huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
CVE: CVE-2023-44432
Component: Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Release date: 2023-11-14T20:29:41.952000+00:00

Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21584.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
segmentation violation in function cJSON_InsertItemInArray
CVE: CVE-2023-50471
Component: cjson
CWE: CWE-476
Severity: Low
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-12-14T00:00:00+00:00

A flaw was discovered in the cJSON package. Certain input conditions may trigger a null pointer dereference, which can lead to a denial of service.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html/updating_red_hat_satellite/index
CVE: CVE-2023-51630
Component: Paessler PRTG Network Monitor Cross-Site Scripting Authentication Bypass Vulnerability
Release date: 2023-01-01T00:00:00+00:00

Paessler PRTG Network Monitor Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Paessler PRTG Network Monitor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the web console. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system.
. Was ZDI-CAN-21182.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2023-40471
Component: PDF-XChange Editor App Untrusted Pointer Dereference Remote Code Execution Vulnerability
Release date: 2023-08-17T19:06:44.486000+00:00

PDF-XChange Editor App Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20729.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ext4: fix invalid free tracking in ext4_xattr_move_to_block()
CVE: CVE-2023-54062
Component: kernel
CWE: CWE-825
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A memory management flaw was found in the Linux kernel's ext4 filesystem extended attribute handling. In ext4_xattr_move_to_block(), when moving an extended attribute value to an external block, the code checks entry->e_value_inum to determine if the buffer was allocated via kvmalloc(). However, at cleanup time the xattr entry pointer is stale (already removed), leading to either calling kvfree() on an invalid pointer or leaking memory that should have been freed.

Statement: This flaw affects ext4 filesystems using extended attributes stored in external inodes. The invalid free tracking occurs when moving large xattr values to separate blocks. While this can cause memory corruption or leaks, exploiting it requires specific filesystem operations on ext4 with large extended attributes, limiting practical attack scenarios.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Reflective denial of service amplification attack via UDP
CVE: CVE-2023-29552
Component: openslp
CWE: CWE-406
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-04-25T00:00:00+00:00

.The Service Location Protocol (SLP) is vulnerable to an attack through UDP

The OpenSLP provides a dynamic configuration mechanism for applications in local area networks, such as printers and file servers. However, SLP is vulnerable to a reflective denial of service amplification attack through UDP on systems connected to the internet. SLP allows an unauthenticated attacker to register new services without limits set by the SLP implementation. By using UDP and spoofing the source address, an attacker can request the service list, creating a Denial of Service on the spoofed address.

To prevent external attackers from accessing the SLP service, disable SLP on all systems running on untrusted networks, such as those directly connected to the internet. Alternatively, to work around this problem, configure firewalls to block or filter traffic on UDP and TCP port 427.

Statement: The OpenSLP protocol specification makes it prone to UDP amplification attacks, and the abuse of exposed OpenSLP servers can be used to contribute to Distributed Denial of Service attacks. Due to the protocol implementation, this issue can't be directly fixed.

This issue affects the Server component of the openslp package, which is only shipped on Red Hat Enterprise Linux 7 and 9.
RHEL 8 only ships the Client component, that is not affected by this CVE.

The OpenSLP server is not installed and active on any standard RHEL deployments. If you are using the OpenSLP server, Red Hat recommends to do so in a secure and controlled network environment.

Remediation:
media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup
CVE: CVE-2023-53748
Component: kernel
Severity: None
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup

variable *nplanes is provided by user via system call argument. The
possible value of q_data->fmt->num_planes is 1-3, while the value
of *nplanes can be 1-8. The array access by index i can cause array
out-of-bounds.

Fix this bug by checking *nplanes against the array size.


Remediation:
recordmcount: Fix memory leaks in the uwrite function
CVE: CVE-2023-53318
Component: kernel
Severity: None
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

recordmcount: Fix memory leaks in the uwrite function

Common realloc mistake: 'file_append' nulled but not freed upon failure


Remediation:
Multiple vulnerabilities
CVE: CVE-2023-29417
Component: bzip3
Release date: 2023-04-06T00:00:00+00:00

An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3_decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a contract violation, and thus the report is invalid.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
File upload component had a directory traversal vulnerability
CVE: CVE-2023-50164
Component: Struts
CWE: CWE-552
Severity: Critical
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2023-12-07T00:00:00+00:00

A flaw was found in Apache Struts. Affected versions of this package are vulnerable to Remote Code Execution (RCE) via manipulation of file upload parameters that enable path traversal. Under certain conditions, uploading a malicious file is possible, which may then be executed on the server.


Remediation:
ravb: Fix use-after-free issue in ravb_tx_timeout_work()
CVE: CVE-2023-52509
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ravb: Fix use-after-free issue in ravb_tx_timeout_work()

The ravb_stop() should call cancel_work_sync(). Otherwise,
ravb_tx_timeout_work() is possible to use the freed priv after
ravb_remove() was called like below:

CPU0			CPU1
			ravb_tx_timeout()
ravb_remove()
unregister_netdev()
free_netdev(ndev)
// free priv
			ravb_tx_timeout_work()
			// use priv

unregister_netdev() will call .ndo_stop() so that ravb_stop() is
called. And, after phy_stop() is called, netif_carrier_off()
is also called. So that .ndo_tx_timeout() will not be called
after phy_stop().


Remediation:
heap-buffer overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c
CVE: CVE-2023-25434
Component: libtiff
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2023-06-14T00:00:00+00:00

A heap-based buffer overflow vulnerability was found in LibTIFF's tiffcrop utility in the extractContigSamplesBytes() function. This flaw allows an attacker to pass a crafted TIFF image file to the tiffcrop utility, which causes an out-of-bounds read access resulting in an application crash, eventually leading to a denial of service.

Statement: This vulnerability in tiffcrop is classified as moderate severity rather than important because, while it leads to a denial of service (DoS) via a crash, the impact is not critical in terms of system compromise or data loss. The vulnerability, caused by a heap-based buffer overflow, results in an out-of-bounds read, which disrupts the functionality of the tiffcrop utility but does not allow an attacker to execute arbitrary code or escalate privileges. Additionally, exploitation requires the attacker to provide a specially crafted TIFF file, meaning it is not easily triggered remotely without user interaction. While it poses a disruption to operations, it does not lead to broader system vulnerabilities or compromise, justifying its classification as moderate severity.

Remediation:
OpenSSL error handling issues in nodejs crypto library
CVE: CVE-2023-23919
Component: Node.js
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-02-16T00:00:00+00:00

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Statement: This vulnerability has been rated as moderate by Redhat for several reasons,first and foremost being that in order for the stack to crash,same thread would have to be used by the application which is a complexity outside the hands of attacker because in node.js workloads may be isolated or not happen sequentially on the same thread, reducing exposure,moreover the exploitation might lead to denial of service and poses no threat to confidentiality or integrity of the system.

Remediation:
Inappropriate implementation in Internals
CVE: CVE-2023-1236
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-03-07T00:00:00+00:00

Inappropriate implementation in Internals in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to spoof the origin of an iframe via a crafted HTML page. (Chromium security severity: Low)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2023-32172
Component: Unified Automation UaGateway OPC UA Server Use-After-Free Denial-of-Service Vulnerability
Release date: 2023-05-31T23:59:09.188000+00:00

Unified Automation UaGateway OPC UA Server Use-After-Free Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of the ImportXML function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20497.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Denial of Service in io_uring due to hung task detection
CVE: CVE-2023-53461
Component: kernel
CWE: CWE-667
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-01T00:00:00+00:00

A flaw was identified in the Linux kernel’s io_uring subsystem related to how request completions are handled when an io_uring instance exits. During cleanup, the function io_ring_exit_work was waiting in an uninterruptible state for request completions. Under certain test and signal conditions (e.g., when the owning task is parked via SIGSTOP), this could block making progress on completions and trigger the kernel’s hung task detection mechanism, potentially leading to system instability or panic on systems configured with panic_on_hung_task.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To prevent a system panic, administrators can disable the `panic_on_hung_task` kernel parameter. This can be achieved by creating a new sysctl configuration file (e.g., `/etc/sysctl.d/99-disable-hung-task-panic.conf`) with the content `kernel.panic_on_hung_task = 0`. Apply the change using `sysctl -p /etc/sysctl.d/99-disable-hung-task-panic.conf`. This mitigation prevents system panics but does not prevent the hung task condition itself, which may still lead to system instability. A system reboot is required for the change to take full effect.
CVE: CVE-2023-38085
Component: Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2023-07-13T20:34:39.792000+00:00

Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20491.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
CVE: CVE-2023-46233
Component: crypto-js
CWE: CWE-916
Severity: Important
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2023-10-25T00:00:00+00:00

A vulnerability was found in crypto-js in how PBKDF2 is 1,000 times weaker than originally specified in 1993 and at least 1,300,000 times weaker than the current industry standard. This issue is because both default to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and default to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on the iteration count as a countermeasure to preimage and collision attacks.

Statement: The vulnerability in crypto-js's PBKDF2 implementation represents a important CVE issue due to its fundamental impact on cryptographic security. PBKDF2 is widely used for password protection and signature generation, making it a core component of many security-critical systems. However, the default settings in crypto-js result in significantly weaker security than industry standards, with the algorithm being 1,000 times weaker than originally specified in 1993 and millions of times weaker than current recommendations. This weakness stems from the use of the insecure SHA1 hash algorithm and the default of only one iteration, both of which greatly diminish the resistance against various attacks. Consequently, attackers can exploit this vulnerability to create identical cryptographic signatures, potentially gaining unauthorized access to sensitive information or compromising system integrity. Given the widespread use of crypto-js and the important role of PBKDF2 in cryptographic operations, addressing this vulnerability is paramount to safeguarding against security breaches and maintaining trust in digital systems.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
netfilter: nf_tables: disallow timeout for anonymous sets
CVE: CVE-2023-52620
Component: kernel
CWE: CWE-99
Severity: Moderate
CVSS v3: 2.6/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-01-01T00:00:00+00:00

A vulnerability was found in netfilter/nf_tables componets of Linux Kernel allows an userspace to set timeouts for anonymous sets, which are not intended to be used this way. This could lead to unexpected behaviour or security issues.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
patch regression for CVE-2021-21419 in some Red Hat builds
CVE: CVE-2023-5625
Component: python-eventlet
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2023-10-17T00:00:00+00:00

A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.


Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
CVE: CVE-2023-27370
Component: NETGEAR RAX30 Device Configuration Cleartext Storage Information Disclosure Vulnerability
Release date: 2023-05-01T21:31:01.627000+00:00

NETGEAR RAX30 Device Configuration Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the handling of device configuration. The issue results from the storage of configuration secrets in plaintext. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19841.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
allows an attacker to force Salt-SSH to run their script
CVE: CVE-2023-34049
Component: salt
CVSS v3: 6.7/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2023-10-30T00:00:00+00:00

The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Inefficient regular expression complexity in luxon.js
CVE: CVE-2023-22467
Component: luxon
CWE: CWE-1333
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2023-01-04T00:00:00+00:00

A flaw was found in the luxon package, resulting in a regular expression denial of service. This issue could allow an attacker to craft and supply inputs above 10k characters, causing a denial of service.


Remediation: