Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpujul2020.html - https://github.com/FasterXML/jackson-databind/issues/2659 - https://security.netapp.com/advisory/ntap-20200403-0002/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-10673 State: PUBLISHED Published: 2020-03-18T21:17:26.000Z Last Updated: 2025-08-27T20:32:51.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2020/03/msg00027.html - https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpujul2020.html - https://security.n
here-is-what-you-need-to-know-54cd0d6e8062 - https://www.oracle.com/security-alerts/cpujul2020.html - https://security.netapp.com/advisory/ntap-20200403-0002/ - https://github.com/FasterXML/jackson-databind/issues/2660 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2020-10674 State: PUBLISHED Published: 2020-03-18T21:30:20 Last Updated: 2024-08-04T11:06:11.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: PerlSpeak through 2.01 allows attackers to execute arbitrary OS commands, as demonstrated by use of system and 2-argument open. Additional Analyst Notes: - CVE Program Container: References: - https://rt.cpan.org/Public/Bug/Display.html?id=132173 - https://metacpan.org/source/JKAMPHAUS/PerlSpeak-2.01/Changes
CVE ID: CVE-2020-10675 State: PUBLISHED Published: 2020-03-19T13:27:20 Last Updated: 2024-08-04T11:06:10.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/buger/jsonparser/issues/188 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4C7PV6KEUUM76V4B2J5IFN2U6LEOWB67/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KUHKDQSEYJNROA66OMN6AAQMGAAN6WI/
CVE ID: CVE-2020-10676 State: PUBLISHED Published: 2023-12-12T00:00:00 Last Updated: 2024-08-04T11:06:10.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project. Additional Analyst Notes: - CVE Program Container: References: - https://forums.rancher.com/c/announcements - https://github.com/advisories/GHSA-8vhc-hwhc-cpj4 - https://github.com/rancher/rancher/releases/tag/v2.6.13 - https://github.com/rancher/rancher/releases/tag/v2.7.4
CVE ID: CVE-2020-10678 State: PUBLISHED Published: 2020-03-19T14:31:18 Last Updated: 2024-08-04T11:06:10.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user can leverage a bug to escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues/issues/6258
CVE ID: CVE-2020-10681 State: PUBLISHED Published: 2020-03-20T03:39:36 Last Updated: 2024-08-04T11:06:10.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12274
CVE ID: CVE-2020-10682 State: PUBLISHED Published: 2020-03-20T03:39:49 Last Updated: 2024-08-04T11:06:11.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file). Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12275
CVE ID: CVE-2020-10683 State: PUBLISHED Published: 2020-05-01T18:55:25 Last Updated: 2024-08-04T11:06:11.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://cheatsheetseries.owasp.org/cheatsheets/XML_Ext
1.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html - https://bugzilla.redhat.com/show_bug.cgi?id=1694235 - https://github.com/dom4j/dom4j/releases/tag/version-2.1.3 - https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658 - https://security.netapp.com/advisory/ntap-20200518-0002/ - https://usn.ubuntu.com/4575-1/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://github.com/dom4j/dom4j/issues/87 - https://github.com/dom4j/dom4j/commits/version-2.0.3 - https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%
/commits/version-2.0.3 - https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E - https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan20
apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-10684 State: PUBLISHED Published: 2020-03-24T00:00:00 Last Updated: 2024-08-04T11:06:10.659Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H) Vendors: Red Hat Products: Ansible Problem Types: CWE-94, CWE-862, CWE-362 Description: A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalat
altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/ - https://security.gentoo.org/glsa/202006-11 - https://www.debian.org/security/2021/dsa-4950 -
LPBXCYG6CFP35D64NP2UB2S/ - https://security.gentoo.org/glsa/202006-11 - https://www.debian.org/security/2021/dsa-4950 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10684
