huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
URL fetching can be used to exfiltrate arbitrary INI file values and environment variables
CVE: CVE-2024-12426
Component: LibreOffice
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2024-01-01T00:00:00+00:00

A flaw was found in LibreOffice. This issue may allow the exposure of environmental variables and arbitrary INI file values, leading to sensitive information disclosure via crafted URLs embedded in documents.


Remediation:
ppp: reject claimed-as-LCP but actually malformed packets
CVE: CVE-2024-41044
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-29T00:00:00+00:00

The vulnerability was found in the Linux kernel's ppp ppp_generic.c driver, in the ppp_read() and ppp_write() functions where malformed packets were erroneously identified as LCP packets, leading to potential issues with packet handling. This flaw could potentially lead to system instability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
nilfs2: fix missing cleanup on rollforward recovery error
CVE: CVE-2024-46781
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix missing cleanup on rollforward recovery error

In an error injection test of a routine for mount-time recovery, KASAN
found a use-after-free bug.

It turned out that if data recovery was performed using partial logs
created by dsync writes, but an error occurred before starting the log
writer to create a recovered checkpoint, the inodes whose data had been
recovered were left in the ns_dirty_files list of the nilfs object and
were not freed.

Fix this issue by cleaning up inodes that have read the recovery data if
the recovery routine fails midway before the log writer starts.


Remediation:
sandbox bypass via crafted constructor bodies
CVE: CVE-2024-34144
Component: jenkins-plugin/script-security
CWE: CWE-693
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-05-02T00:00:00+00:00

A sandbox bypass vulnerability was found in the Jenkins Script Security Plugin involving crafted constructor bodies, enabling the circumvention of security restrictions. With crafted constructor bodies, this flaw allows authenticated attackers to define and execute sandboxed scripts, including Pipelines, bypassing sandbox protection mechanisms and executing arbitrary code within the context of the Jenkins controller JVM.

The Script Security Plugin features a sandbox functionality designed to enable users with limited privileges to create scripts, including Pipelines, which are generally safe for execution. This security mechanism intercepts calls within sandboxed scripts, referencing various allowlists to decide whether these calls should be permitted.

The vulnerabilities that allow for sandbox bypass have been identified in versions up to 1335.vf07d9ce377a_e of the Script Security Plugin. These vulnerabilities include:

- Exploiting crafted constructor bodies that trigger other constructors, thereby allowing the construction of any subclassable type through implicit casts.
- Utilizing Groovy classes defined within the sandbox that overshadow certain non-sandboxed classes, facilitating the creation of any subclassable type.

These vulnerabilities enable attackers, who have the permission to create and execute sandboxed scripts including Pipelines, to circumvent sandbox protections and execute arbitrary code within the context of the Jenkins controller JVM.

The fixed version of this script incorporates enhanced restrictions and sanity checks. These improvements ensure that calls to super constructors are intercepted by the sandbox, including:

- Ensuring that calls to other constructors via 'this' are now appropriately managed within the sandbox.
- No longer overlooking classes in packages that may be overshadowed by Groovy-defined classes when intercepting super constructor calls.

Statement: Red Hat rates the security impact of this vulnerability as Important due to the worst case scenario resulting in a process being able to access resources outside an assigned sandbox.

The vulnerabilities that allow for sandbox bypass have been identified in versions up to 1335.vf07d9ce377a_e of the Script Security Plugin. These vulnerabilities include exploiting specially crafted constructor bodies, utilizing certain groovy classes.

Remediation:
Remote Code Execution by Pickle Deserialization in vllm-project/vllm
CVE: CVE-2024-9052
Component: vllm
CWE: CWE-502
Severity: Low
CVSS v3: 2.7/CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Release date: 2024-01-01T00:00:00+00:00

A flaw was found in the vLLM distributed training API. This vulnerability allows remote code execution via unsafe deserialization, which uses pickle.loads() without sanitization.


Remediation:
wifi: rtlwifi: remove unused check_buddy_priv
CVE: CVE-2024-58072
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: remove unused check_buddy_priv

Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global
list of private data structures.

Later on, commit 26634c4b1868 ("rtlwifi Modify existing bits to match
vendor version 2013.02.07") started adding the private data to that list at
probe time and added a hook, check_buddy_priv to find the private data from
a similar device.

However, that function was never used.

Besides, though there is a lock for that list, it is never used. And when
the probe fails, the private data is never removed from the list. This
would cause a second probe to access freed memory.

Remove the unused hook, structures and members, which will prevent the
potential race condition on the list and its corruption during a second
probe when probe fails.

Statement: The bug could happen during initialization (when probing PCI driver). The security impact is limited, because only privileged user can trigger the bug.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module rtlwifi from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
wifi: cfg80211: Lock wiphy in cfg80211_get_station
CVE: CVE-2024-40911
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel in wifi driver in cfg80211_get_station function, where the wiphy was not locked before calling rdev_get_station(), which lead to a NULL pointer dereference when a station disconnects and reconnects during a work queue operation, resulting in a kernel panic.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Denial of Service Due to Overly Large Elliptic Curve Parameters
CVE: CVE-2024-34703
Component: botan
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-06-30T00:00:00+00:00

A flaw was found in Botan. X.509 certificates can identify elliptic curves using either an object identifier or explicit encoding of the parameters. This flaw allows an attacker to present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. The POC used a 16Kbit prime for this purpose. When parsing the parameter is checked to be prime, it causes excessive computation.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
CVE: CVE-2024-35811
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-17T00:00:00+00:00

A use-after-free vulnerability was found in the `brcmf_cfg80211_detach` function of the `brcmfmac` driver in the Linux Kernel, which could lead to security risks or system instability. This issue was resolved to prevent unauthorized access to freed memory that could have been exploited for malicious purposes.

Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
cpufreq: Avoid a bad reference count on CPU node
CVE: CVE-2024-50012
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: Avoid a bad reference count on CPU node

In the parse_perf_domain function, if the call to
of_parse_phandle_with_args returns an error, then the reference to the
CPU device node that was acquired at the start of the function would not
be properly decremented.

Address this by declaring the variable with the __free(device_node)
cleanup attribute.

Statement: The kernel version as distributed with Red Hat Enterprise Linux 8 is not affected by this vulnerability as it doesn't ship the vulnerable code.

Remediation:
thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
CVE: CVE-2024-9402
Component: firefox
CWE: CWE-120
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-10-01T15:13:21.493000+00:00

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: Memory safety bugs are present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these could have been exploited to run arbitrary code.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder
CVE: CVE-2024-25112
Component: Exiv2
CWE: CWE-674
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2024-02-13T00:00:00+00:00

A flaw was found in the Exiv2 command-line utility. The denial of service is triggered when Exiv2 is used to read the metadata of a crafted video file. An unbounded recursion can cause Exiv2 to crash by exhausting the stack.

Statement: The Exiv2 versions before v0.28 are not affected. An older version of Exiv2 is present in RHEL. Hence, RHEL is not affected.

Remediation:
wifi: iwlwifi: fix double-free bug
CVE: CVE-2024-26694
Component: kernel
CWE: CWE-415
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-03T00:00:00+00:00

A vulnerability was found in the Linux kernel's iwlwifi driver, where the TLV PC register data being freed is not properly marked as NULL afterwards, resulting in a double-free issue. This could lead to memory corruption or crashes.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
LR register can be overwritten without data being saved to the stack on ARM
CVE: CVE-2024-31852
Component: llvm
CWE: CWE-440
Severity: Moderate
CVSS v3: 4.2/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Release date: 2024-04-05T00:00:00+00:00

A miscompile flaw was found in LLVM. In certain conditions, the LR register can be overwritten without data being saved to the stack, which can lead to an exploitable error in the compiled code. This affects the ARM backend and can be demonstrated with Clang.

Statement: The vulnerability in LLVM, where the Link Register (LR) in ARM architecture can be overwritten without proper stack preservation, is assessed as a moderate severity issue. While overwriting the LR can lead to control-flow manipulation and potential code execution, its impact is mitigated by several factors. Firstly, successful exploitation requires precise knowledge of the target system's memory layout and execution context, making it less straightforward for attackers. Secondly, modern operating systems and runtime environments often have protections in place, such as address space layout randomization (ASLR) and stack canaries, which can make exploitation more challenging. Lastly, the issue primarily affects the ARM backend, limiting its impact to ARM-based systems, which may not be as prevalent as other architectures in certain deployment scenarios.

Remediation:
jfs: fix array-index-out-of-bounds in jfs_readdir
CVE: CVE-2024-56596
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

jfs: fix array-index-out-of-bounds in jfs_readdir

The stbl might contain some invalid values. Added a check to
return error code in that case.


