huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
URL injection (post-authentication) vulnerability
CVE: CVE-2020-13977
Component: nagios
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Release date: 2020-06-09T00:00:00+00:00

Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()
CVE: CVE-2020-36785
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()

The "s3a_buf" is freed along with all the other items on the
"asd->s3a_stats" list.  It leads to a double free and a use after free.


Remediation:
Use after free in V8
CVE: CVE-2020-6448
Component: chromium-browser
Severity: Low
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-04-07T00:00:00+00:00

Use after free in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
bounds tracking issue during use of 64-bit values in scalar32_min_max_or function in kernel/bpf/verifier.c
CVE: CVE-2020-27194
Component: kernel
CWE: CWE-190
Severity: None
CVSS v3: 0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2020-10-08T00:00:00+00:00

An out-of-bounds access flaw was found in the Linux kernel’s implementation of the eBPF (Berkeley Packet Filter) code verifier, where an incorrect register bounds calculation occurs while in use of 64-bit values with scalar32_min_max_or (that is BPF_OR). This flaw allows an unprivileged local user (until param kernel.unprivileged_bpf_disabled is set) to have arbitrary read/write access to the kernel memory or escalate their privileges on the system.

Statement: This flaw is rated as having a Moderate impact because in the default configuration, the issue can only be triggered by a privileged local user.

Remediation:
For Red Hat Enterprise Linux, the Berkeley Packet Filter is available only for privileged users. However, if enabled for an unprivileged user, the mitigation is to disable unprivileged access to the BPF using the following sysctl: kernel.unprivileged_bpf_disabled=1.
SELinux prevents pam-u2f to work correctly, disabling the 2nd factor during authentication
CVE: CVE-2020-24612
Component: selinux-policy
CVSS v3: 4.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2020-07-27T00:00:00+00:00

An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option (the default when configured by the authselect tool), and that file cannot be read, the second factor is disabled. An attacker with only the knowledge of the password can then log in, bypassing 2FA.

Statement: Red Hat Enterprise Linux is not affected by this issue as it does not ship pam-u2f.

In Fedora, updating the package does not trigger a relabeling of the users' pre-existing 2nd factor configuration (including root), and such may need to be manually updated, using the `fixfiles onboot` command, followed by a reboot (or by applying the mitigation).

Remediation:
division by zero in bj10v_print_page() in contrib/japanese/gdev10v.c could result in a DoS
CVE: CVE-2020-16299
Component: ghostscript
CWE: CWE-369
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-08-13T00:00:00+00:00

A Division by Zero vulnerability in bj10v_print_page() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
lib/util.c does not properly check embedded length fields could result in information disclosure
CVE: CVE-2020-13131
Component: yubico-piv-tool
CVSS v3: 4.3/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-10-21T00:00:00+00:00

An issue was discovered in Yubico libykpiv before 2.1.0. lib/util.c in this library (which is included in yubico-piv-tool) does not properly check embedded length fields during device communication. A malicious PIV token can misreport the returned length fields during RSA key generation. This will cause stack memory to be copied into heap allocated memory that gets returned to the caller. The leaked memory could include PINs, passwords, key material, and other sensitive information depending on the integration. During further processing by the caller, this information could leak across trust boundaries. Note that RSA key generation is triggered by the host and cannot directly be triggered by the token.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
segmentation fault in tok_text function in asm/preproc.c by accessing read memory
CVE: CVE-2020-24242
Component: nasm
CWE: CWE-476
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-07-28T00:00:00+00:00

In Netwide Assembler (NASM) 2.15rc10, SEGV can be triggered in tok_text in asm/preproc.c by accessing READ memory.

Statement: nasm as shipped with Red Hat Enterprise Linux 7 and 8 is not affected by this flaw because the vulnerable code was introduced in a newer version of nasm.

Remediation:
Sentinel EGP policy feature incorrectly allowed requests to be processed
CVE: CVE-2020-35453
Component: vault
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2020-12-16T00:00:00+00:00

HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1.

Statement: This flaw affects the Enterprise version of Hashicorp Vault only, not the Open Source version.

Remediation:
Signature Malleability in EdDSA-Java Leading to SUF-CMA Violation
CVE: CVE-2020-36843
Component: d25519-java
CVSS v3: 4.3/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in EdDSA-Java (ed25519-java). This vulnerability allows attackers to create new valid signatures different from previous signatures for a known message via signature malleability, violating the  Strong Existential Unforgeability under Chosen Message Attacks (SUF-CMA) property.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
input validation issue allows users to store unlimited data in workflow rules
CVE: CVE-2020-8293
Component: nextcloud
CVSS v3: 5.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
accepting plaintext data frames in protected networks
CVE: CVE-2020-26140
Component: kernel
CWE: CWE-346
Severity: Moderate
CVSS v3: 6.4/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2020-01-01T00:00:00+00:00

A vulnerability was found in Linux kernel. Where the WiFi implementations accept plaintext frames in a protected WiFi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.


Remediation:
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Heap buffer overflow in hash_findi() in hashtbl.c
CVE: CVE-2020-21685
Component: nasm
CWE: CWE-119
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-06T00:00:00+00:00

Buffer Overflow vulnerability in hash_findi function in hashtbl.c in nasm 2.15rc0 allows remote attackers to cause a denial of service via crafted asm file.


Remediation:
infinite loop via the return value of zzip_file_read() as used in unzzip_cat_file()
CVE: CVE-2020-18442
Component: zziplib
CWE: CWE-835
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-01-01T00:00:00+00:00

Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file".

Statement: Red Hat Enterprise 7 is not affected by this flaw because it shipped with a version prior to the flaw being introduced.

Remediation:
use of unserialize function for the mailtodata value in compose.php
CVE: CVE-2020-14932
Component: squirrelmail
CWE: CWE-676
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2020-06-20T00:00:00+00:00

An unsafe deserialization vulnerability was found in SquirrelMail. This flaw allows an authenticated user to craft malicious form data when submitting mail.


Remediation:
integer overflow in MagickCore/quantum-export.c
CVE: CVE-2020-27751
Component: ImageMagick
CWE: CWE-190
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in ImageMagick in MagickCore/quantum-export.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned long long` as well as a shift exponent that is too large for 64-bit type. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior.

Statement: This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regarding support scopes, please see https://access.redhat.com/support/policy/updates/errata .

Remediation:
Incorrect parsing of template tag could result in JavaScript injection
CVE: CVE-2020-6798
Component: Mozilla
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2020-02-11T00:00:00+00:00

If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
users with Log in as capability in a course context leads to privilege escalation
CVE: CVE-2020-25629
Component: moodle
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2020-09-21T00:00:00+00:00

A flaw was found in Moodle where users with "Log in as" a capability in a course context (typically, course managers) may gain access to some site administration capabilities by "logging in as" a System manager. This issue affects versions 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13, and earlier unsupported versions. This is fixed in versions 3.9.2, 3.8.5, 3.7.8, and 3.5.14.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out-of-bounds read may lead to unexpected application termination or arbitrary code execution
CVE: CVE-2020-9894
Component: webkitgtk
CWE: CWE-125
Severity: Moderate
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-07-29T00:00:00+00:00

An out-of-bounds read flaw was found in webkitgtk that affected WebKitGTK versions before 2.28.4 and WPE WebKit versions before 2.28.4. This flaw allows a remote attacker to cause unexpected application termination or arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

GDM must be restarted for this update to take effect.
Stored XSS vulnerability in upstream cause
CVE: CVE-2020-2221
Component: jenkins
CWE: CWE-79
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-07-15T00:00:00+00:00

A flaw was found in Jenkins versions 2.244 and prior and in LTS 2.235.1 and prior. The upstream job's display name is not escaped on build time trend pages which could lead to a stored cross-site scripting (XSS) vulnerability. The user must have the Agent/Configure permission for this exploit to function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
See the following documentation, which will be updated shortly for release
3.11.272, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
For OpenShift Container Platform 4.3 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.4 see the following documentation, which
will be updated shortly for release 4.4.18, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.5 see the following documentation, which
will be updated shortly for release 4.5.7, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.
Out of bound reads in dovecot NTLM implementation
CVE: CVE-2020-12673
Component: dovecot
CWE: CWE-125
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-08-12T12:00:00+00:00

A flaw was found in dovecot. An out-of-bounds read flaw was found in the way dovecot handled NTLM authentication allowing an attacker to crash the dovecot auth process repeatedly preventing login. The highest threat from this vulnerability is to system availability.


Remediation:
Upstream suggests that this flaw can be mitigated by disabling NTLM authentication. NTLM authentication can be disabled by using the configuration parameter "auth_mechanisms". More details available at: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
Sandbox escape with improperly separated process types
CVE: CVE-2020-12389
Component: Mozilla
CWE: CWE-284
Severity: Important
CVSS v3: 10/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2020-05-05T00:00:00+00:00

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.

Statement: This issue only affects Firefox on Windows operating systems.  Firefox on Linux is not affected.

Remediation:
problem with privacy after user logout
CVE: CVE-2020-1724
Component: keycloak
CWE: CWE-613
Severity: Low
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-05-07T00:00:00+00:00

A flaw was found in Keycloak. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
QLibrary loads libraries relative to CWD which could result in arbitrary code execution
CVE: CVE-2020-24741
Component: qt
CWE: CWE-22
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

Qt5 versions up to qt 5.12.7, qt 5.14.1, qt 5.15.0 allows plugins to be loaded from current working directory, this can lead to compromised plugins to loaded leading to possible arbitrary code execution.


Remediation:
multiple vulnerabilities
CVE: CVE-2020-8155
Component: nextcloud
Release date: 2020-03-18T00:00:00+00:00

An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: