huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling
CVE: CVE-2025-15468
Component: openssl
CWE: CWE-476
Severity: Low
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in openssl. A remote attacker could trigger a NULL pointer dereference by sending an unknown or unsupported cipher ID during the client hello callback in applications using the QUIC (Quick UDP Internet Connections) protocol. This vulnerability, occurring when the SSL_CIPHER_find() function is called in this specific context, leads to an abnormal termination of the running process, causing a Denial of Service (DoS).

Statement: This vulnerability is rated Low for Red Hat. The NULL pointer dereference in the `SSL_CIPHER_find()` function, affecting OpenSSL versions 3.3, 3.4, 3.5, and 3.6, occurs only when applications utilizing the QUIC protocol uncommonly invoke this function from the `client_hello_cb` callback with an unknown cipher ID. This specific usage pattern and the resulting Denial of Service limit the overall impact in the Red Hat context.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
The Insights proxy container image provided here is downloaded by the Red Hat
Insights proxy product RPM.

Before applying this update, make sure all previously released errata relevant to
your system have been applied.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Authlib: Cross-Site Request Forgery due to improper session management in state storage
CVE: CVE-2025-68158
Component: Authlib
CWE: CWE-352
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in Authlib, a Python library used for building OAuth and OpenID Connect servers. The cache-backed state and request-token storage within Authlib is not securely linked to the user's initiating session. This vulnerability allows a remote attacker to exploit a Cross-Site Request Forgery (CSRF) by obtaining a valid state, which can lead to unauthorized actions being performed on behalf of the user.

Statement: This vulnerability is rated Moderate for Red Hat products utilizing Authlib, such as Red Hat Ansible Automation Platform, Hosted OpenShift Clusters, Red Hat Quay, and Red Hat Satellite. The flaw arises from improper session management in Authlib's cache-backed state storage, allowing a remote attacker to perform Cross-Site Request Forgery (CSRF) by obtaining a valid state.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
seccomp: passthrough uretprobe systemcall without filtering
CVE: CVE-2025-21834
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-06T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

seccomp: passthrough uretprobe systemcall without filtering

When attaching uretprobes to processes running inside docker, the attached
process is segfaulted when encountering the retprobe.

The reason is that now that uretprobe is a system call the default seccomp
filters in docker block it as they only allow a specific set of known
syscalls. This is true for other userspace applications which use seccomp
to control their syscall surface.

Since uretprobe is a "kernel implementation detail" system call which is
not used by userspace application code directly, it is impractical and
there's very little point in forcing all userspace applications to
explicitly allow it in order to avoid crashing tracked processes.

Pass this systemcall through seccomp without depending on configuration.

Note: uretprobe is currently only x86_64 and isn't expected to ever be
supported in i386.

[kees: minimized changes for easier backporting, tweaked commit log]


Remediation:
Cookie domain validation bypass via uppercase characters in libsoup
CVE: CVE-2025-4035
Component: libsoup
CWE: CWE-178
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2025-04-28T00:00:00+00:00

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation.


Remediation:
Remix Host Header Spoofing Vulnerability
CVE: CVE-2025-31137
Component: react-router
CWE: CWE-444
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T18:20:32.660000+00:00

A flaw was found in react-router due to improper handling of user-controlled data within the Express adapter. This flaw allows a remote attacker to trigger a server-side request forgery (SSRF) condition. This SSRF can be exploited by sending crafted HTTP requests to arbitrary internal or external resources. Successful exploitation results in a high impact denial of service.

Statement: This vulnerability allows URL spoofing, which can lead to unauthorized access to resources and potential data breaches. The fact that it requires no authentication or user interaction significantly increases its exploitability. The use of Host or X-Forwarded-Host headers, which are commonly used in web applications, makes this a widespread issue. While arbitrary code execution isn't directly possible based on the description, the ability to manipulate URLs and potentially access sensitive data warrants an Important impact rating.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Improperly Controlled Sequential Memory Allocation in Wireshark
CVE: CVE-2025-13945
Component: wireshark
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-12-03T08:04:49.403000+00:00

A flaw was found in the HTTP3 dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing an excessive consumption of CPU and memory resources, resulting in a denial of service.

Statement: This vulnerability will cause a crash in Wireshark with no other security impact. Additionally, this issue can only be exploited when a specially crafted pcap file is processed. For these reasons, this flaw has been rated with a moderate severity.

Remediation:
If the HTTP3 protocol dissector is not being used, it can be disabled via the "Enabled Protocols" dialog box in the Wireshark GUI application. This will also disable the protocol dissector when using "tshark", the command line tool.

See the links below for instructions to disable a protocol in Wireshark, specifically the "Control Protocol Dissection" section and the "disabled_protos" configuration file option.

https://www.wireshark.org/docs/wsug_html_chunked/ChCustProtocolDissectionSection.html
https://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html
Privilege Handling Flaw in MySQL Server
CVE: CVE-2025-21567
Component: mysql
CWE: CWE-200
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-01-21T20:53:22.751000+00:00

A flaw was found in the MySQL Server component: Server: Security: Privileges. This vulnerability allows unauthorized read access to a subset of MySQL Server data via multiple protocols.


Remediation:
ipv4: start using dst_dev_rcu()
CVE: CVE-2025-40074
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipv4: start using dst_dev_rcu()

Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.

Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(),
ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu().

Statement: The patch replaces non-RCU-safe dst_dev() usages with dst_dev_rcu() and wraps lookups with proper rcu_read_lock(). Without this, concurrency with route/device teardown could yield a dangling dst->dev and a kernel use-after-free, crashing the host. Remote packets can reach these code paths (ICMP, IPv4 defrag, multicast), but a practical trigger typically requires concurrent routing/device changes on the host (admin action), hence for the CVSS the AC:H and most likely DoS-only impact.
This issue cannot be reliably triggered by sending crafted packets alone — successful exploitation requires concurrent privileged/server-side actions (e.g. route/interface removal, driver unbind or network-namespace teardown) that change or free the dst->dev while packet processing is underway. A purely unprivileged remote actor cannot force those conditions on a correctly configured system.
Triggering this issue in practice typically requires server-side conditions — for example concurrent route/interface changes, netns teardown, or device removal — to occur while packets are being processed. This makes reliable exploitation difficult and confines the risk mainly to DoS. Remote exploitation with a single packet without privileged actions on the host is not expected.

Remediation:
CVE: CVE-2025-7249
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:56:36.062000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26100.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
tika-parsers: tika-parser-pdf-module: Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
CVE: CVE-2025-66516
Component: tika-core
CWE: CWE-611
Severity: Critical
CVSS v3: 10/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2025-12-04T16:17:24.980000+00:00

A XML External Entity (XXE) injection vulnerability was found in the Apache Tika framework's PDF parsing functionality. It could allow a remote, unauthenticated attacker to exploit the system by providing a specially crafted PDF containing an XFA (XML Forms Architecture) file. This flaw could lead to sensitive information disclosure or, potentially, Remote Code Execution (RCE) on the server. The issue affects multiple Tika modules, including tika-core, tika-pdf-module, and tika-parsers, within the version ranges 1.13 through 3.2.1.

This CVE expands on the scope of CVE-2025-54988 to clarify that the root cause and required fix reside in the tika-core module, regardless of which parser module is used.

Statement: This vulnerability is rated Critical because it can be triggered when Apache Tika processes a maliciously crafted XFA file embedded within a PDF. Successful exploitation enables XML External Entity (XXE) injection, allowing an attacker to access sensitive local files and initiate arbitrary requests to internal or external network resources. This can lead to Server-Side Request Forgery (SSRF), data tampering, and potential elevation of privileges. With high impact across confidentiality, integrity, and availability, this vulnerability poses a severe risk to affected systems.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
ice: fix NULL access of tx->in_use in ice_ll_ts_intr
CVE: CVE-2025-39854
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Release date: 2025-09-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ice: fix NULL access of tx->in_use in ice_ll_ts_intr

Recent versions of the E810 firmware have support for an extra interrupt to
handle report of the "low latency" Tx timestamps coming from the
specialized low latency firmware interface. Instead of polling the
registers, software can wait until the low latency interrupt is fired.

This logic makes use of the Tx timestamp tracking structure, ice_ptp_tx, as
it uses the same "ready" bitmap to track which Tx timestamps complete.

Unfortunately, the ice_ll_ts_intr() function does not check if the
tracker is initialized before its first access. This results in NULL
dereference or use-after-free bugs similar to the issues fixed in the
ice_ptp_ts_irq() function.

Fix this by only checking the in_use bitmap (and other fields) if the
tracker is marked as initialized. The reset flow will clear the init field
under lock before it tears the tracker down, thus preventing any
use-after-free or NULL access.


Remediation:
kubelet: node denial of service via kubelet checkpoint API
CVE: CVE-2025-0426
Component: k8s.io/kubernetes
CWE: CWE-400
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-13T15:16:13.703000+00:00

A flaw was found in Kubernetes. A large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may fill the Node's disk, potentially leading to a Node denial of service.

Statement: OpenShift is not impacted by this vulnerability since the kubelet's unauthenticated read-only port is not enabled in that product.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
To mitigate this vulnerability, disable the kubelet read-only port by setting `readOnlyPort: 0` in `/var/lib/kubelet/config.yaml` and restarting kubelet. Additionally, disable container checkpointing by setting `ContainerCheckpoint: false` under featureGates. If using CRI-O, ensure `enable_criu_support=false` is configured in `/etc/crio/crio.conf`.
wifi: mt76: mt7996: avoid NULL pointer dereference in mt7996_set_monitor()
CVE: CVE-2025-38316
Component: kernel
Severity: None
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: avoid NULL pointer dereference in mt7996_set_monitor()

The function mt7996_set_monitor() dereferences phy before
the NULL sanity check.

Fix this to avoid NULL pointer dereference by moving the
dereference after the check.


Remediation:
python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service
CVE: CVE-2025-12084
Component: cpython
CWE: CWE-770
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-03T18:55:32.222000+00:00

A flaw was found in cpython. This vulnerability allows impacted availability via a quadratic algorithm in `xml.dom.minidom` methods, such as `appendChild()`, when building excessively nested documents due to a dependency on `_clear_id_cache()`

Statement: This vulnerability is rated Important for Red Hat products as it can lead to a denial of service. The flaw exists in the `xml.dom.minidom` module of cpython, where a quadratic algorithm in methods like `appendChild()` can be triggered when processing excessively nested XML documents. When successfully exploited this may impact the availability of applications utilizing this functionality across affected Red Hat products.

Remediation:
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
paho.mqtt.golang: Integer Overflow in UTF-8 String Encoding
CVE: CVE-2025-10543
Component: paho.mqtt.golang
CWE: CWE-681
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-12-02T08:18:16.724000+00:00

A flaw was found in paho.mqtt.golang. This vulnerability allows data leakage and packet corruption via malformed UTF-8 (Unicode Transformation Format - 8-bit) encoded strings exceeding 65535 bytes due to an integer overflow.

Statement: This vulnerability is rated Moderate for Red Hat. It affects applications utilizing the `paho.mqtt.golang` library that process UTF-8 encoded strings exceeding 65535 bytes. This uncommon scenario can lead to data leakage within MQTT packets, such as a topic inadvertently appearing in the message body.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
sctp: add mutual exclusion in proc_sctp_do_udp_port()
CVE: CVE-2025-22062
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sctp: add mutual exclusion in proc_sctp_do_udp_port()

We must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start()
or risk a crash as syzbot reported:

Oops: general protection fault, probably for non-canonical address 0xdffffc000000000d: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]
CPU: 1 UID: 0 PID: 6551 Comm: syz.1.44 Not tainted 6.14.0-syzkaller-g7f2ff7b62617 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
 RIP: 0010:kernel_sock_shutdown+0x47/0x70 net/socket.c:3653
Call Trace:
 <TASK>
  udp_tunnel_sock_release+0x68/0x80 net/ipv4/udp_tunnel_core.c:181
  sctp_udp_sock_stop+0x71/0x160 net/sctp/protocol.c:930
  proc_sctp_do_udp_port+0x264/0x450 net/sctp/sysctl.c:553
  proc_sys_call_handler+0x3d0/0x5b0 fs/proc/proc_sysctl.c:601
  iter_file_splice_write+0x91c/0x1150 fs/splice.c:738
  do_splice_from fs/splice.c:935 [inline]
  direct_splice_actor+0x18f/0x6c0 fs/splice.c:1158
  splice_direct_to_actor+0x342/0xa30 fs/splice.c:1102
  do_splice_direct_actor fs/splice.c:1201 [inline]
  do_splice_direct+0x174/0x240 fs/splice.c:1227
  do_sendfile+0xafd/0xe50 fs/read_write.c:1368
  __do_sys_sendfile64 fs/read_write.c:1429 [inline]
  __se_sys_sendfile64 fs/read_write.c:1415 [inline]
  __x64_sys_sendfile64+0x1d8/0x220 fs/read_write.c:1415
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]


Remediation:
CVE: CVE-2025-15311
Component: Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.
Release date: 2025-01-22T00:00:00+00:00

Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: PCI link speed calculation DoS
CVE: CVE-2025-39784
Component: kernel
CWE: CWE-1419
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix link speed calculation on retrain failure

When pcie_failed_link_retrain() fails to retrain, it tries to revert to the
previous link speed.  However it calculates that speed from the Link
Control 2 register without masking out non-speed bits first.

PCIE_LNKCTL2_TLS2SPEED() converts such incorrect values to
PCI_SPEED_UNKNOWN (0xff), which in turn causes a WARN splat in
pcie_set_target_speed():

  pci 0000:00:01.1: [1022:14ed] type 01 class 0x060400 PCIe Root Port
  pci 0000:00:01.1: broken device, retraining non-functional downstream link at 2.5GT/s
  pci 0000:00:01.1: retraining failed
  WARNING: CPU: 1 PID: 1 at drivers/pci/pcie/bwctrl.c:168 pcie_set_target_speed
  RDX: 0000000000000001 RSI: 00000000000000ff RDI: ffff9acd82efa000
  pcie_failed_link_retrain
  pci_device_add
  pci_scan_single_device

Mask out the non-speed bits in PCIE_LNKCTL2_TLS2SPEED() and
PCIE_LNKCAP_SLS2SPEED() so they don't incorrectly return PCI_SPEED_UNKNOWN.

[bhelgaas: commit log, add details from https://lore.kernel.org/r/1c92ef6bcb314ee6977839b46b393282e4f52e74.1750684771.git.lukas@wunner.de]


Remediation:
XSS Vulnerability in jquery-validation
CVE: CVE-2025-3573
Component: jquery-validation
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-04-15T05:00:09.474000+00:00

A flaw was found in the jquery-validation package. This vulnerability allows Cross-site scripting (XSS) via a user-controlled placeholder value passed to the showLabel() function, which populates messages using the $.validator.messages dictionary.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.