Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-26906 State: PUBLISHED Published: 2021-02-18T19:50:04 Last Updated: 2024-08-03T20:33:41.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.asterisk.org/pub/security/ - http://seclists.org/fulldisclosure/2021/F
rogram Container: References: - https://downloads.asterisk.org/pub/security/ - http://seclists.org/fulldisclosure/2021/Feb/61 - https://downloads.asterisk.org/pub/security/AST-2021-005.html - https://issues.asterisk.org/jira/browse/ASTERISK-29196 - http://packetstormsecurity.com/files/161477/Asterisk-Project-Security-Advisory-AST-2021-005.html
CVE ID: CVE-2021-26908 State: PUBLISHED Published: 2021-04-23T15:35:20.041877Z Last Updated: 2024-09-17T01:26:49.007Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Automox Products: Automox Agent Problem Types: CWE-532 Description: Automox Agent prior to version 31 logs potentially sensitive information in local log files, which could be used by a locally-authenticated attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent. Additional Analyst Notes: - CVE Program Container: References: - https://community.automox.com/t/cve-2021-26908-and-cve-201-26909-automox-agent-information-disclosure-vulne
eferences: - https://community.automox.com/t/cve-2021-26908-and-cve-201-26909-automox-agent-information-disclosure-vulnerabilities-fixed/1955 - https://www.rapid7.com/blog/post/2021/04/13/cve-2021-26908-and-cve-2021-26909-automox-agent-information-disclosure-fixed/
CVE ID: CVE-2021-26909 State: PUBLISHED Published: 2021-04-23T15:35:20.717256Z Last Updated: 2024-09-16T22:52:05.825Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Automox Products: Automox Agent Problem Types: CWE-284 Description: Automox Agent prior to version 31 uses an insufficiently protected S3 bucket endpoint for storing sensitive files, which could be brute-forced by an attacker to subvert an organization's security program. The issue has since been fixed in version 31 of the Automox Agent. Additional Analyst Notes: - CVE Program Container: References: - https://community.automox.com/t/cve-2021-26908-and-cve-201-26909-automox-agent-information-disclos
tainer: References: - https://community.automox.com/t/cve-2021-26908-and-cve-201-26909-automox-agent-information-disclosure-vulnerabilities-fixed/1955 - https://www.rapid7.com/blog/post/2021/04/13/cve-2021-26908-and-cve-2021-26909-automox-agent-information-disclosure-fixed/
CVE ID: CVE-2021-26910 State: PUBLISHED Published: 2021-02-08T19:56:38 Last Updated: 2024-08-03T20:33:41.306Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b - https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt - https://unparalleled.eu/blog/2021/20210208-rigged-race-a
//unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt - https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/ - https://github.com/netblue30/firejail/releases/tag/0.9.64.4 - http://www.openwall.com/lists/oss-security/2021/02/09/1 - https://www.debian.org/security/2021/dsa-4849 - https://lists.debian.org/debian-lts-announce/2021/02/msg00015.html - https://security.gentoo.org/glsa/202105-19
CVE ID: CVE-2021-26911 State: PUBLISHED Published: 2021-02-17T20:54:08 Last Updated: 2024-08-03T20:33:41.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode. Additional Analyst Notes: - CVE Program Container: References: - https://apps.apple.com/us/app/canary-mail/id1236045954 - https://census-labs.com/news/category/advisories/ - https://www.openwall.com/lists/oss-security/2021/02/17/3 - https://census-labs.com/news/2021/02/17/canary-mail-app-missing-certificate-validation-check-on-imap-starttls/ - https://github.com/canarymail/mailcore2/commit/45acb4efbcaa57a20
issing-certificate-validation-check-on-imap-starttls/ - https://github.com/canarymail/mailcore2/commit/45acb4efbcaa57a20ac5127dc976538671fce018 - http://www.openwall.com/lists/oss-security/2021/02/17/3
CVE ID: CVE-2021-26912 State: PUBLISHED Published: 2021-02-08T21:04:02 Last Updated: 2024-08-03T20:33:41.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in SupportRpcServlet. Additional Analyst Notes: - CVE Program Container: References: - https://ssd-disclosure.com/?p=4676 - https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020 - https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/
CVE ID: CVE-2021-26913 State: PUBLISHED Published: 2021-02-08T21:04:10 Last Updated: 2024-08-03T20:33:41.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in RpcServlet. Additional Analyst Notes: - CVE Program Container: References: - https://ssd-disclosure.com/?p=4676 - https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020 - https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/
CVE ID: CVE-2021-26914 State: PUBLISHED Published: 2021-02-08T21:04:19 Last Updated: 2024-08-03T20:33:41.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject. Additional Analyst Notes: - CVE Program Container: References: - https://ssd-disclosure.com/?p=4676 - https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020 - https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to
0 - https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/ - http://packetstormsecurity.com/files/162617/NetMotion-Mobility-Server-MvcUtil-Java-Deserialization.html
CVE ID: CVE-2021-26915 State: PUBLISHED Published: 2021-02-08T21:04:27 Last Updated: 2024-08-03T20:33:41.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in webrepdb StatusServlet. Additional Analyst Notes: - CVE Program Container: References: - https://ssd-disclosure.com/?p=4676 - https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020 - https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/
CVE ID: CVE-2021-26916 State: PUBLISHED Published: 2021-02-08T21:22:32 Last Updated: 2024-08-03T20:33:41.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CheckDiscountCouponAttribute.cs discountcode parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nopSolutions/nopCommerce/issues/5322
CVE ID: CVE-2021-26917 State: PUBLISHED Published: 2021-02-08T22:22:51 Last Updated: 2024-08-03T20:33:41.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: PyBitmessage through 0.6.3.2 allows attackers to write screen captures to Potentially Unwanted Directories via a crafted apinotifypath value. NOTE: the discoverer states "security mitigation may not be necessary as there is no evidence yet that these screen intercepts are actually transported away from the local host." NOTE: it is unclear whether there are any common use cases in which apinotifypath is controlled by an attacker Additional Analyst Notes: - CVE Program Container: References: - https://poal.co/s/technology/29047
olled by an attacker Additional Analyst Notes: - CVE Program Container: References: - https://poal.co/s/technology/290479 - https://github.com/Bitmessage/PyBitmessage/releases - https://github.com/Bitmessage/PyBitmessage/blob/f381721bec31641002e2f240309600c4994855a7/src/api.py#L35-L37 - https://attack.mitre.org/techniques/T1113/
CVE ID: CVE-2021-26918 State: PUBLISHED Published: 2021-02-09T02:07:20 Last Updated: 2024-08-03T20:33:41.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ProBot bot through 2021-02-08 for Discord might allow attackers to interfere with the intended purpose of the "Send an image when a user joins the server" feature (or possibly have unspecified other impact) because the uploader web service allows double extensions (such as .html.jpg) with the text/html content type. NOTE: there may not be cases in which an uploader web service is customer controlled; however, the nature of the issue has substantial interaction with customer controlled configuration. NOTE: the vendor state
ever, the nature of the issue has substantial interaction with customer controlled configuration. NOTE: the vendor states "This is just an uploader (like any other one) which uploads files to cloud storage and accepts various file types. There is no kind of vulnerability and it won't compromise either the client side or the server side. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://raw.githubusercontent.com/TheLastVvV/Vulnerability-Reports-and-CVE/main/Reports/Discord%20Probot%20-%20Unrestricted%20File%20Upload.txt - http://packetstormsecurity.com/files/161347/Discord-Probot-Arbitrary-File-Upload.html
CVE ID: CVE-2021-26919 State: PUBLISHED Published: 2021-03-30T07:50:10.000Z Last Updated: 2025-02-13T16:27:55.797Z Vendors: Apache Software Foundation Products: Apache Druid Problem Types: Remote code execution Description: Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2 Additional Analyst Notes:
us MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2 Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rd87451fce34df54796e66321c40d743a68fb4553d72e7f6f0bc62ebd%40%3Cdev.druid.apache.org%3E - https://lists.apache.org/thread.html/r443e2916c612fbd119839c0fc0729327d6031913a75081adac5b43ad%40%3Cdev.druid.apache.org%3E - https://lists.apache.org/thread.html/re4c5deb0aae4bace69844d15c9fd1699e907ebfee93bc3926474d110%40%3Cdev.druid.apache.org%3E - https://lists.apache.org/thread.html/re0910cf4c784897774427fecd95912fb565a6bd06d924a55e70bbbfc%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.
0cf4c784897774427fecd95912fb565a6bd06d924a55e70bbbfc%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/ra85fa7d31f9bec1148ffd2e4030934927caa8bff89bca9f61f75e697%40%3Cdev.druid.apache.org%3E - https://lists.apache.org/thread.html/r470f8c92eb5df45f41b3ae609b6315b6c5ff51b3ceb2f09f00ca620f%40%3Cdev.druid.apache.org%3E - https://lists.apache.org/thread.html/r7a531ec123570cb7875ff991cf115f99e9ef99a48b3cf3fa4f9d9864%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r6bc68264170046448f823d12c17fd1fd875251d97d60869f58709872%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rf3ea2a4018e87e6c45d36cf8479af7727dcc276edabd2f7cf59e0c5f%40%3C
uid.apache.org%3E - https://lists.apache.org/thread.html/rf3ea2a4018e87e6c45d36cf8479af7727dcc276edabd2f7cf59e0c5f%40%3Cdev.druid.apache.org%3E
CVE ID: CVE-2021-26920 State: PUBLISHED Published: 2021-07-02T07:20:13 Last Updated: 2024-08-03T20:33:41.311Z Vendors: Apache Software Foundation Products: Apache Druid Problem Types: Data accessible to unathorized parties Description: In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problemati
d directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r29e45561343cc5cf7d3290ee0b0e94e565faab19c20d022df9b5e29c%40%3Cdev.druid.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/07/02/1 - https://lists.apache.org/thread.html/r61aab724cf97d80da7f02d50e9af6d
/www.openwall.com/lists/oss-security/2021/07/02/1 - https://lists.apache.org/thread.html/r61aab724cf97d80da7f02d50e9af6de5c7c40dd92dab7518746fbaa2%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/rc9400a70d0ec5cdb8a3486fc5ddb0b5282961c0b63e764abfbcb9f5d%40%3Cdev.druid.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/09/24/1 - https://lists.apache.org/thread.html/r304dfe56a5dfe1b2d9166b24d2c74ad1c6730338b20aef77a00ed2be%40%3Cannounce.apache.org%3E
CVE ID: CVE-2021-26921 State: PUBLISHED Published: 2021-02-09T14:08:55 Last Updated: 2024-08-03T20:33:41.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/argoproj/argo-cd/compare/v1.8.3...v1.8.4 - https://github.com/argoproj/argo-cd/commit/f5b0db240b4e3abf18e97f6fd99096b4f9e94dc5 - https://github.com/argoproj/argo-cd/security/advisories/GHSA-9h6w-j7w4-jr52
CVE ID: CVE-2021-26923 State: PUBLISHED Published: 2021-03-15T14:40:02 Last Updated: 2024-08-03T20:33:41.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this endpoint is not protected with authentication. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/argoproj/argo-cd/compare/v1.8.3...v1.8.4 - https://github.com/argoproj/argo-cd/security/advisories/GHSA-pfgj-mh5m-2p48
CVE ID: CVE-2021-26924 State: PUBLISHED Published: 2021-03-15T14:42:59 Last Updated: 2024-08-03T20:33:41.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/argoproj/argo-cd/compare/v1.8.3...v1.8.4 - https://github.com/argoproj/argo-cd/security/advisories/GHSA-pg99-h5gc-446r
CVE ID: CVE-2021-26925 State: PUBLISHED Published: 2021-02-09T08:53:14 Last Updated: 2024-08-03T20:33:41.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering. Additional Analyst Notes: - CVE Program Container: References: - https://roundcube.net/news/2021/02/08/security-update-1.4.11 - https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1bac6fbd683c6d596 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/ - https://lists.fedoraproject.org/archives/list/package-an
s.fedoraproject.org/message/5QPAMYM2DQODSCQIAVNFJR2ETG7WMJOD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q752JPOHTR6H72FK3EIPJZ5O24Z7RGLM/
CVE ID: CVE-2021-26926 State: PUBLISHED Published: 2021-02-23T17:43:25 Last Updated: 2024-08-03T20:33:41.324Z Vendors: n/a Products: jasper Problem Types: CWE-125 Description: A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of information or program crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jasper-software/jasper/issues/264 - https://github.com/jasper-software/jasper/commit/41f214b121b837fa30d9ca5f2430212110f5cd9b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYVCFVTVPL66OS7LCNLUSYCMYQAVWXMM/ - https://lists.f
org/archives/list/package-announce%40lists.fedoraproject.org/message/JYVCFVTVPL66OS7LCNLUSYCMYQAVWXMM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRZFZSJ4UVLLMXSKHR455TAC2SD3TOHI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSXESYUHMO522Z3RHXOQ2SJNWP3XTO67/
CVE ID: CVE-2021-26927 State: PUBLISHED Published: 2021-02-23T19:03:29 Last Updated: 2024-08-03T20:33:41.507Z Vendors: n/a Products: jasper Problem Types: CWE-476 Description: A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jasper-software/jasper/commit/41f214b121b837fa30d9ca5f2430212110f5cd9b - https://github.com/jasper-software/jasper/issues/265 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYVCFVTVPL66OS7LCNLUSYCMYQAVWXMM/ - https://lists.fedoraproject.org/ar
ackage-announce%40lists.fedoraproject.org/message/JYVCFVTVPL66OS7LCNLUSYCMYQAVWXMM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRZFZSJ4UVLLMXSKHR455TAC2SD3TOHI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSXESYUHMO522Z3RHXOQ2SJNWP3XTO67/
CVE ID: CVE-2021-26928 State: PUBLISHED Published: 2021-06-04T20:13:28 Last Updated: 2024-08-03T20:33:41.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: BIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. Because of this, products that use BIRD (which may, for example, include Tigera products in some configurations, as well as products of other vendors) may have been susceptible to route redirection for Denial of Service and/or Information Disclosure. NOTE: a researcher has asserted that the behavior is within Tigera’s area of responsibility; however, Tigera disagrees Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Cont
area of responsibility; however, Tigera disagrees Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cyberark.com/resources/threat-research-blog/attacking-kubernetes-clusters-through-your-network-plumbing-part-2
CVE ID: CVE-2021-26929 State: PUBLISHED Published: 2021-02-14T03:43:49 Last Updated: 2024-08-03T20:33:41.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke use of \x00\x00\x00 and \x01\x01\x01 interferes with XSS defenses. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/horde/webmail/releases - https://www.horde.org/apps/webmail - https://www.alexbir
iner: References: - https://github.com/horde/webmail/releases - https://www.horde.org/apps/webmail - https://www.alexbirnberg.com/horde-xss.html - https://lists.horde.org/archives/announce/2021/001298.html - https://lists.debian.org/debian-lts-announce/2021/02/msg00028.html - http://packetstormsecurity.com/files/162187/Webmail-Edition-5.2.22-XSS-Remote-Code-Execution.html - http://packetstormsecurity.com/files/162194/Horde-Groupware-Webmail-5.2.22-Cross-Site-Scripting.html
CVE ID: CVE-2021-26930 State: PUBLISHED Published: 2021-02-17T00:00:00 Last Updated: 2024-08-03T20:33:41.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from th
ce that wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error. This affects drivers/block/xen-blkback/blkback.c. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-365.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/ - https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html - https://security.netapp.com/advisory/ntap-20210326-0001/ - https://lists.d
g/debian-lts-announce/2021/03/msg00010.html - https://security.netapp.com/advisory/ntap-20210326-0001/ - https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=871997bc9e423f05c7da7c9178e62dde5df2a7f8
CVE ID: CVE-2021-26931 State: PUBLISHED Published: 2021-02-17T00:00:00 Last Updated: 2024-08-03T20:33:41.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn't correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c. Additional An