huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Missing access control leads to escalation of admin group privileges
CVE: CVE-2020-10783
Component: CloudForms
CWE: CWE-284
Severity: Important
CVSS v3: 8.2/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Release date: 2020-08-03T13:30:00+00:00

A role-based privileges escalation flaw was found in Red Hat CloudForms where export or import of administrator files was possible. An attacker with EVM-Operator group can perform actions restricted only to system administrator.

Refer CVE-2020-25716 for remaining RBAC group fixes.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
incorrect handling of records in the answer section of a NXDOMAIN response lacking an SOA allows an attacker to bypass DNSSEC validation
CVE: CVE-2020-12244
Component: pdns-recursor
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-05-19T00:00:00+00:00

An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
xenoprof issue allows guest OS users with active profiling to obtain sensitive information about other guests (XSA-313)
CVE: CVE-2020-11741
Component: xen
CWE: CWE-862
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-04-14T00:00:00+00:00

A flaw was found in Xenoprof in the Xen virtual machine through version 4.13.x, where it allows guest OS users, with active profiling, to obtain sensitive information about other guests, cause a denial of service, or possibly gain privileges. For guests with “active” profiling enabled by the administrator, the Xenoprof code uses the standard Xen shared ring structure. With this flaw, the code does not treat the guest as a potential attacker, and it trusts the guest not to modify the buffer size information and not modify the head/tail pointers in unexpected ways, which can lead to a denial of service or escalation of privileges.


Remediation:
CVE: CVE-2020-1893
Component: CVE-2020-1893
Release date: 2020-01-01T00:00:00+00:00

Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
WASSP dissector crash (wnpa-sec-2020-01)
CVE: CVE-2020-7044
Component: wireshark
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-15T00:00:00+00:00

In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash. This was addressed in epan/dissectors/packet-wassp.c by using >= and <= to resolve off-by-one errors.

Statement: This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 7, and 8 as they did not include the vulnerable code.

Remediation:
xen: guest OS users can cause a DoS via a high rate of events to dom0 (XSA-332)
CVE: CVE-2020-27673
Component: kernel
CWE: CWE-400
Severity: None
CVSS v3: 0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2020-10-20T00:00:00+00:00

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.


Remediation:
information disclosure through public FAQ
CVE: CVE-2020-15217
Component: glpi
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-10-07T00:00:00+00:00

In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
heap buffer overflow in sdhci_sdma_transfer_multi_blocks() in hw/sd/sdhci.c
CVE: CVE-2020-17380
Component: QEMU
CWE: CWE-119
Severity: Moderate
CVSS v3: 4.9/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Release date: 2020-08-11T00:00:00+00:00

A flaw was found in QEMU. A heap-based buffer overflow vulnerability was found in the SDHCI device emulation support allowing a guest user or process to crash the QEMU process on the host resulting in a denial of service condition, or potentially execute arbitrary code with privileges of the QEMU process on the host. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This flaw did not affect the following versions of QEMU as they did not include support for SDHCI device emulation:
* `qemu-kvm-ma` as shipped with Red Hat Enterprise Linux 7.
* `qemu-kvm-rhev` as shipped with Red Hat Virtualization and Red Hat OpenStack.
* `qemu-kvm` as shipped with Red Hat Enterprise Linux 6, 7, 8, and RHEL Advanced Virtualization.

Remediation:
invalid read in process_symbol_table could result in DoS
CVE: CVE-2020-16591
Component: binutils
CWE: CWE-125
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-12-10T00:00:00+00:00

A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid read in process_symbol_table, as demonstrated in readeif.

Statement: binutils as shipped in Red Hat Developer Toolsets 9 and 10, Red Hat Enterprise Linux 8 BaseOS and GCC Toolsets 9 and 10, are all not affected by this flaw as it was introduced in a newer version of binutils code than shipped for BaseOS and the 9 toolsets, and already patched in the versions shipped with 10 toolsets.

Remediation:
sending a crafted pcap file to the 'tcpreplay-edit could result in DoS
CVE: CVE-2020-18976
Component: tcpreplay
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

Buffer Overflow in Tcpreplay v4.3.2 allows attackers to cause a Denial of Service via the 'do_checksum' function in 'checksum.c'. It can be triggered by sending a crafted pcap file to the 'tcpreplay-edit' binary. This issue is different than CVE-2019-8381.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
overly large SETTINGS frames can lead to DoS
CVE: CVE-2020-11080
Component: nghttp2
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-06-02T00:00:00+00:00

A resource consumption vulnerability was found in nghttp2. This flaw allows an attacker to repeatedly construct an overly large HTTP/2 SETTINGS frame with a length of 14,400 bytes that causes excessive CPU usage, leading to a denial of service.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.
The OpenShift Service Mesh release notes provide information on the features and known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html
The OpenShift Service Mesh release notes provide information on the features and known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
SSRF: Server Side Request Forgery on webhooks
CVE: CVE-2020-14328
Component: Tower
CWE: CWE-918
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-07-14T00:00:00+00:00

A flaw was found in Ansible Tower. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.

Statement: Ansible Tower 3.7.1 as well as previous versions are affected.

Remediation:
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
messages userrights-expiry-current and userrights-expiry-none can contain raw html
CVE: CVE-2020-35475
Component: mediawiki
CWE: CWE-79
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-12-18T00:00:00+00:00

In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. (The right column with the changeable groups is not affected and is escaped correctly.)


Remediation:
archive traversal vulnerability in ansible-galaxy collection install
CVE: CVE-2020-10691
Component: Ansible
CWE: CWE-22
Severity: Moderate
CVSS v3: 4.9/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Release date: 2020-03-27T00:00:00+00:00

An archive traversal flaw was found in Ansible Engine when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

Statement: Ansible Engine 2.9.6 as well as previous 2.9.x versions are affected. Ansible versions less than or equal to 2.8 are not affected by this vulnerability as this functionality was introduced on 2.9.

Ansible Tower 3.6.3 as well as previous 3.6.x versions are affected as they use ansible-galaxy collections.

Remediation:
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
A possible mitigation of archive traversal issue could be done by restricting file access control and directory write accesses for extracting tarball files. This is feasible only for scenarios when the destination path could be known and enforced beforehand.
Cross-site scripting in translation helpers
CVE: CVE-2020-15169
Component: rubygem-activeview
CWE: CWE-79
Severity: Moderate
CVSS v3: 0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2020-09-09T00:00:00+00:00

A flaw was found in rubygem-actionview in versions prior to 5.2.4.4 and 6.0.3.3. When an HTML-unsafe string is passed as the default for a missing  translation key, the default string is incorrectly marked as HTML-safe and not escaped. Thie highest threat from this vulnerability is to data confidentiality and integrity.

Statement: Red Hat CloudForms and Red Hat Satellite 6 ships affected ActiveView RubyGem, however, those are not vulnerable since product code do not use such unsafe implementation.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Insufficient policy enforcement in URL formatting
CVE: CVE-2020-6481
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-05-19T00:00:00+00:00

Insufficient policy enforcement in URL formatting in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to perform domain spoofing via a crafted domain name.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
plugin names are not sanitized properly
CVE: CVE-2020-15186
Component: helm
Severity: Low
CVSS v3: 3.7/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Release date: 2020-09-18T00:00:00+00:00

In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`. This issue has been patched in Helm 3.3.2. A possible workaround is to not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-] range.


Remediation:
MIME multipart dissector crash (wnpa-sec-2020-11)
CVE: CVE-2020-25863
Component: wireshark
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-09-23T00:00:00+00:00

In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This was addressed in epan/dissectors/packet-multipart.c by correcting the deallocation of invalid MIME parts.


Remediation:
use-after-free when a valid page was followed by a page with invalid pixmap dimensions
CVE: CVE-2020-16600
Component: mupdf
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-03-27T00:00:00+00:00

A Use After Free vulnerability exists in Artifex Software, Inc. MuPDF library 1.17.0-rc1 and earlier when a valid page was followed by a page with invalid pixmap dimensions, causing bander - a static - to point to previously freed memory instead of a newband_writer.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
CVE: CVE-2020-8165
Component: rubygem-activesupport
CWE: CWE-20
Severity: Important
CVSS v3: 0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2020-05-18T00:00:00+00:00

A flaw was found in rubygem-activesupport. An untrusted user input can be written to the cache store using the `raw: true` parameter which can lead to the result being evaluated as a marshaled object instead of plain text. The threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This issue affects the version of rubygem-activesupport as shipped with Red Hat Gluster Storage 3. However, the 'raw' option is not used by the product when storing untrusted user input and hence this issue has been rated as having a security impact of Low.

