huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
foreman: OAuth secret exposure via unauthenticated access to the GraphQL API
CVE: CVE-2024-6861
Component: foreman
CWE: CWE-200
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-10-09T00:42:00+00:00

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.

Statement: This vulnerability was reported for an End of Life Product and does not affect any current supported Red Hat Products. The fix was included in foreman version 3.3 which was first shipped in Satellite 6.12.

Remediation:
For Red Hat Satellite 6.12, see the following documentation for the release.
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.12

The important instructions on how to upgrade are available below.
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.12/html/upgrading_and_updating_red_hat_satellite
To mitigate this issue the GraphQL introspection feature must be disabled or the GraphQL API be disabled entirely.

Malicious requests can also be filtered using a reverse proxy or directly in the web server configuration.
Buildkit's interactive containers API does not validate entitlements check
CVE: CVE-2024-23653
Component: moby/buildkit
CVSS v3: 6.9/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2024-01-31T00:00:00+00:00

A vulnerability was found in the Moby Builder Toolkit, specifically in the Interactive Containers API, where entitlement checks are not adequately validated, caused by a missing privilege check in a GRPC endpoint when called using a custom syntax format. This flaw allows the currently running privileged container to leverage its elevated privileges, such as full Linux capabilities, to break out of the container and achieve complete host root command execution. This issue may lead to container escape to the underlying host OS when building an image using a malicious Dockerfile or upstream image (for example, when using FROM).

Statement: This vulnerability can only be exploited when a container execution is part of the build steps of another container. Additionally, an attacker needs to trick a user or process into processing an malicious Buildkit frontend. For these reasons, this flaw was rated with an important severity.
The risk of this vulnerability is to systems which build containers. It could have significant consequences to an organization's ability to release new versions of their software.

Red Hat has reviewed and removed previously listed "Not Affected" components from this CVE page to reduce confusion around containers/components

Remediation:
Do not use BuildKit frontends from untrusted sources.
fs: Fix uninitialized value issue in from_kuid and from_kgid
CVE: CVE-2024-53101
Component: kernel
CWE: CWE-457
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-11-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fs: Fix uninitialized value issue in from_kuid and from_kgid

ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in
a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set.

Initialize all fields of newattrs to avoid uninitialized variables, by
checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.


Remediation:
Heap Buffer Overflow in Vim's Typeahead Buffer Handling
CVE: CVE-2024-43802
Component: vim
CWE: CWE-122
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2024-08-26T19:15:07.943000+00:00

A flaw was found in Vim. This issue may allow a heap-buffer overflow via improper management of the typeahead buffer, leading to crashes when error messages occur in combination with several long mappings.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
PCI/MSI: Fix UAF in msi_capability_init
CVE: CVE-2024-41096
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-07-29T00:00:00+00:00

A use after free vulnerability was found in the Linux Kernel. Failure propagates back to pci_msi_setup_msi_irqs() in msi_capability_init(), which accesses the descriptor for unmasking in the error exit path, leading to a loss of confidentiality, integrity, and availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
btrfs: handle errors from btrfs_dec_ref() properly
CVE: CVE-2024-46753
Component: kernel
CWE: CWE-703
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

btrfs: handle errors from btrfs_dec_ref() properly

In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref().  This is
incorrect, we have proper error handling here, return the error.


Remediation:
url-encoded request path information can be broken on ajp-listener
CVE: CVE-2024-6162
Component: undertow
CWE: CWE-488
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-06-19T00:00:00+00:00

A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.

Statement: This issue is classified as moderate severity rather than important because it specifically affects URL-encoded request paths under concurrent access conditions, primarily through the AJP listener. While it can lead to 404 errors or application failures, it does not inherently compromise data integrity, security, or lead to direct unauthorized access. The impact is limited to incorrect handling of certain URL-encoded paths, which means it primarily disrupts access to static or encoded resources rather than posing a broader risk to the system’s overall security or functionality.

