Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-10702 State: PUBLISHED Published: 2020-06-04T17:31:05 Last Updated: 2024-08-04T11:06:11.188Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: The QEMU Project Products: qemu Problem Types: CWE-325 Description: A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU. Additiona
nature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10702 - https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=de0b1bae6461f67243282555475f88b2384a1eb9 - https://security.netapp.com/advisory/ntap-20200724-0007/
CVE ID: CVE-2020-10703 State: PUBLISHED Published: 2020-06-02T00:00:00 Last Updated: 2024-08-04T11:06:11.183Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: libvirt Products: libvirt Problem Types: CWE-476 Description: A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial
ged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10703 - https://bugzilla.redhat.com/show_bug.cgi?id=1790725 - https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=dfff16a7c261f8d28e3abe60a47165f845fa952f - https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=5d5c732d748d644ec14626bce448e84bdc4bd93e - https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=7aa0e8c0cb8a6293d0c6f7e3d29c13b96dec2129 - https://security.netapp.com/advisory/ntap-20200608-0005/ - https://lists.fedoraproject.org/archi
6f7e3d29c13b96dec2129 - https://security.netapp.com/advisory/ntap-20200608-0005/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5GE6ISYUL3CIWO3FQRUGMKTKP2NYED2/ - https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
CVE ID: CVE-2020-10704 State: PUBLISHED Published: 2020-05-06T00:00:00 Last Updated: 2024-08-04T11:06:11.201Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: samba Problem Types: CWE-674 Description: A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerability is to system availability. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2. Additional Analyst Notes: - CVE Progr
issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7DVGCHG3XPIBQ5ETGMGW7MXNOO4HFH4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5KW3ZO35NVDO57JSBZHTQZOS3AIQ5QE/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html - https://security.gentoo.org/glsa/202007-15 - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html - https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html - https://bugzilla.r
announce/2020-09/msg00002.html - https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10704 - https://www.samba.org/samba/security/CVE-2020-10704.html
CVE ID: CVE-2020-10705 State: PUBLISHED Published: 2020-06-10T19:29:12 Last Updated: 2024-08-04T11:06:11.149Z Vendors: n/a Products: Undertow Problem Types: Uncontrolled Resource Consumption Description: A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1803241 - https://security.netapp.com/advisory/ntap-20220210-0014/
CVE ID: CVE-2020-10706 State: PUBLISHED Published: 2020-05-12T13:48:36 Last Updated: 2024-08-04T11:06:11.155Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: openshift/openshift-apiserver Problem Types: CWE-312 Description: A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via the WebUI or via the command line in the last 24 hours. Once the backup is older than 24 hours the OAuth tokens are no longer
bUI or via the command line in the last 24 hours. Once the backup is older than 24 hours the OAuth tokens are no longer valid. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10706
CVE ID: CVE-2020-10707 State: REJECTED Published: 2020-04-16T13:59:15 Last Updated: 2020-04-16T13:59:15 Description: No description available.
CVE ID: CVE-2020-10708 State: REJECTED Published: 2020-06-10T14:14:15 Last Updated: 2020-06-10T14:14:15 Description: No description available.