CVE ID: CVE-2020-10685 State: PUBLISHED Published: 2020-05-11T00:00:00 Last Updated: 2024-08-04T11:06:10.628Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Ansible Problem Types: CWE-459 Description: A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a t
ules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/202006-11 - https://www.debian.org/security/2021/dsa-4950 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10685 - https://github.com/ansible/ansible/pull/68433
CVE ID: CVE-2020-10686 State: PUBLISHED Published: 2020-05-04T20:05:37 Last Updated: 2024-08-04T11:06:10.651Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Keycloak Products: keycloak Problem Types: CWE-285 Description: A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10686
CVE ID: CVE-2020-10687 State: PUBLISHED Published: 2020-09-23T12:30:43 Last Updated: 2024-08-04T11:06:11.126Z Vendors: n/a Products: Undertow Problem Types: CWE-444 Description: A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1785049 - https://lists.apache.org/thread
E Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1785049 - https://lists.apache.org/thread.html/r6603513ea8afbf6857fd77ca5888ec8385d0af493baa4250e28c351c%40%3Cdev.cxf.apache.org%3E - https://security.netapp.com/advisory/ntap-20220210-0015/
CVE ID: CVE-2020-10688 State: PUBLISHED Published: 2021-05-27T18:45:41 Last Updated: 2024-08-04T11:06:11.147Z Vendors: n/a Products: RESTEasy Problem Types: CWE-79 Description: A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1814974 - https://github.com/quarkusio/quarkus/issues/7248 - https://issues.redhat.com/browse/RESTEASY-2519 - https://security.netapp.com/advisory/n
/quarkusio/quarkus/issues/7248 - https://issues.redhat.com/browse/RESTEASY-2519 - https://security.netapp.com/advisory/ntap-20210706-0008/
CVE ID: CVE-2020-10689 State: PUBLISHED Published: 2020-04-03T14:29:59 Last Updated: 2024-08-04T11:06:11.157Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Eclipse Che Problem Types: CWE-862 Description: A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypass JWT proxy and gain access to the workspace pods of another user. Successful exploitation requires knowledge of the service name and namespace of the target pod. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=
arget pod. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10689 - https://github.com/eclipse/che/issues/15651
CVE ID: CVE-2020-10690 State: PUBLISHED Published: 2020-05-08T13:48:30 Last Updated: 2024-08-04T11:06:11.142Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: kernel Problem Types: CWE-416 Description: There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to th
an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10690 - https://security.netapp.com/advisory/ntap-20200608-0001/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html - https://usn.ubuntu.com/4419-1/
CVE ID: CVE-2020-10691 State: PUBLISHED Published: 2020-04-30T16:23:36 Last Updated: 2024-08-04T11:06:11.130Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: Red Hat Products: Ansible Problem Types: CWE-22 Description: An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691 - https://g
yst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691 - https://github.com/ansible/ansible/pull/68596
CVE ID: CVE-2020-10692 State: REJECTED Published: N/A Last Updated: 2023-01-19T00:00:00 Description: No description available.
CVE ID: CVE-2020-10693 State: PUBLISHED Published: 2020-05-06T13:03:33 Last Updated: 2024-08-04T11:06:11.169Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Hibernate Products: hibernate-validator Problem Types: CWE-20 Description: A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages. Additional Analyst Notes: - CVE Program Container: References: - https://lists.a
user-controlled data in error messages. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rf9c17c3efc4a376a96e9e2777eee6acf0bec28e2200e4b35da62de4a%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/rd418deda6f0ebe658c2015f43a14d03acb8b8c2c093c5bf6b880cd7c%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/rb8dca19a4e52b60dab0ab21e2ff9968d78f4b84e4033824db1dd24b4%40%3Cpluto-scm.portals.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2022.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10693
CVE ID: CVE-2020-10694 State: REJECTED Published: N/A Last Updated: 2023-01-19T00:00:00 Description: No description available.
CVE ID: CVE-2020-10695 State: PUBLISHED Published: 2021-05-26T21:35:27 Last Updated: 2024-08-04T11:06:11.103Z Vendors: n/a Products: containers/redhat-sso-7 Problem Types: CWE-266 Description: An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can use this flaw to modify the /etc/passwd and escalate their privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1817530
CVE ID: CVE-2020-10696 State: PUBLISHED Published: 2020-03-31T21:01:22 Last Updated: 2024-08-04T11:06:11.148Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: buildah Problem Types: CWE-22 Description: A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10696 - https://github.com/containers/buildah/pull/2245 - https:
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10696 - https://github.com/containers/buildah/pull/2245 - https://access.redhat.com/security/cve/cve-2020-10696
CVE ID: CVE-2020-10697 State: PUBLISHED Published: 2021-05-27T18:45:46 Last Updated: 2024-08-04T11:06:11.154Z Vendors: n/a Products: Tower Problem Types: CWE-862 Description: A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage of writing a playbook polluting this cache, causing a denial of service attack. This attack would not completely stop the service, but in the worst-case scenario, it can reduce the Tower performance, for which memcached is designed. Theoretically, more sophisticated attacks can be performed by manipulating and crafting the cache, as Tower relies on memcached as a place to pull out s
d attacks can be performed by manipulating and crafting the cache, as Tower relies on memcached as a place to pull out setting values. Confidential and sensitive data stored in memcached should not be pulled, as this information is encrypted. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1818445
CVE ID: CVE-2020-10698 State: PUBLISHED Published: 2021-05-27T18:45:51 Last Updated: 2024-08-04T11:06:11.170Z Vendors: n/a Products: Tower Problem Types: CWE-200 Description: A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the no_log flag when debugging is enabled. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6. Additional Analyst Notes: - CVE Program Container: References: - https:/
3.5.6 and Ansible Tower versions before 3.4.6. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1818924
CVE ID: CVE-2020-10699 State: PUBLISHED Published: 2020-04-15T00:00:00 Last Updated: 2024-08-04T11:06:11.137Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Datera, Inc Products: targetcli Problem Types: CWE-732 Description: A flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by targetclid was world-writable. If a system enables the targetclid socket, a local attacker can use this flaw to modify the iSCSI configuration and escalate their privileges to root. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/202008-22 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10
iner: References: - https://security.gentoo.org/glsa/202008-22 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10699 - https://github.com/open-iscsi/targetcli-fb/issues/162
CVE ID: CVE-2020-10700 State: PUBLISHED Published: 2020-05-04T20:03:50 Last Updated: 2024-08-04T11:06:11.140Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: samba Problem Types: CWE-416 Description: A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10700 - https://www.samba.o
- CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10700 - https://www.samba.org/samba/security/CVE-2020-10700.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WG54NRMES2GTURZKZH6H4BGXCD3OMJDJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y7DVGCHG3XPIBQ5ETGMGW7MXNOO4HFH4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5KW3ZO35NVDO57JSBZHTQZOS3AIQ5QE/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html - https://security.gentoo.org/glsa/202007-15 - http://lists.opensu
.org/opensuse-security-announce/2020-07/msg00054.html - https://security.gentoo.org/glsa/202007-15 - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html
CVE ID: CVE-2020-10701 State: PUBLISHED Published: 2021-05-27T18:45:56 Last Updated: 2024-08-04T11:06:11.116Z Vendors: n/a Products: libvirt Problem Types: CWE-862 Description: A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-only connections to adjust the time that libvirt waits for the QEMU guest agent to respond to agent commands. Depending on the timeout value that is set, this flaw can make guest agent commands fail because the agent cannot respond in time. Unprivileged users with a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero, potential
a read-only connection could abuse this flaw to set the response timeout for all guest agent messages to zero, potentially leading to a denial of service. This flaw affects libvirt versions before 6.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1819163 - https://security.netapp.com/advisory/ntap-20210708-0001/