huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Arbitrary Code Execution in thenify
CVE: CVE-2020-7677
Component: thenify
CWE: CWE-78
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in the thenify package. Users can control the name argument provided to the package without any sanitization, and this is provided to the eval function without any sanitization, which leads to arbitrary code execution.

Statement: Red Hat Service Registry does not directly use the vulnerable code, but has a dependency on the affected package, and as such is affected at Low impact.

Red Hat Service Mesh (OSSM) is closed as Won't Do as Thenify is hosted only by Cucumber, which is a development dependency for automation testing and is not part of the production container.

As an aside, this is already resolved in the upcoming 2.3 version.

Remediation:
use-after-free in fs/namei.c
CVE: CVE-2020-8428
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.1/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-28T00:00:00+00:00

A flaw was found in the Linux kernel. The may_create_in_sticky in fs/namei.c function has a possible use-after-free which can allow a local user to cause a denial of service (OOPS) or possibly obtain sensitive information from kernel memory. The highest threat from this vulnerability is to system availability.


Remediation:
environment variables leak between containers when started via Varlink or Docker-compatible REST API
CVE: CVE-2020-14370
Component: podman
CWE: CWE-212
Severity: Moderate
CVSS v3: 5.4/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-09-22T00:00:00+00:00

An information disclosure flaw was found in containers/podman. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container leak into subsequent containers. This flaw allows an attacker who controls the subsequent containers to gain access to sensitive information stored in such variables. The highest threat from this vulnerability is to confidentiality.

Statement: Whilst OpenShift Container Platform (OCP) does include podman, the Varlink API is not enabled by default. However, as it is trivial to activate this feature, OCP has been marked as affected.

OCP 3.11 has previously packaged podman, but instead now relies on the version from rhel-extra.The older version previously packaged is not vulnerable to this CVE and hence has been marked not affected.

Remediation:
For OpenShift Container Platform 4.6 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.
Divide by zero in eps_print_page in gdevepsn.c
CVE: CVE-2020-21710
Component: ghostscript
CWE: CWE-369
Severity: Low
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

GhostScript is vulnerable to divide by zero issue in function eps_print_page in gdevepsn.c allows remote attacker to cause a denial of service via crafted PDF file.


Remediation:
CSRF at admin email
CVE: CVE-2020-13231
Component: cacti
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2020-03-11T00:00:00+00:00

In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Incorrect security UI in WebUSB
CVE: CVE-2020-16033
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-11-17T00:00:00+00:00

Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page.


Remediation:
Use-After-Free when trying to connect to a STUN server
CVE: CVE-2020-12420
Component: Mozilla
CWE: CWE-416
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-06-30T00:00:00+00:00

The Mozilla Foundation Security Advisory describes this flaw as:

When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila
CVE: CVE-2020-27781
Component: ceph
CWE: CWE-522
Severity: Important
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-12-16T00:00:00+00:00

User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface drivers. Then, all users of the requesting OpenStack project can view the access key. This enables the attacker to target any resource that the user has access to. This can be done to even "admin" users, compromising the ceph administrator.

Statement: Red Hat OpenStack Platform deployments use the ceph package directly from the Ceph channel; the RHOSP package will not be updated at this time.

Red Hat OpenShift Container Storage (RHOCS) 4 shipped ceph package for the usage of RHOCS 4.2 only, that has reached End Of Life. The shipped version of ceph package is no longer used and supported with the release of RHOCS 4.3.

Red Hat Enterprise Linux ceph packages do not include the vulnerable component.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
HTTP request smuggling when presented with two Content-Length headers
CVE: CVE-2020-10108
Component: python-twisted
CWE: CWE-444
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2020-03-11T00:00:00+00:00

A flaw was found in python-twisted-web, where it does not correctly process HTTP requests, accepting requests with more than one Content-Length header. When the requests sent from and to the python-twisted-web are processed by another component that correctly processes HTTP requests, for example, a proxy, back-end, or web application firewall, a remote attacker can use this flaw to perform an HTTP request smuggling attack. This flaw impacts the system differently based on the type of application and the infrastructure.

Statement: OpenShift Container Platform 4.3 and later includes `python-twisted` as a dependency of `python-prometheus_client` in Ironic container images, however the affected code is not used.

Red Hat OpenStack Platform packages the flawed code, however python-twisted's web.HTTP functionality is not used in the RHOSP environment. For this reason, the RHOSP impact has been lowered to moderate and no update will be provided at this time for the RHOSP python-twisted package.