Remediation:
driver core: Fix uevent_show() vs driver detach race
CVE: CVE-2024-44952
Component: kernel
CWE: CWE-667
Severity: None
Release date: 2024-09-04T00:00:00+00:00

No description is available for this CVE.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Information Exposure when used on the backend
CVE: CVE-2024-21501
Component: sanitize-html
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2024-02-24T00:00:00+00:00

An information exposure flaw was found in the sanitize-html package, when used on the backend with the style attribute allowed. This issue may allow an attacker to enumerate files in the system, including project dependencies, to gather details about the file system structure and dependencies of the targeted server.


Remediation:
For Red Hat Advanced Cluster Management for Kubernetes, see the following
documentation, which will be updated shortly for this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html-single/install/index#installing
For OpenShift Container Platform 4.15 see the following documentation,
which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags

The sha values for the release are:

(For x86_64 architecture)
The image digest is sha256:4c57e9589ac8d96ad74fd8c9fce35c5e507a20a88a6871d8a731c3b295abc79a

(For s390x architecture)
The image digest is sha256:634e598fa7efd07889134df534c48c9e9bc3a9c9281fc9f92d3e6e7a3c9c636b

(For ppc64le architecture)
The image digest is sha256:2efac9327f58a2356a094cad86cc2fa6a1258256a84cbc049adc16bafc7ff845

(For aarch64 architecture)
The image digest is sha256:6033ead0c6171aff24c4b8825d6556ba23aa3f176883d705896056f93191083d

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
For multicluster engine for Kubernetes, see the following documentation for
details on how to install the images:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.9/html/clusters/cluster_mce_overview#installing-while-connected-online-mce
For Red Hat Advanced Cluster Management for Kubernetes, see the following
documentation, which will be updated shortly for this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.10/html-single/install/index#installing
For multicluster engine for Kubernetes, see the following documentation for
details on how to install the images:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.10/html/clusters/cluster_mce_overview#mce-install-intro
StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
CVE: CVE-2024-29131
Component: commons-configuration
CWE: CWE-787
Severity: Low
CVSS v3: 4.5/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Release date: 2024-03-20T00:00:00+00:00

A vulnerability was found in Apache Commons-Configuration2, where a Stack Overflow Error can occur when adding a property in AbstractListDelimiterHandler.flattenIterator(). This issue could allow an attacker to corrupt memory or execute a denial of service attack by crafting malicious property that triggers an out-of-bounds write issue when processed by the vulnerable method.


Remediation:
The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.

The References section of this erratum contains a download link (you must log in to download the update).
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Infinite loop due to improper EDE message size check
CVE: CVE-2024-1931
Component: unbound
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-03-07T00:00:00+00:00

A vulnerability was found in Unbound. The issue arises due to a flaw in the handling of Extended DNS Error (EDE) records when the 'ede: yes' option is enabled, a non-default configuration. Specifically, an unchecked condition in the code can trigger an infinite loop when attempting to trim the text fields of EDE records to fit within the client's buffer size. This vulnerability could potentially lead to denial of service (DoS) as the infinite loop consumes system resources, impacting the availability of the Unbound DNS resolver.

Statement: The vulnerability present in Unbound, while posing a risk of denial of service, is assessed as having a Moderate severity level from a technical perspective. The severity is primarily attributed to the potential for exploitation under specific conditions, namely when the 'ede: yes' option is enabled, which is not the default configuration. Additionally, the vulnerability manifests in a limited scenario where responses containing Extended DNS Error (EDE) records exceed the client's buffer size. While the issue can result in an infinite loop and consequent denial of service, its impact is constrained to situations where these specific conditions align.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
wifi: mac80211: don&#39;t use rate mask for offchannel TX either
CVE: CVE-2024-47738
Component: kernel
CWE: CWE-755
Severity: Moderate
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2024-10-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: don't use rate mask for offchannel TX either

Like the commit ab9177d83c04 ("wifi: mac80211: don't use rate mask for
scanning"), ignore incorrect settings to avoid no supported rate warning
reported by syzbot.

The syzbot did bisect and found cause is commit 9df66d5b9f45 ("cfg80211:
fix default HE tx bitrate mask in 2G band"), which however corrects
bitmask of HE MCS and recognizes correctly settings of empty legacy rate
plus HE MCS rate instead of returning -EINVAL.

As suggestions [1], follow the change of SCAN TX to consider this case of
offchannel TX as well.

[1] https://lore.kernel.org/linux-wireless/6ab2dc9c3afe753ca6fdcdd1421e7a1f47e87b84.camel@sipsolutions.net/T/#m2ac2a6d2be06a37c9c47a3d8a44b4f647ed4f024


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.