huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
JNDI realm authentication weakness
CVE: CVE-2021-30640
Component: tomcat
CWE: CWE-287
Severity: Low
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Release date: 2021-07-12T00:00:00+00:00

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.

Statement: Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Critical flaws.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.11.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.11/
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
Server: Optimizer unspecified vulnerability (CPU Jul 2021)
CVE: CVE-2021-2383
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-07-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
denial of service in the PDF parsing module
CVE: CVE-2021-1405
Component: clamav
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-04-07T00:00:00+00:00

A flaw was found in clamav. The email parsing module could allow an unauthenticated, remote attacker to cause a denial of service condition due to improper variable initialization that may result in an NULL pointer read. The highest threat from this vulnerability is to system availability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
memory leak in the show-status CGI handler when no filter files are configured
CVE: CVE-2021-20210
Component: privoxy
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

Memory leak in the show-status CGI handler when no filter files are configured can lead to a system crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
slirp: invalid pointer initialization may lead to information disclosure (bootp)
CVE: CVE-2021-3592
Component: QEMU
CWE: CWE-824
Severity: Low
CVSS v3: 3.5/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Release date: 2021-06-14T00:00:00+00:00

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality.

Statement: This flaw affects the versions of SLiRP embedded in `qemu-kvm` as shipped with Red Hat Enterprise Linux 8 and RHEL Advanced Virtualization. A future update may address this issue. It is worth noting that although `qemu-kvm` is built with SLiRP networking support, due to its limitations, it is not used by the virtual machine guests by default.

Remediation:
JWT validation bypass when allow_missing is used
CVE: CVE-2021-21378
Component: envoyproxy/envoy
CWE: CWE-287
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Release date: 2021-03-01T20:00:00+00:00

An authentication bypass vulnerability was found in envoyproxy/envoy. When specifying a JSON Web Token (JWT) authentication filter, if `allow_missing` is also used, this flaw allows an attacker to craft a request with a JWT token with an incorrect issuer bypassing the filter. The highest threat from this vulnerability is to confidentiality and integrity.

Statement: Only version 1.9.0 of upstream Istio is affected by the vulnerability. Therefore, even if the OpenShift ServiceMesh (OSSM) does package Istio, it is only v1.6.14 and is not affected.

Remediation:
out-of-bounds memory access in __f2fs_setxattr() in fs/f2fs/xattr.c when an inode has an invalid last xattr entry
CVE: CVE-2021-45469
Component: kernel
CWE: CWE-125
Severity: Important
CVSS v3: 8.4/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-12-06T00:00:00+00:00

An out-of-bounds memory access flaw in the Linux kernel's F2FS (Flash-Friendly File System) functionality was found in the way users mount and operate corrupted image of this file-system if an inode has an invalid last xattr entry. A local user could use this flaw to crash the system or escalate their privileges on the system.


Remediation:
out-of-bounds write in the drill format T-code tool number functionality
CVE: CVE-2021-40391
Component: Gerbv
CVSS v3: 8.2/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Release date: 2021-11-04T00:00:00+00:00

An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). A specially-crafted drill file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
powerpc/smp: do not decrement idle task preempt count in CPU offline
CVE: CVE-2021-47454
Component: kernel
CWE: CWE-362
Severity: Moderate
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's powerpc/smp architecture, where the idle task's preemption count was incorrectly decremented during the CPU offline process. This issue caused a "scheduling while atomic" error when a CPU was offlined and then onlined again, leading to potential system instability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Use after free in sqlite
CVE: CVE-2021-30569
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-07-20T00:00:00+00:00

Use after free in sqlite in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Javascript alert box could have been spoofed onto an arbitrary domain
CVE: CVE-2021-38509
Component: Mozilla
CWE: CWE-1021
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2021-11-02T00:00:00+00:00

Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the attacker's choosing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
f2fs: fix to avoid touching checkpointed data in get_victim()
CVE: CVE-2021-47004
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid touching checkpointed data in get_victim()

In CP disabling mode, there are two issues when using LFS or SSR | AT_SSR
mode to select victim:

1. LFS is set to find source section during GC, the victim should have
no checkpointed data, since after GC, section could not be set free for
reuse.

Previously, we only check valid chpt blocks in current segment rather
than section, fix it.

2. SSR | AT_SSR are set to find target segment for writes which can be
fully filled by checkpointed and newly written blocks, we should never
select such segment, otherwise it can cause panic or data corruption
during allocation, potential case is described as below:

 a) target segment has 'n' (n < 512) ckpt valid blocks
 b) GC migrates 'n' valid blocks to other segment (segment is still
    in dirty list)
 c) GC migrates '512 - n' blocks to target segment (segment has 'n'
    cp_vblocks and '512 - n' vblocks)
 d) If GC selects target segment via {AT,}SSR allocator, however there
    is no free space in targe segment.


Remediation:
out-of-bounds read in TiffReadRGBATile in TiffDecode.c
CVE: CVE-2021-25291
Component: python-pillow
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-02-28T00:00:00+00:00

A flaw was found in python-pillow. Invalid tile boundaries could lead to an OOB Read in TiffReadRGBATile in TiffDecode.c.

Statement: This issue does not affect the versions of python-pillow as shipped with Red Hat Enterprise Linux 8 as it does not include the vulnerable code, which was introduced in a newer upstream version than what what shipped.

Remediation:
Disable the invoice generation feature to mitigate this vulnerability in Red Hat Quay.
SM2 Decryption Buffer Overflow
CVE: CVE-2021-3711
Component: openssl
CWE: CWE-787
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-08-24T00:00:00+00:00

A flaw was found in openssl. A miscalculation of a buffer size was found in openssl's SM2 decryption function, allowing up to 62 arbitrary bytes to be written outside of the buffer. A remote attacker could use this flaw to crash an application supporting SM2 signature or encryption algorithm, or, possibly, execute arbitrary code with the permissions of the user running that application. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: OpenSSL packages shipped with Red Hat Enterprise Linux 8 are not compiled with support for SM2 algorithm and therefore are not affected by this flaw. Packages shipped with Red Hat Enterprise Linux 7 and older do not support the SM2 algorithm. 

The Red Hat Advanced Cluster Management for Kubernetes 2.3.1 and the previous versions are using the vulnerable version of the OpenSSL library, however the vulnerable code path is not reachable.

Remediation:
out-of-bounds reads and writes due to enforcing incorrect limits for pointer arithmetic operations by BPF verifier
CVE: CVE-2021-33200
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-05-26T00:00:00+00:00

A flaw was found in kernel/bpf/verifier.c in BPF in the Linux kernel. An incorrect limit is enforced for pointer arithmetic operations which can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl.   This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For the Red Hat Enterprise Linux 7 the eBPF for unprivileged users is always disabled.
For the Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command:

# cat /proc/sys/kernel/unprivileged_bpf_disabled

The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

A kernel update will be required to mitigate the flaw for the root or users with CAP_SYS_ADMIN capabilities.
novnc allows open redirection
CVE: CVE-2021-3654
Component: openstack-nova
CWE: CWE-601
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2021-05-13T00:00:00+00:00

A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ALSA: pcm: oss: Fix negative period/buffer sizes
CVE: CVE-2021-47511
Component: kernel
CWE: CWE-839
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A denial of service flaw exists in the Linux kernel such that a period size calculation in the OSS layer may receive a negative value as an error, but the code there assumes only the positive values, this may result in disruption to the availability of a system.


Remediation:
gve: Add NULL pointer checks when freeing irqs.
CVE: CVE-2021-47141
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A vulnerability was found in the Generic Virtual Ethernet (gve) driver in the Linux kernel. A NULL pointer dereference could occur during the freeing of notification blocks. This issue arises when attempting to index priv->msix_vectors without prior allocation, potentially leading to a crash if the driver is unloaded.


Remediation:
To mitigate this issue, NULL pointer checks have been added to ensure safe handling during the freeing process of notification blocks within the gve driver. It is advised to update the affected package as soon as possible.
Use after free in dialog box handling on Windows
CVE: CVE-2021-30586
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2021-07-20T00:00:00+00:00

Use after free in dialog box handling in Windows in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
workers listen on external interfaces rather than only localhost
CVE: CVE-2021-42343
Component: python-dask
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-10-22T00:00:00+00:00

An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
possible open redirect in the Host Authorization middleware
CVE: CVE-2021-22942
Component: rubygem-actionpack
CWE: CWE-601
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2021-08-20T00:00:00+00:00

A flaw was found in rubygem-actionpack. Specially crafted “X-Forwarded-Host” headers, in combination with certain “allowed host” formats, can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. The highest threat from this vulnerability is to system availability.

Statement: Red Hat Satellite 6 does ship affected version of RubyGem Actionpack, however, product is not vulnerable as it does not set host configuration the vulnerable way.

Remediation:
information leak in the IPv4 implementation
CVE: CVE-2021-45486
Component: kernel
CWE: CWE-497
Severity: Moderate
CVSS v3: 3.7/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2021-03-24T00:00:00+00:00

An information leak flaw was found in the Linux kernel’s IPv4 implementation in the ip_rt_init in net/ipv4/route.c function. The use of a small hash table in IP ID generation allows a remote attacker to reveal sensitive information.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Use after free in tab search
CVE: CVE-2021-21180
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2021-03-02T00:00:00+00:00

Use after free in tab search in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: