huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration
CVE: CVE-2025-27818
Component: apache-kafka
CWE: CWE-502
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-06-10T07:52:31.778000+00:00

A flaw was found in apache-kafka. This issue occurs due to improper handling of configuration data when using a Kafka client SASL JAAS, allowing an attacker with access to alterConfig for a cluster resource or Kafka Connect worker to inject arbitrary configuration. This injection can lead to the creation or modification of connectors with malicious configurations. Consequently, this can allow an attacker to compromise the integrity and availability of the Kafka cluster or Kafka Connect worker.

Statement: No Red Hat products are affected by this flaw.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread 
installation base or stability.
Redis: Bug in XACKDEL may lead to stack overflow and potential RCE
CVE: CVE-2025-62507
Component: redis
CWE: CWE-787
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-11-04T21:24:44.802000+00:00

Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed in version 8.2.3. To workaround this issue without patching the redis-server executable is to prevent users from executing XACKDEL operation. This can be done using ACL to restrict XACKDEL command.


Remediation:
pycares Channel Use-After-Free
CVE: CVE-2025-48945
Component: pycares
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-06-16T16:09:47+00:00

A flaw was found in pycares. A use-after-free condition arises when a Channel object is garbage collected while associated DNS queries remain pending, leading to a fatal Python error and interpreter crash. This vulnerability allows a local attacker to trigger the crash by initiating DNS queries and then manipulating the object lifetime. This condition causes a denial of service resulting from interpreter termination.


Remediation:
To mitigate this flaw avoid creating Channel objects per-request.
LoongArch: Return NULL from huge_pte_offset() for invalid PMD
CVE: CVE-2025-37818
Component: kernel
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Return NULL from huge_pte_offset() for invalid PMD

LoongArch's huge_pte_offset() currently returns a pointer to a PMD slot
even if the underlying entry points to invalid_pte_table (indicating no
mapping). Callers like smaps_hugetlb_range() fetch this invalid entry
value (the address of invalid_pte_table) via this pointer.

The generic is_swap_pte() check then incorrectly identifies this address
as a swap entry on LoongArch, because it satisfies the "!pte_present()
&& !pte_none()" conditions. This misinterpretation, combined with a
coincidental match by is_migration_entry() on the address bits, leads to
kernel crashes in pfn_swap_entry_to_page().

Fix this at the architecture level by modifying huge_pte_offset() to
check the PMD entry's content using pmd_none() before returning. If the
entry is invalid (i.e., it points to invalid_pte_table), return NULL
instead of the pointer to the slot.


Remediation:
Large /etc/passwd file may lead to Denial of Service
CVE: CVE-2025-4437
Component: cri-o
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-06-26T00:00:00+00:00

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.

Statement: This vulnerability was rated as Moderate by the Red Hat's Product Security team as it requires the attacker to own an account with minimal privileges to create pods using the CRI-O utility.

Remediation:
As for now there's no available mitigation for this flaw.
Argo Workflows exposes artifact repository credentials
CVE: CVE-2025-62157
Component: github.com/argoproj/argo-workflows
CWE: CWE-522
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-10-14T15:06:39.829000+00:00

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissions to read pod logs in a namespace running Argo Workflows can read the workflow-controller logs and obtain credentials to the artifact repository. Update to versions 3.6.12 or 3.7.3 to remediate the vulnerability. No known workarounds exist.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Race condition in nsHttpTransaction could lead to memory corruption
CVE: CVE-2025-3608
Component: firefox
CWE: CWE-364
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-04-15T12:57:28.868000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory: A race condition exists in nsHttpTransaction that can be exploited to cause memory corruption, leading to an exploitable condition.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
heap overflow in the hfs and hfsplus filesystems with manually crafted filesystem
CVE: CVE-2025-0927
Component: kernel
Release date: 2025-03-30T00:00:00+00:00

[REJECTED CVE] Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code.

Statement: This CVE has been rejected by the Linux kernel community. Refer to the announcement: https://lore.kernel.org/linux-cve-announce/2025052308-brittle-unbroken-888b@gregkh/

Remediation:
HID: hid-steam: Fix use-after-free when detaching device
CVE: CVE-2025-21923
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: hid-steam: Fix use-after-free when detaching device

When a hid-steam device is removed it must clean up the client_hdev used for
intercepting hidraw access. This can lead to scheduling deferred work to
reattach the input device. Though the cleanup cancels the deferred work, this
was done before the client_hdev itself is cleaned up, so it gets rescheduled.
This patch fixes the ordering to make sure the deferred work is properly
canceled.


Remediation:
thunderbird: Cross-site request forgery via storage access API redirects
CVE: CVE-2025-4088
Component: firefox
CWE: CWE-601
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2025-04-29T13:13:43.684000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A security vulnerability in Firefox allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Firebird Denial-of-Service Vulnerability
CVE: CVE-2025-54989
Component: firebirdsql
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-08-15T15:04:19.097000+00:00

Firebird is a relational database. Prior to versions 3.0.13, 4.0.6, and 5.0.3, there is an XDR message parsing NULL pointer dereference denial-of-service vulnerability in Firebird. This specific flaw exists within the parsing of xdr message from client. It leads to NULL pointer dereference and DoS. This issue has been patched in versions 3.0.13, 4.0.6, and 5.0.3.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
perf/core: Add RCU read lock protection to perf_iterate_ctx()
CVE: CVE-2025-21889
Component: kernel
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Add RCU read lock protection to perf_iterate_ctx()

The perf_iterate_ctx() function performs RCU list traversal but
currently lacks RCU read lock protection. This causes lockdep warnings
when running perf probe with unshare(1) under CONFIG_PROVE_RCU_LIST=y:

	WARNING: suspicious RCU usage
	kernel/events/core.c:8168 RCU-list traversed in non-reader section!!

	 Call Trace:
	  lockdep_rcu_suspicious
	  ? perf_event_addr_filters_apply
	  perf_iterate_ctx
	  perf_event_exec
	  begin_new_exec
	  ? load_elf_phdrs
	  load_elf_binary
	  ? lock_acquire
	  ? find_held_lock
	  ? bprm_execve
	  bprm_execve
	  do_execveat_common.isra.0
	  __x64_sys_execve
	  do_syscall_64
	  entry_SYSCALL_64_after_hwframe

This protection was previously present but was removed in commit
bd2756811766 ("perf: Rewrite core context handling"). Add back the
necessary rcu_read_lock()/rcu_read_unlock() pair around
perf_iterate_ctx() call in perf_event_exec().

[ mingo: Use scoped_guard() as suggested by Peter ]


Remediation:
Bouncy Castle for Java bc-fips: Out-of-bounds Write vulnerability allows local information disclosure, data modification, or denial of service.
CVE: CVE-2025-9340
Component: org.bouncycastle/bc-fips
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-08-22T09:39:47.303000+00:00

A flaw was found in Bouncy Castle for Java bc-fips. This out-of-bounds write vulnerability, located in the org/bouncycastle/jcajce/provider/BaseCipher program files, could allow a local attacker to cause information disclosure, data modification, or a denial of service without requiring any privileges or user interaction.

Statement: This vulnerability is rated Moderate. However, Red Hat products are not affected by this vulnerability as the vulnerable code is not present in the shipped components.

Remediation:
From CVEorg collector
CVE: CVE-2025-29943
Component: AMD EPYC™ 9004 Series Processors
Release date: 2025-01-01T00:00:00+00:00

Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially resulting in the corruption of the stack pointer inside an SEV-SNP guest.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linkify Prototype Pollution
CVE: CVE-2025-8101
Component: linkifyjs
CWE: CWE-1321
Severity: Important
CVSS v3: 8.6/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Release date: 2025-07-25T21:52:47.287000+00:00

A prototype pollution vulnerability was found in Linkify. This vulnerability allows an attacker to inject HTML attributes and manipulate user-controlled variables.

Statement: No Red Hat products or offerings are affected by this vulnerability.

This vulnerability is Important rather than Moderate because it enables a direct escalation from a logic flaw (prototype pollution) to active client-side code execution (XSS) in a single step, with no complex exploitation required. By failing to filter the __proto__ property in the assign() helper, Linkify.js 4.3.1 allows attackers to inject malicious event handlers into Object.prototype, which are then automatically inherited and applied to all generated <a> elements. This results in universal HTML attribute injection, enabling both stored and reflected XSS. Since Linkify is commonly used in contexts that render untrusted user input—such as comments, chat messages, and CMS content—this flaw can be exploited remotely and at scale, impacting every end-user who views the processed content.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
CVE: CVE-2025-38201
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Release date: 2025-07-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX

Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof()
when resizing hashtable because __GFP_NOWARN is unset.

Similar to:

  b541ba7d1f5a ("netfilter: conntrack: clamp maximum hashtable size to INT_MAX")


Remediation:
ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
CVE: CVE-2025-39943
Component: kernel
Severity: None
Release date: 2025-10-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer

If data_offset and data_length of smb_direct_data_transfer struct are
invalid, out of bounds issue could happen.
This patch validate data_offset and data_length field in recv_done.


Remediation:
landlock: Fix warning from KUnit tests
CVE: CVE-2025-38651
Component: kernel
Severity: None
Release date: 2025-08-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

landlock: Fix warning from KUnit tests

get_id_range() expects a positive value as first argument but
get_random_u8() can return 0.  Fix this by clamping it.

Validated by running the test in a for loop for 1000 times.

Note that MAX() is wrong as it is only supposed to be used for
constants, but max() is good here.

  [..]     ok 9 test_range2_rand1
  [..]     ok 10 test_range2_rand2
  [..]     ok 11 test_range2_rand15
  [..] ------------[ cut here ]------------
  [..] WARNING: CPU: 6 PID: 104 at security/landlock/id.c:99 test_range2_rand16 (security/landlock/id.c:99 (discriminator 1) security/landlock/id.c:234 (discriminator 1))
  [..] Modules linked in:
  [..] CPU: 6 UID: 0 PID: 104 Comm: kunit_try_catch Tainted: G                 N  6.16.0-rc1-dev-00001-g314a2f98b65f #1 PREEMPT(undef)
  [..] Tainted: [N]=TEST
  [..] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
  [..] RIP: 0010:test_range2_rand16 (security/landlock/id.c:99 (discriminator 1) security/landlock/id.c:234 (discriminator 1))
  [..] Code: 49 c7 c0 10 70 30 82 4c 89 ff 48 c7 c6 a0 63 1e 83 49 c7 45 a0 e0 63 1e 83 e8 3f 95 17 00 e9 1f ff ff ff 0f 0b e9 df fd ff ff <0f> 0b ba 01 00 00 00 e9 68 fe ff ff 49 89 45 a8 49 8d 4d a0 45 31

  [..] RSP: 0000:ffff888104eb7c78 EFLAGS: 00010246
  [..] RAX: 0000000000000000 RBX: 000000000870822c RCX: 0000000000000000
            ^^^^^^^^^^^^^^^^
  [..]
  [..] Call Trace:
  [..]
  [..] ---[ end trace 0000000000000000 ]---
  [..]     ok 12 test_range2_rand16
  [..] # landlock_id: pass:12 fail:0 skip:0 total:12
  [..] # Totals: pass:12 fail:0 skip:0 total:12
  [..] ok 1 landlock_id

[mic: Minor cosmetic improvements]


Remediation:
sched/deadline: Stop dl_server before CPU goes offline
CVE: CVE-2025-40163
Component: kernel
Severity: None
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sched/deadline: Stop dl_server before CPU goes offline

IBM CI tool reported kernel warning[1] when running a CPU removal
operation through drmgr[2]. i.e "drmgr -c cpu -r -q 1"

WARNING: CPU: 0 PID: 0 at kernel/sched/cpudeadline.c:219 cpudl_set+0x58/0x170
NIP [c0000000002b6ed8] cpudl_set+0x58/0x170
LR [c0000000002b7cb8] dl_server_timer+0x168/0x2a0
Call Trace:
[c000000002c2f8c0] init_stack+0x78c0/0x8000 (unreliable)
[c0000000002b7cb8] dl_server_timer+0x168/0x2a0
[c00000000034df84] __hrtimer_run_queues+0x1a4/0x390
[c00000000034f624] hrtimer_interrupt+0x124/0x300
[c00000000002a230] timer_interrupt+0x140/0x320

Git bisects to: commit 4ae8d9aa9f9d ("sched/deadline: Fix dl_server getting stuck")

This happens since:
- dl_server hrtimer gets enqueued close to cpu offline, when
  kthread_park enqueues a fair task.
- CPU goes offline and drmgr removes it from cpu_present_mask.
- hrtimer fires and warning is hit.

Fix it by stopping the dl_server before CPU is marked dead.

[1]: https://lore.kernel.org/all/8218e149-7718-4432-9312-f97297c352b9@linux.ibm.com/
[2]: https://github.com/ibm-power-utilities/powerpc-utils/tree/next/src/drmgr

[sshegde: wrote the changelog and tested it]


Remediation:
CVE: CVE-2025-7974
Component: rocket.chat Incorrect Authorization Information Disclosure Vulnerability
Release date: 2025-07-21T21:58:51.072000+00:00

rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of rocket.chat. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on TCP port 3000 by default. The issue results from incorrect authorization. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-26517.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
landlock: Fix handling of disconnected directories
CVE: CVE-2025-68736
Component: kernel
CWE: CWE-266
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's Landlock security module. When handling files or directories accessed through disconnected directories (created via bind mounts after rename/move operations), Landlock incorrectly collected access rights by walking the filesystem hierarchy instead of respecting the mount point boundaries. This could lead to inconsistent access decisions and potential access right widening during rename operations.

Statement: This flaw affects sandboxed applications using Landlock for filesystem access control. A sandboxed task with specific permissions on bind mount sources could potentially gain inconsistent access rights through disconnected directories. The vulnerability requires the ability to create bind mounts and perform specific rename operations, limiting practical exploitability.

Remediation:
drm/amd/display: Avoid a NULL pointer dereference
CVE: CVE-2025-39693
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Avoid a NULL pointer dereference

[WHY]
Although unlikely drm_atomic_get_new_connector_state() or
drm_atomic_get_old_connector_state() can return NULL.

[HOW]
Check returns before dereference.

(cherry picked from commit 1e5e8d672fec9f2ab352be121be971877bff2af9)


Remediation:
Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd
CVE: CVE-2025-71147
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's trusted keys subsystem. A local user could exploit a memory leak in the `tpm2_load_cmd` function, which fails to free a temporary memory allocation in certain error scenarios. This memory leak could lead to a system-wide Denial of Service (DoS) by exhausting available memory resources.


Remediation:
thunderbird: Use-after-free in XSLT
CVE: CVE-2025-1009
Component: firefox
CWE: CWE-416
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-02-04T13:58:51.928000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
strongSwan: Arbitrary Code Execution and Denial of Service via crafted EAP-MSCHAPv2 message
CVE: CVE-2025-62291
Component: strongswan
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the strongSwan eap-mschapv2 plugin (client-side). A remote attacker, specifically a malicious Extensible Authentication Protocol - Microsoft Challenge-Handshake Authentication Protocol version 2 (EAP-MSCHAPv2) server, could exploit this by sending a specially crafted message between 6 and 8 bytes in size. This crafted message can cause an integer underflow, leading to a heap-based buffer overflow. This vulnerability could potentially result in arbitrary code execution, allowing the attacker to take control of the affected system, or lead to a denial of service.

Statement: For this vulnerability to be exploited, a connection must be made to a malicious server.

Remediation: