huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
world-readable OMAPI secret through the ISC DHCP server
CVE: CVE-2020-14335
Component: foreman
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2020-09-07T14:43:00+00:00

A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This flaw allows an attacker to gain control of DHCP records from the network. The highest threat from this vulnerability is to system availability.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
insufficient input validation can lead to OS command injection
CVE: CVE-2020-8178
Component: nodejs-jison-lex
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-05-28T00:00:00+00:00

Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: DML unspecified vulnerability (CPU Jul 2020)
CVE: CVE-2020-14620
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-07-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
out-of-bounds read in opj_t2_encode_packet function in openjp2/t2.c
CVE: CVE-2020-27843
Component: openjpeg
CWE: CWE-125
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-12-02T00:00:00+00:00

A flaw was found in OpenJPEG. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability.


Remediation:
Command injection by calling vulnerable method with untrusted input
CVE: CVE-2020-26301
Component: nodejs-ssh2
CWE: CWE-78
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in nodejs-ssh2. An OS command injection attack on Windows allows an attacker to perform remote code execution and potentially execute arbitrary code. The highest threat from this vulnerability is to confidentiality and integrity.

Statement: This issue affects ssh2 as shipped with all versions of Red Hat Openshift Container Storage and Red Hat Openshift Data Foundations. However, this flaw requires a Windows based attack, and therefore, the impact is adjusted accordingly to a moderate risk.

Remediation:
Heap based buffer overead in in ntfs_dinode_lookup() in fs/ntfs.c
CVE: CVE-2020-10233
Component: sleuthkit
CVSS v3: 2.5/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2020-03-09T00:00:00+00:00

In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
/etc/passwd is given incorrect privileges
CVE: CVE-2020-1709
Component: openshift/mediawiki
CWE: CWE-732
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-21T00:00:00+00:00

An insecure modification vulnerability in the /etc/passwd file was found in the openshift/mediawiki. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

Statement: By default this vulnerability is not exploitable in un-privilieged containers running on OpenShift Container Platform. This is because the system call SETUID and SETGID is blocked by the default seccomp policy.

Remediation:
See the following documentation, which will be updated shortly for release
3.11.188, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
For OpenShift Container Platform 4.1 see the following documentation, which
will be updated shortly for release 4.1.38, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.1/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.2 see the following documentation, which
will be updated shortly for release 4.2.25, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.2/release_notes/ocp-4-2-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.2/updating/updating-cluster-cli.html.
DNS Rebinding in JMX Connector could result in remote command execution
CVE: CVE-2020-11971
Component: camel
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-05-14T00:00:00+00:00

Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.8.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/
The JMX instrumentation agent is the vulnerable component in this, if not being used it can be disabled in the following ways 

* As a Java system property - 
`-Dorg.apache.camel.jmx.disabled=true` as java system property 

* Using the CamelContext method -
```java
CamelContext camel = new DefaultCamelContext();
camel.disableJMX();
```

* If using spring altering the spring configuration -
```xml
<camelContext id="camel" xmlns="http://camel.apache.org/schema/spring">
  <jmxAgent id="agent" disabled="true"/>
    ...
</camelContext>
```
Incorrect security UI in PWAs
CVE: CVE-2020-6536
Component: chromium-browser
Severity: Low
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-07-14T00:00:00+00:00

Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox (URL bar) via a crafted PWA.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Unsafe object creation vulnerability in JSON
CVE: CVE-2020-10663
Component: rubygem-json
CWE: CWE-915
Severity: Moderate
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2020-03-19T00:00:00+00:00

A flaw was found in rubygem-json. While parsing certain JSON documents, the json gem (including the one bundled with Ruby) can be coerced into creating arbitrary objects in the target system. This is the same issue as CVE-2013-0269.

Statement: Red Hat CloudForms 5 uses vulnerable rubygem-json, however, is not vulnerable in Ruby since it does not use version which includes JSON into stdlib.

This issue affects the version of JSON(embedded in pcs) as shipped with Red Hat Gluster Storage 3. However, the vulnerable method calls are currently not used by the product and hence this issue has been rated as having a security impact of Low.

Remediation:
To mitigate this vulnerability, do not supply untrusted user input and/or untrusted strings to the following method calls or utilize code libraries which do so:

```
JSON(user_input)
JSON[user_input, nil]
JSON.parse(user_input, nil)
JSON::Parser.new(user_input).parse
```

Also note that JSON.load() should never be given input from unknown sources.
symbolic link traversal when writing PID file
CVE: CVE-2020-28935
Component: unbound
CWE: CWE-59
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Release date: 2020-09-09T00:00:00+00:00

A symbolic link traversal vulnerability was found in unbound in the way it writes its PID file while starting up. This flaw allows a local attacker with access to the unbound user to set up a link to another file, owned by root, and make unbound overwrite it during its next restart, destroying the original content. The highest threat from this vulnerability is integrity.


Remediation:
If SELinux is enabled in Enforcing mode (the default value in Red Hat Enterprise Linux 8), this kind of attack is prevented as unbound would be blocked from accessing the symbolic link file.
Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests
CVE: CVE-2020-8251
Component: nodejs
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-09-15T00:00:00+00:00

A flaw was found in Node.js 14.x, in versions before 14.11, where it is vulnerable to a denial of service caused by delayed requests. When used as an edge server, this flaw allows an attacker to initiate a large number of HTTP requests, causing resource exhaustion and leaving the service unable to accept new connections. The highest threat from this vulnerability is to system availability.

Statement: NodeJS is included in Red Hat Quay as a dependency of Yarn which is only used while building Red Hat Quay, and not during runtime.

Remediation:
privilege escalation by using XML-RPC to comment on a post
CVE: CVE-2020-28036
Component: wordpress
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-10-29T00:00:00+00:00

wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
race when migrating timers between x86 HVM vCPU-s (XSA-336)
CVE: CVE-2020-25604
Component: xen
CWE: CWE-362
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2020-09-22T12:00:00+00:00

A race condition flaw was found in Xen. When migrating timers of x86 HVM guests between its vCPUs, the locking model that is used allows for a second vCPU of the same guest that is also operating on the timers, to release a lock that was not acquired. The issue leads to the hypervisor hanging or crashing, resulting in a denial of service (DoS). The highest threat from this vulnerability is to system availability.

Statement: Only x86 HVM guests with more than one vCPU can exploit this vulnerability. ARM systems as well as x86 PV and PVH guests are not affected by this flaw.

This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
There is no known mitigation for this flaw apart from applying the patch.
OS command injection possible in CGI implementation
CVE: CVE-2020-24916
Component: yaws
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2020-09-09T00:00:00+00:00

CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
speculation on incompletely validated data on IBM Power9
CVE: CVE-2020-4788
Component: kernel
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-11-20T00:00:00+00:00

A flaw was found in the Linux kernel. IBM Power9 processors can speculatively operate on data stored in the L1 cache before it has been completely validated.  The attack has limited access to memory and is only able to access memory normally permissible to the execution context. The highest threat from this vulnerability is to data confidentiality.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
NULL algorithm parameters entry looks identical to an array of REAL
CVE: CVE-2020-36478
Component: mbedtls
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-09-01T00:00:00+00:00

An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
untrusted accounts are able to crash the server
CVE: CVE-2020-28466
Component: nats-server
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
fdc: null pointer dereference during r/w data transfer
CVE: CVE-2020-25741
Component: QEMU
CWE: CWE-476
Severity: Low
CVSS v3: 2.4/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
Release date: 2020-06-24T00:00:00+00:00

A NULL pointer dereference flaw was found in the Floppy disk emulator of QEMU. This issue occurs while transferring data via the fdctrl_read_data() and fdctrl_write_data() routines if the current drive has a null block pointer. This flaw allows a guest user to crash the QEMU process on the host, resulting in a denial of service.


Remediation:
scp can send duplicate responses to the server upon a utimes system call failure leading to overwrite of arbitrary files
CVE: CVE-2020-12062
Component: openssh
CWE: CWE-20
Severity: Moderate
CVSS v3: 0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2020-05-27T00:00:00+00:00

The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.

Statement: Red Hat does not consider this issue as a security flaw. As per upstream:

"Exploitation of this is not likely as utimes(2) does not fail under normal circumstances. Successful exploitation is not silent - the output of scp(1) would show transfer errors followed by the actualfile(s) that were received"

This CVE has been rejected by MITRE.

Remediation:
Information disclosure from logged proxy environment variables
CVE: CVE-2020-13223
Component: vault
CWE: CWE-200
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-05-21T00:00:00+00:00

A flaw was found in the HashiCorp Vault. The HashiCorp Vault and Vault Enterprise could allow a remote attacker to obtain sensitive information caused by inserting sensitive information into a log file. By accessing the log file, a remote attacker can obtain sensitive information.


Remediation:
Race in ImageBurner
CVE: CVE-2020-16021
Component: chromium-browser
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-11-17T00:00:00+00:00

Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to perform OS-level privilege escalation via a malicious file.


Remediation:
multiple vulnerabiltiies
CVE: CVE-2020-13673
Component: drupal
Release date: 2020-01-01T00:00:00+00:00

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free via crafted web content
CVE: CVE-2020-11793
Component: webkitgtk
CWE: CWE-416
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-04-16T00:00:00+00:00

A use-after-free flaw exists in WebKitGTK. This flaw allows remote attackers to execute arbitrary code or cause a denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

GDM must be restarted for this update to take effect.
potential data leakage via malformed memcached keys
CVE: CVE-2020-13254
Component: django
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-06-03T00:00:00+00:00

A flaw was found in Django, where the memcached backend does not perform key validation and passes malformed keys. This flaw causes a key collision and potential data leakage. The highest threat from this vulnerability is to confidentiality.

Statement: Red Hat Satellite 6 ships affected python-django, however, it does not use memcached implementation in product code hence not vulnerable to this flaw.

Red Hat Update Infrastructure 3 ships an affected version of python-django, however it does not use memcached as a cache backend and it is not vulnerable to this flaw.

Red Hat Ceph Storage(RHCS) ships an affected version of python-django used with calamari and graphite which are no longer supported, hence the django package will not be fixed for RHCS.

Remediation:
Server: Audit Plug-in unspecified vulnerability (CPU Jul 2020)
CVE: CVE-2020-14591
Component: mysql
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-07-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Audit Plug-in). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


Remediation:
non-blocking socket in llcp_sock_connect()
CVE: CVE-2020-25673
Component: kernel
CWE: CWE-400
Severity: None
CVSS v3: 0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Release date: 2020-11-01T00:00:00+00:00

A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak and eventually hanging-up the system.


Remediation:
Insufficient policy enforcement in extensions
CVE: CVE-2020-6392
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-02-04T00:00:00+00:00

Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.