Remediation:
Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
To mitigate this issue, you can either switch to a different listener like the http-listener, or adjust the AJP listener configuration. By setting decode-url="false" on the AJP listener and configuring a separate URL decoding filter, you can prevent the path decoding errors. This adjustment ensures that each request is processed correctly without interference from concurrent requests.
perf: RISCV: Fix panic on pmu overflow handler
CVE: CVE-2024-26902
Component: kernel
CWE: CWE-121
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-17T00:00:00+00:00

A flaw was found in the Linux kernel in the RISC-V architecture. The issue arises in the perf subsystem's handling of Performance Monitoring Unit (PMU) overflow interrupts. Specifically, it involves an error when setting bits in the overflowed_ctrs variable, where an incorrect shift operation using an `int` rather than an unsigned long can lead to kernel panic.
This vulnerability triggers a NULL pointer dereference, causing the kernel to crash when running certain perf commands, such as perf record -e branches, on systems like the Sophgo SG2042. The issue results in system instability, potentially leading to a denial-of-service (DoS) scenario. The problem has been fixed by replacing the faulty code with a more appropriate bit-setting operation using the BIT() macro.


Remediation:
netfs: Fix the pre-flush when appending to a file in writethrough mode
CVE: CVE-2024-36001
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-05-20T00:00:00+00:00

A vulnerability was found in the netfs_perform_write() function in the Linux Kernel, where a race condition can lead to kernel panics or improper writeback handling. This issue occurs if certain synchronous flags (O_SYNC, RWF_SYNC) are used or the file is in write-through mode, and the write position is at or beyond the EOF. In these situations, the code skips the flush and wait, which can lead to problems if a write is already in progress. This can lead to data corruption or system instability.

Statement: Red Hat Enterprise Linux is not impacted by this CVE, as this vulnerability does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue and no further action or mitigation is necessary for systems running this operating system.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
riscv: kvm: Fix out-of-bounds array access
CVE: CVE-2024-53228
Component: kernel
CWE: CWE-129
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

riscv: kvm: Fix out-of-bounds array access

In kvm_riscv_vcpu_sbi_init() the entry->ext_idx can contain an
out-of-bound index. This is used as a special marker for the base
extensions, that cannot be disabled. However, when traversing the
extensions, that special marker is not checked prior indexing the
array.

Add an out-of-bounds check to the function.


Remediation:
NVMe: out-of-bounds memory access in nvme_sriov_pre_write_ctrl()
CVE: CVE-2024-26328
Component: QEMU
CWE: CWE-787
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-02-19T00:00:00+00:00

A flaw was found in the NVMe emulation support of QEMU. The register_vfs() function in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, causing the interaction with hw/nvme/ctrl.c to be mishandled. This issue could lead to out-of-bounds memory access in hw/nvme. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

Statement: The affected code path can only be reached if dev->exp.sriov_cap is set. For example, if QEMU is explicitly launched with the hw/nvme SR-IOV emulation enabled (parameter `sriov_max_vfs` is set). The emulation is exclusively used to emulate NVMe devices with SR-IOV capabilities for host software development purposes. Thus, the security impact of this CVE is Low.

The `qemu-kvm` versions, as shipped with Red Hat Enterprise Linux and RHEL Advanced Virtualization, are not affected by this flaw as they did not include support for NVMe emulation.

Remediation:
CVE: CVE-2024-30356
Component: Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2024-03-28T12:39:59.102000+00:00

Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22811.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
fbdev: savage: Error out if pixclock equals zero
CVE: CVE-2024-26778
Component: kernel
CWE: CWE-369
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-04-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fbdev: savage: Error out if pixclock equals zero

The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of pixclock,
it may cause divide-by-zero error.

Although pixclock is checked in savagefb_decode_var(), but it is not
checked properly in savagefb_probe(). Fix this by checking whether
pixclock is zero in the function savagefb_check_var() before
info->var.pixclock is used as the divisor.

This is similar to CVE-2022-3061 in i740fb which was fixed by
commit 15cf0b8.


Remediation:
Null pointer exeption may lead to DoS
CVE: CVE-2024-23080
Component: joda-time
CWE: CWE-476
Severity: None
CVSS v3: 0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2024-04-10T00:00:00+00:00

Joda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.

Statement: Red Hat Product Security does not consider this to be a vulnerability.

Remediation:
net: mana: Fix possible double free in error handling path
CVE: CVE-2024-42069
Component: kernel
CWE: CWE-415
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Fix possible double free in error handling path

When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), callback function adev_release
calls kfree(madev). We shouldn't call kfree(madev) again
in the error handling path. Set 'madev' to NULL.


Remediation:
DOM Clobbering vulnerability within the Prism library's prism-autoloader plugin
CVE: CVE-2024-53382
Component: prismjs
CWE: CWE-94
Severity: Moderate
CVSS v3: 4.7/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Release date: 2024-01-01T00:00:00+00:00

A flaw was found in the prism-autoloader plugin of the Prism library. The prism-autoloader plugin uses `document.currentScript` as the base URL for dynamically loading other dependencies and, in certain circumstances, can be vulnerable to a DOM Clobbering attack. This issue could lead to Cross-site scripting (XSS) attacks on web pages that embed Prism and allow users to inject scriptless HTML elements, such as an `img` tag with a controlled `name` attribute.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2789521

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2789521

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
For more about Red Hat Developer Hub, see References links
SQL Injection in run-llama/llama_index
CVE: CVE-2024-11958
Component: llama-index
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-01-01T00:00:00+00:00

A flaw was found in the run-llama/llama_index. This vulnerability allows remote code execution (RCE) via SQL injection, enabling an attacker to install the shellfs extension and execute malicious commands.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
OAuth2 issue in pgAdmin 4
CVE: CVE-2024-9014
Component: pgadmin4
Release date: 2024-09-23T17:15:14+00:00

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()
CVE: CVE-2024-58034
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()

As of_find_node_by_name() release the reference of the argument device
node, tegra_emc_find_node_by_ram_code() releases some device nodes while
still in use, resulting in possible UAFs. According to the bindings and
the in-tree DTS files, the "emc-tables" node is always device's child
node with the property "nvidia,use-ram-code", and the "lpddr2" node is a
child of the "emc-tables" node. Thus utilize the
for_each_child_of_node() macro and of_get_child_by_name() instead of
of_find_node_by_name() to simplify the code.

This bug was found by an experimental verification tool that I am
developing.

[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]


Remediation:
http request smuggling
CVE: CVE-2024-23829
Component: python-aiohttp
CWE: CWE-444
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2024-01-30T00:00:00+00:00

An HTTP request smuggling vulnerability was found in aiohttp. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets that must trigger error handling to robustly match frame boundaries of proxies in order to protect against the injection of additional requests.


Remediation:
Red Hat Ansible Automation Platform
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For detailed instructions on how to apply this update, see:
https://access.redhat.com/documentation/en-us/red_hat_update_infrastructure/4/html/migrating_red_hat_update_infrastructure/assembly_upgrading-red-hat-update-infrastructure_migrating-red-hat-update-infrastructure

For other information, see the product documentation:
https://access.redhat.com/documentation/en-us/red_hat_update_infrastructure/4
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_and_updating_red_hat_satellite/index
For details on how to apply this update, refer to:
* For upgrading connected Satellite: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html-single/upgrading_connected_red_hat_satellite_to_6.15
* For upgrading disconnected Satellite: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html-single/upgrading_disconnected_red_hat_satellite_to_6.15
net/smc: check return value of sock_recvmsg when draining clc data
CVE: CVE-2024-57791
Component: kernel
CWE: CWE-671
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/smc: check return value of sock_recvmsg when draining clc data

When receiving clc msg, the field length in smc_clc_msg_hdr indicates the
length of msg should be received from network and the value should not be
fully trusted as it is from the network. Once the value of length exceeds
the value of buflen in function smc_clc_wait_msg it may run into deadloop
when trying to drain the remaining data exceeding buflen.

This patch checks the return value of sock_recvmsg when draining data in
case of deadloop in draining.


Remediation:
specially crafted hash can lead to invalid HMAC being accepted by Booth server
CVE: CVE-2024-3049
Component: booth
CWE: CWE-345
Severity: Important
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2024-05-27T00:00:00+00:00

A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
CVE: CVE-2024-40957
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's segment routing (seg6) component in the input_action_end_dx4() and input_action_end_dx6() functions, where improper parameter passing to the NF_HOOK() can occur, which leads to a NULL pointer dereference when a NULL input device is provided, resulting in a kernel crash.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.