CVE ID: CVE-2020-10709 State: PUBLISHED Published: 2021-05-27T18:46:02 Last Updated: 2024-08-04T11:06:11.168Z Vendors: n/a Products: Tower Problem Types: CWE-287 Description: A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication. This flaw allows an attacker to obtain a refresh token that does not expire. The original token granted to the user still has access to Ansible Tower, which allows any user that can gain access to the token to be fully authenticated to Ansible Tower. This flaw affects Ansible Tower versions before 3.6.4 and Ansible Tower versions before 3.5.6. Additional Analyst N
wer. This flaw affects Ansible Tower versions before 3.6.4 and Ansible Tower versions before 3.5.6. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1824033
CVE ID: CVE-2020-10710 State: PUBLISHED Published: 2022-08-16T00:00:00 Last Updated: 2024-08-04T11:06:11.148Z Vendors: n/a Products: foreman-installer Problem Types: CWE-522 Description: A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through the satellite-installer. This flaw allows an attacker with sufficiently high privileges, such as root, to retrieve the Candlepin plaintext password. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1816747
CVE ID: CVE-2020-10711 State: PUBLISHED Published: 2020-05-22T14:09:46 Last Updated: 2024-08-04T11:14:14.192Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Kernel Problem Types: CWE-476 Description: A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is pre
p tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10711 - https://www.openwall.com/lists/oss-security/2020/05/12/2 - https://security.netapp.com/advisory/ntap-20200608-0001/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://www.debia
om/advisory/ntap-20200608-0001/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://www.debian.org/security/2020/dsa-4698 - https://www.debian.org/security/2020/dsa-4699 - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html - https://usn.ubuntu.com/4413-1/ - https://usn.ubuntu.com/4411-1/ - https://usn.ubuntu.com/4412-1/ - https://usn.ubuntu.com/4419-1/ - https://usn.ubuntu.com/4414-1/
CVE ID: CVE-2020-10712 State: PUBLISHED Published: 2020-04-22T15:29:40 Last Updated: 2024-08-04T11:14:14.214Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: Red Hat Products: openshift/cluster-image-registry-operator Problem Types: CWE-532 Description: A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry operator allowing an attacker able to gain access to those logs, to read and write to the storage backing the internal image registry. The highest threat from this vulnerability is to data integrity. Additional Analyst Notes: - CVE Program Container: References: - https://bugz
m this vulnerability is to data integrity. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10712
CVE ID: CVE-2020-10713 State: PUBLISHED Published: 2020-07-30T12:58:30 Last Updated: 2024-08-04T11:14:14.235Z Vendors: n/a Products: Grub Problem Types: Out-of-bounds Write leading to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Description: A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote acce
ccess to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2020/dsa-4735 - http://www.openwall.com/lists/oss-security/2020/07/29/3 - https://bugzilla.redhat.com/show_bug.cgi?id=1825243 - https://www.kb.cert.org/vuls
com/lists/oss-security/2020/07/29/3 - https://bugzilla.redhat.com/show_bug.cgi?id=1825243 - https://www.kb.cert.org/vuls/id/174059 - https://security.netapp.com/advisory/ntap-20200731-0008/ - https://usn.ubuntu.com/4432-1/ - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-grub2-code-exec-xLePCAPY - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html - https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/ - https://kb.vmware.com/s/article/80181 - https://cve.openeuler.org/#/CVEInfo/CVE-2020-10713 - https://security.gentoo.org/glsa/202104-05
CVE ID: CVE-2020-10714 State: PUBLISHED Published: 2020-09-23T12:28:17 Last Updated: 2024-08-04T11:14:14.215Z Vendors: n/a Products: wildfly-elytron Problem Types: CWE-384 Description: A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1825714 - https://security.netapp.com/advisory/ntap-20201223-0002/
CVE ID: CVE-2020-10715 State: PUBLISHED Published: 2020-09-16T18:00:27 Last Updated: 2024-08-04T11:14:14.279Z Vendors: n/a Products: openshift/console Problem Types: CWE-20 Description: A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft a URL and inject arbitrary text onto the error page that appears to be from the OpenShift instance. This attack could potentially convince a user that the inserted text is legitimate. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openshift/origin-web-console/pull/3173 - https://bugzilla.redhat.com/show_bug.cgi?id=1767665
CVE ID: CVE-2020-10716 State: PUBLISHED Published: 2021-05-27T18:46:07 Last Updated: 2024-08-04T11:14:14.168Z Vendors: n/a Products: rubygem-foreman_ansible Problem Types: CWE-285 Description: A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects tfm-rubygem-foreman_ansible versions before 4.0.3.4. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1827300 - https://bugzilla.redhat.com/show_bug.cgi?id=
tainer: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1827300 - https://bugzilla.redhat.com/show_bug.cgi?id=1814998
CVE ID: CVE-2020-10717 State: PUBLISHED Published: 2020-05-04T00:00:00 Last Updated: 2024-08-04T11:14:14.837Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: The QEMU Project Products: QEMU Problem Types: CWE-770 Description: A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs is meant to share a host file system directory with a guest via virtio-fs device. If the guest opens the maximum number of file descriptors under the shared directory, a denial of service may occur. This flaw allows a guest user/process to cause this denial of service on the host. Additional Analyst No
vice may occur. This flaw allows a guest user/process to cause this denial of service on the host. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/202011-09 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10717 - https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg00143.html - https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg00141.html - https://www.openwall.com/lists/oss-security/2020/05/04/1
CVE ID: CVE-2020-10718 State: PUBLISHED Published: 2020-09-16T18:06:26 Last Updated: 2024-08-04T11:14:14.762Z Vendors: n/a Products: Wildfly Problem Types: Exposed Dangerous Method or Function Description: A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1828476
CVE ID: CVE-2020-10719 State: PUBLISHED Published: 2020-05-26T14:57:51 Last Updated: 2024-08-04T11:14:14.887Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: undertow Problem Types: CWE-444 Description: A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10719 - https://security.netapp.com/advisory/ntap-20220210-0014/
CVE ID: CVE-2020-10720 State: PUBLISHED Published: 2020-09-03T17:49:04 Last Updated: 2024-08-04T11:14:14.213Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with local access to crash the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1781204 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4270d6795b0580287453ea55974d948393e66ef
CVE ID: CVE-2020-10721 State: PUBLISHED Published: 2020-10-22T20:00:48 Last Updated: 2024-08-04T11:14:14.240Z Vendors: n/a Products: fabric8-maven-plugin Problem Types: CWE-502 Description: A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of untrusted data resulting in arbitrary code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/sho
as system availability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1827201
CVE ID: CVE-2020-10722 State: PUBLISHED Published: 2020-05-19T18:04:15 Last Updated: 2024-08-04T11:14:14.909Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: [UNKNOWN] Products: dpdk Problem Types: CWE-190 Description: A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/4362-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html - https://lists.fedoraproject.org/archives/list/package
ts.opensuse.org/opensuse-security-announce/2020-05/msg00045.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10722 - https://www.openwall.com/lists/oss-security/2020/05/18/2 - https://bugs.dpdk.org/show_bug.cgi?id=267 - https://www.oracle.com/security-alerts/cpujan2021.html
CVE ID: CVE-2020-10723 State: PUBLISHED Published: 2020-05-19T18:02:46 Last Updated: 2024-08-04T11:14:14.697Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: [UNKNOWN] Products: dpdk Problem Types: CWE-190 Description: A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and truncated into a uint16, which can lead to out of bound indexing and possible memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/4362-1/ - http://lists.opensuse.org/opensuse-security-anno
- CVE Program Container: References: - https://usn.ubuntu.com/4362-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.openwall.com/lists/oss-security/2020/05/18/2 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10723 - https://bugs.dpdk.org/show_bug.cgi?id=268 - https://www.oracle.com/security-alerts/cpujan2021.html
CVE ID: CVE-2020-10724 State: PUBLISHED Published: 2020-05-19T17:59:21 Last Updated: 2024-08-04T11:14:15.210Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: [UNKNOWN] Products: dpdk Problem Types: CWE-190 Description: A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/4362-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html - https://lists.fedoraproject.org/archives/list/package-
s.opensuse.org/opensuse-security-announce/2020-05/msg00045.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.openwall.com/lists/oss-security/2020/05/18/2 - https://bugs.dpdk.org/show_bug.cgi?id=269 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10724 - https://www.oracle.com/security-alerts/cpujan2021.html
CVE ID: CVE-2020-10725 State: PUBLISHED Published: 2020-05-20T13:16:55 Last Updated: 2024-08-04T11:14:14.236Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: dpdk Problem Types: CWE-665 Description: A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend application running on the host, which could result in a loss of connectivity for the other guests running on that host. This is caused by a missing validity check of the descriptor address in the function `virtio_dev_rx_batch_packed()`. Additional Analyst Notes: - CVE Program Container: References: - http://list
he function `virtio_dev_rx_batch_packed()`. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HRHKFVV4MRWNNJOYQOVP64L4UVWYPEO4/ - https://www.openwall.com/lists/oss-security/2020/05/18/2 - https://www.oracle.com/security-alerts/cpujan2021.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10725 - https://bugs.dpdk.org/show_bug.cgi?id=270
CVE ID: CVE-2020-10726 State: PUBLISHED Published: 2020-05-20T13:04:47 Last Updated: 2024-08-04T11:14:15.435Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: dpdk Problem Types: CWE-190 Description: A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak (file descriptors and virtual memory), which may result in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00045.html - https://lists.fedor