huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Insufficient policy enforcement in Omnibox
CVE: CVE-2020-6497
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-06-03T00:00:00+00:00

Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to perform domain spoofing via a crafted URI.


Remediation:
Null pointer dereference in function H5F_get_nrefs() in H5Fquery.c
CVE: CVE-2020-10812
Component: hdf5
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-03-22T00:00:00+00:00

An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5F_get_nrefs() located in H5Fquery.c. It allows an attacker to cause Denial of Service.

Statement: HDF5 is included as part of a loose dependency trail from python3-hardware package. There is a very low likelihood that an attacker would be able to exploit this vulnerability in a meaningful way in both OpenShift and OpenStack

In OpenShift 4.3, hdf5 is included in the container openshift/ironic-hardware-inventory-recorder-image, the dependency tail is: python3-hardware -> python3-pandas -> python3-tables -> hdf5

Remediation:
improper handling of max_memory_to_use setting can lead to excessive memory consumption
CVE: CVE-2020-14152
Component: libjpeg
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Release date: 2020-06-11T00:00:00+00:00

In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.

Statement: Red Hat Enterprise Linux 6 and further versions ships libjpeg-turbo which already contains the fixes, thus these products are not affected.

Remediation:
Stack-Overflow in `FoFiType1C::cvtGlyph`
CVE: CVE-2020-36023
Component: poppler
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in the Poppler package. This flaw allows attackers to possibly cause a denial of service via a crafted .pdf file to the FoFiType1C::cvtGlyph function.


Remediation:
Prototype pollution could result in DoS or RCE
CVE: CVE-2020-15256
Component: object-path
CWE: CWE-915
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-10-20T00:00:00+00:00

A flaw was found in object-path. A prototype pollution vulnerability has been found in `object-path` affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Red Hat Advanced Cluster Management for Kubernetes 2.1 uses an affected version of object-path, but the vulnerable functionality `includeInheritedProps` and `withInheritedProps` is not present.  A future update will include fixed versions of object-path, which will prevent this vulnerability being introduced.

Remediation:
powerpc: RTAS calls can be used to compromise kernel integrity
CVE: CVE-2020-27777
Component: kernel
CWE: CWE-862
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-10-08T00:00:00+00:00

A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot)  guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.

Statement: This issue is rated as having Moderate impact due to the required privileges and hardware dependencies.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
allows attackers to adversely affect availability of data on a Mimblewimble blockchain
CVE: CVE-2020-12439
Component: grin
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-05-05T00:00:00+00:00

Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
malformed NOOP commands leads to DoS
CVE: CVE-2020-10957
Component: dovecot
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-05-18T00:00:00+00:00

A flaw was found in Dovecot, where it did not properly handle certain malformed NOOP commands. This flaw allows a malicious attacker to cause the submission, submission-login, or lmtp services to crash by sending specially crafted commands.


Remediation:
Cross Site Request Forgery in API notifications
CVE: CVE-2020-14369
Component: CloudForms
CWE: CWE-352
Severity: Moderate
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2020-08-24T15:24:00+00:00

This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
Out of bounds read in audio
CVE: CVE-2020-15981
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-10-06T00:00:00+00:00

Out of bounds read in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
InnoDB unspecified vulnerability (CPU Apr 2020)
CVE: CVE-2020-2895
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-04-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
DoS on client ntpd using server mode packet
CVE: CVE-2020-11868
Component: ntp
CWE: CWE-400
Severity: Low
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-03-03T00:00:00+00:00

A flaw was found in the Network Time Protocol (NTP), where a security issue exists that allows an off-path attacker to prevent the Network Time Protocol daemon (ntpd) from synchronizing with NTP servers not using authentication. A server mode packet with a spoofed source address sent to the client ntpd causes the next transmission to be rescheduled, even if the packet does not have a valid origin timestamp. If the packet is sent to the client frequently enough, it stops polling the server and is unable to synchronize with it.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the ntpd daemon will restart automatically.
Use authentication with symmetric keys.
OOB read in pure_strcmp function in utils.c
CVE: CVE-2020-9365
Component: pure-ftpd
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-02-24T00:00:00+00:00

An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Improper validation of protocol of the returned URL
CVE: CVE-2020-8124
Component: npmjs-url-parse
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2020-02-04T00:00:00+00:00

An input validation flaw exists in the node.js-url-parse, which results in the URL being incorrectly set to the document location protocol instead of the URL being passed as an argument. An attacker could use this flaw to bypass security checks on URLs.


Remediation:
The OpenShift Service Mesh release notes provide information on the features and known issues:

https://docs.openshift.com/container-platform/4.3/service_mesh/servicemesh-release-notes.html
global buffer overflow in the setfigfont() in genepic.c
CVE: CVE-2020-21532
Component: transfig
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

In transfig's fig2dev 3.2.7b it is possible for an attacker to create a specially crafted file that causes a buffer overflow due to accepting an invalid value. This leads to a denial of service, impacting availability of the program.


Remediation:
unsanitized field name in the helper_ensure_confirmed call in manage_custom_field_update.php
CVE: CVE-2020-35571
Component: mantis
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2020-01-01T00:00:00+00:00

An issue was discovered in MantisBT through 2.24.3. In the helper_ensure_confirmed call in manage_custom_field_update.php, the custom field name is not sanitized. This may be problematic depending on CSP settings.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
bleichenbacher timing oracle attack against RSA decryption
CVE: CVE-2020-25658
Component: python-rsa
CWE: CWE-385
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-11-09T00:00:00+00:00

A flaw was found in python-rsa, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The highest threat from this vulnerability is to confidentiality.

Statement: In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-rsa package.

Remediation:
Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.394, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
For OpenShift Container Platform 4.7 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html.
local side channel attack on RSA and static Diffie-Hellman
CVE: CVE-2020-36424
Component: mbedtls
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-09-01T00:00:00+00:00

An issue was discovered in Arm Mbed TLS before 2.24.0. An attacker can recover a private key (for RSA or static Diffie-Hellman) via a side-channel attack against generation of base blinding/unblinding values.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c
CVE: CVE-2020-16092
Component: QEMU
CWE: CWE-617
Severity: Low
CVSS v3: 3.5/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2020-07-27T00:00:00+00:00

An assertion failure flaw was found in QEMU in the network packet processing component. This issue affects the "e1000e" and "vmxnet3" network devices. This flaw allows a malicious guest user or process to abort the QEMU process on the host, resulting in a denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
A heap-based buffer overflow in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp could result in a DOS via a crafted EXR file
CVE: CVE-2020-16587
Component: OpenEXR
CWE: CWE-787
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-12-10T00:00:00+00:00

A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted EXR file.

Statement: This flaw is out of support scope for OpenEXR as shipped with Red Hat Enterprise Linux 6 and 7. For more information on Red Hat Enterprise Linux support scope, please see https://access.redhat.com/support/policy/updates/errata/ .

Remediation:
Heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file
CVE: CVE-2020-14410
Component: SDL2
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2020-01-01T00:00:00+00:00

SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file.

Statement: SDL as shipped in Red Hat Enterprise Linux 6, 7, and 8 is not affected as the vulnerable code exists in SDL2; SDL is already hardened for this flaw.

Remediation:
stack-based buffer overflow in stats/rate_hist.c
CVE: CVE-2020-36131
Component: aom
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-12-24T00:00:00+00:00

A stack buffer overflow flaw was found in AOM. An attacker could create an overflow in the stack buffer in stats/rate_hist.c, resulting in a loss of confidentiality, availability, and integrity.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Insufficient policy enforcement in navigations
CVE: CVE-2020-6439
Component: chromium-browser
Severity: Low
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-04-07T00:00:00+00:00

Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
XSS via crafted input
CVE: CVE-2020-4054
Component: rubygem-rails-html-sanitizer
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2020-06-16T00:00:00+00:00

In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Bypass of Kubernetes API Server proxy TOCTOU
CVE: CVE-2020-8562
Component: kubernetes
CWE: CWE-367
Severity: Low
CVSS v3: 2.7/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-01-01T00:00:00+00:00

A security issue was discovered in Kubernetes where an authorized user may be able to access private networks on the Kubernetes control plane components. Kubernetes clusters are only affected if an untrusted user can create or modify Node objects and proxy to them, or an untrusted user can create or modify StorageClass objects and access KubeControllerManager logs.


Remediation:
Integer overflow in VIDEO channel
CVE: CVE-2020-11038
Component: freerdp
CWE: CWE-190
Severity: Low
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Release date: 2020-04-09T00:00:00+00:00

In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.

Statement: Although this flaw affects versions of freerdp shipped with Red Hat Enterprise Linux 7 and 8, Red Hat Product Security views this flaw as having low impact because it only affects the freerdp client, the user must connect to an untrusted or compromised server, and it would not lead to a persistent denial of service if exploited.

Remediation:
This flaw can be mitigated by deactivating video redirection on the client side and not using /video.
Insufficient data validation in navigation
CVE: CVE-2020-15978
Component: chromium-browser
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-10-06T00:00:00+00:00

Insufficient data validation in navigation in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
out-of-bounds write in fbcon_redraw_softback
CVE: CVE-2020-14390
Component: kernel
CWE: CWE-787
Severity: Low
CVSS v3: 6.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-09-15T00:00:00+00:00

A flaw was found in the Linux kernel. When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.

Statement: Due to this flaw requiring a local user to trigger by using frame buffer fbcon, the impact has been rated as Low.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.