Red Hat Satellite ship affected RubyGem ActiveSupport and use RedisCacheStore, however, unmarshalling of user-provided objects is handled well in product code hence it is not vulnerable to the flaw. We may update the Ruby on Rails and rails-core dependency in a future release.

in OpenShift Container Platform 3.11, rubygem-activesupport is shipped, and it's included in the logging-fluentd container for use by rubygem-kubeclient [1]. The kubeclient gem does NOT make use of the vulnerable class, its only included for the inflector part of activesupport.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
XML parser not configured to prevent XXE attack
CVE: CVE-2020-2138
Component: jenkins-cobertura-plugin
CWE: CWE-611
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2020-03-09T00:00:00+00:00

Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.


Remediation:
Hashicorp Vault AWS IAM Integration Authentication Bypass
CVE: CVE-2020-16250
Component: vault
CWE: CWE-290
Severity: Moderate
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Release date: 2020-08-26T00:00:00+00:00

A flaw was found in Vault and Vault Enterprise (“Vault”). In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM identities and roles may be manipulated and bypass authentication.


Remediation:
These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:

https://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index

All Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.
Out of bounds write in new_node() function
CVE: CVE-2020-35530
Component: LibRaw
CWE: CWE-787
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-04-03T00:00:00+00:00

A vulnerability was found in LibRaw. An out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) can be triggered via a crafted X3F file.


Remediation:
ASP.NET Core Resource Consumption Denial of Service
CVE: CVE-2020-1597
Component: dotnet
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-08-11T17:21:00+00:00

A flaw was found in ASP.NET Core. Client disconnects were not properly handled in all circumstances. A remote, unauthenticated attacker could send specially crafted requests that would consume more disk and CPU resources than necessary potentially leading to a denial of service via resource exhaustion. The highest threat from this vulnerability is to system availability.


Remediation:
Invalid input could cause a use-after-free in DeepScanLineInputFile::DeepScanLineInputFile() in IlmImf/ImfDeepScanLineInputFile.cpp
CVE: CVE-2020-15305
Component: OpenEXR
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-06-26T00:00:00+00:00

An issue was discovered in OpenEXR before 2.5.2. Invalid input could cause a use-after-free in DeepScanLineInputFile::DeepScanLineInputFile() in IlmImf/ImfDeepScanLineInputFile.cpp.

Statement: The versions of OpenEXR shipped with Red Hat Enterprise Linux 6, 7, and 8 are not affected by this flaw as the affected code was introduced in a newer version of OpenEXR.

Remediation:
Prototype pollution in TSVB could result in arbitrary code execution (ESA-2020-06)
CVE: CVE-2020-7013
Component: kibana
CWE: CWE-94
Severity: Moderate
CVSS v3: 8.2/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-06-03T00:00:00+00:00

Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.

Statement: To mitigate this vulnerability you can set  "metrics.enabled: false" in kibana.yml

Remediation:
For OpenShift Container Platform 4.6 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.
infinite loop in wcsnrtombs function
CVE: CVE-2020-28928
Component: musl
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-11-19T00:00:00+00:00

In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstrated by an invalid write access (buffer overflow).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
SQL injection was found in retrieval of the current username which could result privilege escalation
CVE: CVE-2020-10804
Component: phpMyAdmin
CVSS v3: 8.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-03-20T00:00:00+00:00

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
processing template options inside documents allows unintended read access or embedded Ruby code execution
CVE: CVE-2020-14001
Component: rubygem-kramdown
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-06-27T00:00:00+00:00

A flaw was found in rubygem-kramdown in versions prior to 2.3.0. The template option allows unintended read access or embedded Ruby code execution which is enabled in Kramdown by default. The highest threat from this vulnerability is to data confidentiality and integrity.

Statement: Rubygem-kramdown is not shipped in Red Hat Enterprise Linux 8 and is only used as a buildtime dependency only. Customers are not at risk for exploitation of this flaw.

Remediation: