Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-13006 State: PUBLISHED Published: 2020-03-10T16:57:39 Last Updated: 2024-08-04T23:41:09.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to view the number of related merge requests on an issue. It has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/
CVE ID: CVE-2019-13007 State: PUBLISHED Published: 2020-03-10T17:03:04 Last Updated: 2024-08-04T23:41:10.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering an action that leads to resource depletion. It allows Uncontrolled Resource Consumption. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/
CVE ID: CVE-2019-13009 State: PUBLISHED Published: 2020-03-10T17:06:14 Last Updated: 2024-08-04T23:41:10.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible to unauthorized users due to improper permission settings. It has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/
CVE ID: CVE-2019-13010 State: PUBLISHED Published: 2020-03-10T17:07:50 Last Updated: 2024-08-04T23:41:09.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2. The color codes decoder was vulnerable to a resource depletion attack if specific formats were used. It allows Uncontrolled Resource Consumption. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/
CVE ID: CVE-2019-13011 State: PUBLISHED Published: 2020-03-10T17:09:40 Last Updated: 2024-08-04T23:41:09.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could create a list of merge requests template names. It has excessive algorithmic complexity. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/releases/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/
CVE ID: CVE-2019-13012 State: PUBLISHED Published: 2019-06-28T14:07:42 Last Updated: 2024-08-04T23:41:09.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450. Additional Analyst Notes:
ons are used; for files, default file permissions are used. This is similar to CVE-2019-12450. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/glib/issues/1658 - https://gitlab.gnome.org/GNOME/glib/merge_requests/450 - https://gitlab.gnome.org/GNOME/glib/commit/5e4da714f00f6bfb2ccd6d73d61329c6f3a08429 - https://usn.ubuntu.com/4049-1/ - https://usn.ubuntu.com/4049-2/ - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00022.html - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931234#12 - https://lists.debian.org/debian-lts-announce/2019/07/msg00029.html - https://lists.debian.org/debian-lts-announce/2019/08/msg00004.html - http
rg/debian-lts-announce/2019/07/msg00029.html - https://lists.debian.org/debian-lts-announce/2019/08/msg00004.html - https://security.netapp.com/advisory/ntap-20190806-0003/ - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2019-13013 State: PUBLISHED Published: 2019-08-23T16:58:49 Last Updated: 2024-08-04T23:41:10.198Z Vendors: n/a Products: Little Snitch Problem Types: CWE-264 Description: Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings and copying files as root. Additional Analyst Notes: - CVE Program Container: References: - https://obdev.at/cve/2019-13013-OSv2mEFD3z.html
CVE ID: CVE-2019-13014 State: PUBLISHED Published: 2019-08-23T16:55:55 Last Updated: 2024-08-04T23:41:10.142Z Vendors: n/a Products: Little Snitch Problem Types: CWE-264 Description: Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the privileged helper which is not removed or updated immediately. Computers may therefore still be vulnerable after upgrading to 4.4.0. Version 4.4.1 fixes this issue by removing the operating system's copy during the upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://obdev.at/cve/2019-13014-MzE24Ify4p.html
CVE ID: CVE-2019-13020 State: PUBLISHED Published: 2019-08-26T17:11:57 Last Updated: 2024-08-04T23:41:10.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: The fetch API in Tightrope Media Carousel before 7.1.3 has CarouselAPI/v0/fetch?url= SSRF. This has two potential areas for abuse. First, a specially crafted URL could be used in a phishing attack to hijack the trust the user and the browser have with the website and could serve malicious content from a third-party attacker-controlled system. Second, arguably more severe, is the potential for an attacker to circumvent firewall controls, by proxying traffic, unauthenticated, into the internal network from the internet. Additio
circumvent firewall controls, by proxying traffic, unauthenticated, into the internal network from the internet. Additional Analyst Notes: - CVE Program Container: References: - https://www.carouselsignage.com/release-notes/carousel-7-1-3
CVE ID: CVE-2019-13021 State: PUBLISHED Published: 2020-05-14T16:16:04 Last Updated: 2024-08-04T23:41:10.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem, rather than encrypted within the MySQL database. This backup copy of the passwords is made as part of the installation script, after the administrator has generated a password using ENCtool.jar (see CVE-2019-13022). This allows any low-privilege user who can read this file to trivially obtain the passwords for the administrative accounts of the JetSelect application. The path to the file containing the enco
ain the passwords for the administrative accounts of the JetSelect application. The path to the file containing the encoded password hash is /opt/JetSelect/SFC/resources/sfc-general-properties. Additional Analyst Notes: - CVE Program Container: References: - https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/
CVE ID: CVE-2019-13022 State: PUBLISHED Published: 2020-05-14T16:18:16 Last Updated: 2024-08-04T23:41:10.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorithm (used to set initial passwords upon first installation). It XORs the plaintext into the 'encrypted' password that is then stored within the database. These steps are able to be trivially reversed, allowing for escalation of privilege within the JetSelect application through obtaining the passwords of JetSelect administrators. JetSelect administrators have the ability to modify and delete all networking co
passwords of JetSelect administrators. JetSelect administrators have the ability to modify and delete all networking configuration across a vessel, as well as altering network configuration of all managed network devices (switches, routers). Additional Analyst Notes: - CVE Program Container: References: - https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/
CVE ID: CVE-2019-13023 State: PUBLISHED Published: 2020-05-14T16:20:27 Last Updated: 2024-08-04T23:41:10.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in all versions of Bond JetSelect. Within the JetSelect Application, the web interface hides RADIUS secrets, WPA passwords, and SNMP strings from 'non administrative' users using HTML 'password field' obfuscation. By using Developer tools or similar, it is possible to change the obfuscation so that the credentials are visible. Additional Analyst Notes: - CVE Program Container: References: - https://labs.nettitude.com/blog/cve-2019-13021-22-23-jetselect-network-segregation-application/
CVE ID: CVE-2019-13024 State: PUBLISHED Published: 2019-07-01T18:17:05 Last Updated: 2024-08-04T23:41:10.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands). Additional Analyst N
e database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands). Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/mhaskar/c4255f6cf45b19b8a852c780f50576da - https://shells.systems/centreon-v19-04-remote-code-execution-cve-2019-13024/ - http://packetstormsecurity.com/files/153504/Centreon-19.04-Remote-Code-Execution.html - https://github.com/centreon/centreon/pull/7694 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04/centreon-19.04.3.html - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.6.html
CVE ID: CVE-2019-13025 State: PUBLISHED Published: 2019-10-02T14:54:46 Last Updated: 2024-08-04T23:41:10.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. The attacker can send a maliciously modified POST (HTTP) request containing shell commands, which will be executed on the device, to an backend API endpoint of the cable modem. Additional Analyst Notes: - CVE Program Container: References: - https://xitan.me/posts/connect-box-ch7465lg-rce/
CVE ID: CVE-2019-13026 State: PUBLISHED Published: 2019-07-30T19:39:25 Last Updated: 2024-08-04T23:41:09.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker. This includes all shopping cart options, customer data, and the database. No interaction between the attacker and the victim is necessary. Additional Analyst Notes: - CVE Program Container: References: - https://oxidforge.org/en/security-bulletin-2019-001.html
CVE ID: CVE-2019-13027 State: PUBLISHED Published: 2019-07-12T14:03:01 Last Updated: 2024-08-04T23:41:10.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: Realization Concerto Critical Chain Planner (aka CCPM) 5.10.8071 has SQL Injection in at least in the taskupdt/taskdetails.aspx webpage via the projectname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/IckoGZ/CVE-2019-13027/blob/master/README.md
CVE ID: CVE-2019-13028 State: PUBLISHED Published: 2019-06-28T21:23:46 Last Updated: 2024-08-04T23:41:10.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect implementation of a local web server in eID client (Windows version before 3.1.2, Linux version before 3.0.3) allows remote attackers to execute arbitrary code (.cgi, .pl, or .php) or delete arbitrary files via a crafted HTML page. This is a product from the Ministry of Interior of the Slovak Republic. Additional Analyst Notes: - CVE Program Container: References: - https://www.csirt.gov.sk/aktualne-7d7.html?id=194 - https://www.csirt.gov.sk/doc/eid_klient_tlacova_sprava.pdf - https://www.minv.sk/?tlacove-spravy&
alne-7d7.html?id=194 - https://www.csirt.gov.sk/doc/eid_klient_tlacova_sprava.pdf - https://www.minv.sk/?tlacove-spravy&sprava=pouzivatelom-e-sluzieb-automaticky-aktualizujeme-aplikaciu-pre-elektronicky-obciansky-preukaz
CVE ID: CVE-2019-13029 State: PUBLISHED Published: 2019-07-11T18:52:33.000Z Last Updated: 2025-03-19T19:37:20.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/snippets/1874216 - http://packetstormsecurity.com/files/153691/REDCap-Cross-Site-Scripting.html - https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2019-13029/REDCap%20Cross%20Site%20Scripting.txt
CVE ID: CVE-2019-13030 State: PUBLISHED Published: 2019-08-14T20:17:35 Last Updated: 2024-08-04T23:41:10.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.js process, resulting in the ability to obtain mediola configuration details. This is related to improper access control for addons configuration pages and a missing check in rc.d/97NeoServer. Additional Analyst Notes: - CVE Program Container: References: - https://psytester.github.io/CVE-2019-13030/ - https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentest
ster.github.io/CVE-2019-13030/ - https://github.com/psytester/psytester.github.io/blob/master/_posts/hacking_and_pentests/CVEs/2019-06-29-CVE-2019-13030.md
CVE ID: CVE-2019-13031 State: PUBLISHED Published: 2019-06-28T22:42:10 Last Updated: 2024-08-04T23:41:10.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server. By default, the notification server is not enabled and has a "deny all" rule. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1820 - https://lists.debian.org/debian-lts-announce/2019/07/msg00003.html - https://www.calypt.com/blog/index.php/cve-2019-13031-xxe-on-lemonldapng-2-0-5/
CVE ID: CVE-2019-13032 State: PUBLISHED Published: 2019-06-28T22:56:58 Last Updated: 2024-08-04T23:41:09.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Sigil-Ebook/flightcrew/issues/53 - https://salvatoresecurity.com/fun-with-fuzzers-or-how-i-discovered-three-vulnerabilities-part-1-of-3/ - https://usn.
3 - https://salvatoresecurity.com/fun-with-fuzzers-or-how-i-discovered-three-vulnerabilities-part-1-of-3/ - https://usn.ubuntu.com/4055-1/
CVE ID: CVE-2019-13033 State: PUBLISHED Published: 2020-06-18T17:30:46 Last Updated: 2024-08-04T23:41:10.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload the data of additional scans. Additional Analyst Notes: - CVE Program Container: References: - https://cisofy.com/security/cve/cve-2019-13033/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00024.html - https://lists.fedorapr
curity/cve/cve-2019-13033/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00024.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/
CVE ID: CVE-2019-13035 State: PUBLISHED Published: 2019-06-29T12:51:33 Last Updated: 2024-08-04T23:41:09.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standard users to create new files. Moreover, the Apache service httpd.exe will try to execute cmd.exe from C:\PandoraFMS (the current directory) as NT AUTHORITY\SYSTEM upon web requests to the portal. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://github.c
ate privileges to NT AUTHORITY\SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-008.md
CVE ID: CVE-2019-13038 State: PUBLISHED Published: 2019-06-29T00:00:00 Last Updated: 2024-08-04T23:41:10.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5E3JVHURJJNDP63CKVX5O5MJAGCQV4K/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XU5GVFZW3C2M4ZBL4F7UP7N24FNUCX4E/ - https://usn.ubuntu.com/4291-1/ - https://www.or
ce%40lists.fedoraproject.org/message/XU5GVFZW3C2M4ZBL4F7UP7N24FNUCX4E/ - https://usn.ubuntu.com/4291-1/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://github.com/Uninett/mod_auth_mellon/issues/35#issuecomment-503974885 - https://lists.debian.org/debian-lts-announce/2023/03/msg00010.html
CVE ID: CVE-2019-13044 State: REJECTED Published: 2019-06-29T13:46:23 Last Updated: 2019-07-15T13:37:50 Description: No description available.
CVE ID: CVE-2019-13045 State: PUBLISHED Published: 2019-06-29T13:58:05 Last Updated: 2024-08-04T23:41:10.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/irssi/irssi/commit/d23b0d22cc611e43c88d99192a59f413f951a955 - https://irssi.org/security/irssi_sa_2019_06.txt - http://www.openwall.com/lists/oss-security/2019/06/29/1 - https://seclists.org/bugtraq/2019/Jun/41 - http://packetstormsecurity.com/files/153480/Slackware-Security-Advisory-irssi-Updates.ht
lists.org/bugtraq/2019/Jun/41 - http://packetstormsecurity.com/files/153480/Slackware-Security-Advisory-irssi-Updates.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00004.html - http://www.securityfocus.com/bid/108998 - https://usn.ubuntu.com/4046-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00030.html
CVE ID: CVE-2019-13046 State: PUBLISHED Published: 2019-06-29T14:50:21 Last Updated: 2024-08-04T23:41:10.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: linker/linker.c in ToaruOS through 1.10.9 has insecure LD_LIBRARY_PATH handling in setuid applications. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mehsauce/kowasuos/blob/master/exploits/kowasu-linker.sh
CVE ID: CVE-2019-13047 State: PUBLISHED Published: 2019-06-29T14:50:33 Last Updated: 2024-08-04T23:41:10.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/sys/syscall.c in ToaruOS through 1.10.9 has incorrect access control in sys_sysfunc case 9 for TOARU_SYS_FUNC_SETHEAP, allowing arbitrary kernel pages to be mapped into user land, leading to root access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mehsauce/kowasuos/blob/master/exploits/kowasu-sysfunc.c
CVE ID: CVE-2019-13048 State: PUBLISHED Published: 2019-06-29T14:50:42 Last Updated: 2024-08-04T23:41:10.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: kernel/sys/syscall.c in ToaruOS through 1.10.9 allows a denial of service upon a critical error in certain sys_sbrk allocation patterns (involving PAGE_SIZE, and a value less than PAGE_SIZE). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mehsauce/kowasuos/blob/master/dos/kowasu-sbrk.c
CVE ID: CVE-2019-13049 State: PUBLISHED Published: 2019-06-29T14:50:53 Last Updated: 2024-08-04T23:41:10.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer wrap in kernel/sys/syscall.c in ToaruOS 1.10.10 allows users to map arbitrary kernel pages into userland process space via TOARU_SYS_FUNC_MMAP, leading to escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mehsauce/kowasuos/blob/master/exploits/kowasu-sysfunc-revenge.c
CVE ID: CVE-2019-13050 State: PUBLISHED Published: 2019-06-29T16:07:13 Last Updated: 2024-08-04T23:41:09.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f - https://lists.gnupg.org/pipermail/gnupg-announce/2019q3/0
://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f - https://lists.gnupg.org/pipermail/gnupg-announce/2019q3/000439.html - https://twitter.com/lambdafu/status/1147162583969009664 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CP4ON34YEXEZDZOXXWV43KVGGO6WZLJ5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUK2YRO6QIH64WP2LRA5D4LACTXQPPU4/ - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00039.html - https://support.f5.com/csp/article/K08654551 - https://support.f5.com/csp/article/K08654551?utm_source=f5support&amp%3Butm_medium=RSS - https://lists.apache.org/threa