Red Hat Satellite uses affected versions of `python-twisted` and  `python-twisted-web` modules in Pulp, however, it is not vulnerable since `http` modal of web implementation is not expose in product. Red Hat Satellite may update `python-twisted` and `python-twisted-web` in future.

This issue affects the version of python-twisted(embedded in calamari-server) shipped with Red Hat Ceph Storage 2. However, calamari is no longer supported, hence the embedded python-twisted package will not be fixed.

Remediation:
When python-twisted-web is used as the back-end of your infrastructure, you can partially mitigate the problem by ensuring that each request on the front-end component (e.g. proxy) is sent over a separate network connection to the python-twisted-web server. This will prevent interference between different users, but it will not prevent all possible attacks that can be performed, which would vary based on the infrastructure and application in use.
integer overflow in bson_ensure_space() parameter bytesNeeded
CVE: CVE-2020-12135
Component: bson
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-04-13T00:00:00+00:00

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.

Statement: This flaw does not affect versions of bson that are shipped with Red Hat Software Collections packages. The vulnerable code is present in an older version of bson.

Remediation:
InnoDB unspecified vulnerability (CPU Oct 2020)
CVE: CVE-2020-14848
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-10-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
KVM subsystem allows out-of-range access to memslots after a deletion
CVE: CVE-2020-36313
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-03-26T00:00:00+00:00

A flaw was found in the Linux kernel. The KVM subsystem allows out-of-range access to memslots after a deletion. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
Mitigation for this issue is either not available or the currently available options does not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Heap buffer overflow in WebAudio
CVE: CVE-2020-6524
Component: chromium-browser
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-07-14T00:00:00+00:00

Heap buffer overflow in WebAudio in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
KVM: host stack overflow due to lazy update IOAPIC
CVE: CVE-2020-27152
Component: Kernel
CWE: CWE-835
Severity: Moderate
CVSS v3: 4.8/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H
Release date: 2020-08-02T00:00:00+00:00

A stack overflow flaw via an infinite loop condition issue was found in the KVM hypervisor of the Linux kernel. This flaw occurs while processing interrupts because the IRQ state is erroneously set. This flaw allows a guest user to crash the host kernel, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Statement: This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.
This issue affects the version of the kernel package as shipped with Red Hat Enterprise Linux 8. Future kernel updates for Red Hat Enterprise Linux 8  may address this issue.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Disabling APICV by setting the kvm_intel.enable_apicv=0 parameter helps to avoid this situation.
XSS in the HTML Data Processor allows remote attackers to inject arbitrary web script through a crafted "protected" comment
CVE: CVE-2020-9281
Component: ckeditor
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2020-03-06T00:00:00+00:00

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
remote code execution via the backup functionality
CVE: CVE-2020-11060
Component: glpi
CVSS v3: 7.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Release date: 2020-05-11T00:00:00+00:00

In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only conceivable by an account having Maintenance privileges and the right to add WIFI networks. This is fixed in version 9.4.6.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Missing maximum length check in WindowsNativeDispatcher.asNativeBuffer() (Libraries, 8242695)
CVE: CVE-2020-14798
Component: OpenJDK
CWE: CWE-190
Severity: Moderate
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2020-10-20T00:00:00+00:00

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).


Remediation:
Server: Options unspecified vulnerability (CPU Jul 2020)
CVE: CVE-2020-14632
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-07-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
NULL pointer dereference in bfd_pef_parse_symbols function in bfd/pef.c
CVE: CVE-2020-35495
Component: binutils
CWE: CWE-476
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in binutils. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability.

Statement: Red Hat has determined this vulnerability to be of low impact, as it can only be triggered by tricking the objdump program into disassembling a corrupt input file, which will only cause the program to fail.

binutils as shipped with Red Hat Enterprise Linux 8's GCC Toolset 10 and Red Hat Developer Toolset 10 are not affected by this flaw because the versions shipped have already received the patch.

Remediation:
Server: DML unspecified vulnerability (CPU Jan 2020)
CVE: CVE-2020-2588
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
untrusted users able to run pending migrations in production
CVE: CVE-2020-8185
Component: rubygem-rails
CWE: CWE-250
Severity: Moderate
CVSS v3: 6.8/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
Release date: 2020-06-17T00:00:00+00:00

A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.

Statement: Red Hat Satellite and Red Hat CloudForms do not ship vulnerable versions of RubyGem Rails hence not affected to the flaw.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258