive a patch. There are currently no known workarounds. A
s banned. Users should upgrade to version 4.1.2 or 5.0.3 to receive a patch. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChainSafe/js-libp2p-noise/security/advisories/GHSA-j3ff-xp6c-6gcc - https://github.com/ChainSafe/js-libp2p-noise/pull/130 - https://github.com/ChainSafe/js-libp2p-noise/releases/tag/v5.0.3
CVE ID: CVE-2022-24760 State: PUBLISHED Published: 2022-03-11T23:55:10.000Z Last Updated: 2025-04-22T18:19:01.959Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: parse-community Products: parse-server Problem Types: CWE-74 Description: Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well.
le code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-p6h4-93qp-jhcm - https://github.com/parse-community/parse-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d - https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc
-server/commit/886bfd7cac69496e3f73d4bb536f0eec3cba0e4d - https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099/
CVE ID: CVE-2022-24761 State: PUBLISHED Published: 2022-03-17T12:40:10.000Z Last Updated: 2025-04-23T18:46:46.567Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Pylons Products: waitress Problem Types: CWE-444 Description: Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and where it ends. This would allow requests to be smuggled via the front-end proxy to waitress and later behavior. There are two classes of vulnerabili
low requests to be smuggled via the front-end proxy to waitress and later behavior. There are two classes of vulnerability that may lead to request smuggling that are addressed by this advisory: The use of Python's `int()` to parse strings into integers, leading to `+10` to be parsed as `10`, or `0x01` to be parsed as `1`, where as the standard specifies that the string should contain only digits or hex digits; and Waitress does not support chunk extensions, however it was discarding them without validating that they did not contain illegal characters. This vulnerability has been patched in Waitress 2.1.1. A workaround is available. When deploying a proxy in front of waitress, turning on any
s been patched in Waitress 2.1.1. A workaround is available. When deploying a proxy in front of waitress, turning on any and all functionality to make sure that the request matches the RFC7230 standard. Certain proxy servers may not have this functionality though and users are encouraged to upgrade to the latest version of waitress instead. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Pylons/waitress/security/advisories/GHSA-4f7p-27jc-3c36 - https://github.com/Pylons/waitress/commit/9e0b8c801e4d505c2ffc91b891af4ba48af715e0 - https://github.com/Pylons/waitress/releases/tag/v2.1.1 - https://lists.debian.org/debian-lts-announce/202
4ba48af715e0 - https://github.com/Pylons/waitress/releases/tag/v2.1.1 - https://lists.debian.org/debian-lts-announce/2022/05/msg00011.html - https://www.debian.org/security/2022/dsa-5138
CVE ID: CVE-2022-24762 State: PUBLISHED Published: 2022-03-14T22:50:10 Last Updated: 2024-09-18T14:58:43.275Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: jcubic Products: sysend.js Problem Types: CWE-200 Description: sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via syse
nly currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jcubic/sysend.js/security/advisories/GHSA-4vvg-x86p-mvqc - https://github.com/jcubic/sysend.js/issues/33 - https://github.com/jcubic/sysend.js/commit/a24f4b776fb18191ae0f7e3d90c2c7bec459431a - https://github.com/jcubic/sysend.js/releases/tag/1.10.0
CVE ID: CVE-2022-24763 State: PUBLISHED Published: 2022-03-30T00:00:00.000Z Last Updated: 2025-11-04T16:09:36.751Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: pjsip Products: pjproject Problem Types: CWE-835 Description: PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-5x45-qp78-g4p4 - https://g
Program Container: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-5x45-qp78-g4p4 - https://github.com/pjsip/pjproject/commit/856f87c2e97a27b256482dbe0d748b1194355a21 - https://lists.debian.org/debian-lts-announce/2022/05/msg00047.html - https://security.gentoo.org/glsa/202210-37 - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/security/2022/dsa-5285 - https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
CVE ID: CVE-2022-24764 State: PUBLISHED Published: 2022-03-22T00:00:00.000Z Last Updated: 2025-11-04T16:09:37.703Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: pjsip Products: pjproject Problem Types: CWE-120, CWE-121 Description: PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch
pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-f5qg-pqcg-765m - https://github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b00 - https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - https://security.gentoo.org/glsa/202210-37 - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/security/2022/dsa-5285 - https://lis
lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/security/2022/dsa-5285 - https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
CVE ID: CVE-2022-24765 State: PUBLISHED Published: 2022-04-12T00:00:00.000Z Last Updated: 2025-07-24T03:55:38.621Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: git-for-windows Products: git Problem Types: CWE-427 Description: Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bas
tside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as
y create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2 - https://git-scm.com/book/en/v2/Appendix-A%3A-Git-in-Other-Environments-Git-in-Bash - https://git-scm.com/docs/git#Documentation/git.txt-codeGITCEILINGDIRECTORIEScode - http://www.openwall.com/lists/oss-securit
s://git-scm.com/docs/git#Documentation/git.txt-codeGITCEILINGDIRECTORIEScode - http://www.openwall.com/lists/oss-security/2022/04/12/7 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PTN5NYEHYN2OQSHSAMCNICZNK2U4QH6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BENQYTDGUL6TF3UALY6GSIEXIHUIYNWM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLP42KIZ6HACTVZMZLJLFJQ4W2XYT27M/ - https://support.apple.com/kb/HT213261 - http://seclists.org/fulldisclosure/2022/May/31 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedo
://seclists.org/fulldisclosure/2022/May/31 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZG5CDUQ27OWTPC5MQOR4UASNXHWEZS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDI325LOO2XBDDKLINOAQJEG6MHAURZE/ - https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIKWISWUDFT2FAITYIA6372BVLH3OOOC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YROCMBWYFKRSS64PO6FUNM6L7LKBUKVW/ - https://lists.fedoraproject.org/archives/list/package-
sts.fedoraproject.org/message/YROCMBWYFKRSS64PO6FUNM6L7LKBUKVW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVOLER2PIGMHPQMDGG4RDE2KZB74QLA2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDZRZAL7QULOB6V7MKT66MOMWJLBJPX4/ - https://security.gentoo.org/glsa/202312-15
CVE ID: CVE-2022-24766 State: PUBLISHED Published: 2022-03-21T18:50:10.000Z Last Updated: 2025-04-23T18:45:30.363Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mitmproxy Products: mitmproxy Problem Types: CWE-444 Description: mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A
sponse's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization. Unless mitmproxy is used to protect an HTTP/1 service, no action is required. The vulnerability has been fixed in mitmproxy 8.0.0 and above. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mitmproxy/mitmproxy/security/adv
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-gcx2-gvj7-pxv3 - https://github.com/mitmproxy/mitmproxy/commit/b06fb6d157087d526bd02e7aadbe37c56865c71b - https://mitmproxy.org/posts/releases/mitmproxy8/
CVE ID: CVE-2022-24767 State: PUBLISHED Published: 2022-04-12T17:51:04 Last Updated: 2024-10-01T14:53:40.641Z Vendors: Microsoft Products: Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2022 version 17.1, Microsoft Visual Studio 2019 version 16.7 (includes 16.0 â€“ 16.6), Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8), Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10), Microsoft Visual Studio 2022 version 17.0 Problem Types: Elevation of Privilege Description: GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account. Additional Analyst Notes: - CVE Program Container: -
vulnerable to DLL hijacking when run under the SYSTEM user account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24767
CVE ID: CVE-2022-24768 State: PUBLISHED Published: 2022-03-23T21:20:11.000Z Last Updated: 2025-04-23T18:44:13.900Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-200 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5.0 contain limited versions of this issue. To perform exploits, an authorized Argo CD user must have push access to an Application's source g
rsions of this issue. To perform exploits, an authorized Argo CD user must have push access to an Application's source git or Helm repository or `sync` and `override` access to an Application. Once a user has that access, different exploitation levels are possible depending on their other RBAC privileges. A patch for this vulnerability has been released in Argo CD versions 2.3.2, 2.2.8, and 2.1.14. Some mitigation measures are available but do not serve as a substitute for upgrading. To avoid privilege escalation, limit who has push access to Application source repositories or `sync` + `override` access to Applications; and limit which repositories are available in projects where users have
or `sync` + `override` access to Applications; and limit which repositories are available in projects where users have `update` access to Applications. To avoid unauthorized resource inspection/tampering, limit who has `delete`, `get`, or `action` access to Applications. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww - https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf - https://github.com/argoproj/argo-cd/releases/tag/v2.1.14 - https://github.com/argoproj/argo-cd/releases/tag/v2.2.8 - https://github.com/argoproj/argo-cd/releases/tag/v2.3.2
CVE ID: CVE-2022-24769 State: PUBLISHED Published: 2022-03-24T00:00:00 Last Updated: 2024-08-03T04:20:49.949Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: moby Products: moby Problem Types: CWE-732 Description: Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when execut
heritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not aff