huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
SessionListener can prevent a session from being invalidated breaking logout
CVE: CVE-2021-34428
Component: jetty
CWE: CWE-613
Severity: Low
CVSS v3: 3.4/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2021-06-22T00:00:00+00:00

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being invalidated and a shared-computer application being left logged in. The highest threat from this vulnerability is to data confidentiality and integrity.

Statement: In OpenShift Container Platform (OCP), the hive/presto/hadoop components that comprise the OCP metering stack, ship the vulnerable version of jetty. Since the release of OCP 4.6, the metering product has been deprecated [1], hence the affected components are marked as wontfix. This may be fixed in the future.

OCP 3.11 is out of the support scope for Moderate and Low impact vulnerabilities because is already in the Maintenance Support phase, hence the affected OCP 3.11 component has been marked as wontifx.

[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated

Remediation:
For OpenShift Container Platform 4.9 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.9/updating/updating-cluster-cli.html
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.10.0 product
documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Applications should catch all Throwables within their SessionListener#sessionDestroyed() implementations.
Multiple Vulnerabilities
CVE: CVE-2021-438450
Component: pjsip
Release date: 2021-12-15T00:00:00+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out of bounds read in WebAudio
CVE: CVE-2021-37992
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2021-10-19T00:00:00+00:00

Out of bounds read in WebAudio in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Stored cross-site scripting via plugin metadata
CVE: CVE-2021-3486
Component: glpi
CVSS v3: 8.5/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Release date: 2021-04-06T00:00:00+00:00

GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Incomplete JupyterHub logout with simultaneous JupyterLab sessions
CVE: CVE-2021-41247
Component: juptyerhub
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2021-11-04T00:00:00+00:00

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
privilege escalation when AuthorizedKeysCommand or AuthorizedPrincipalsCommand are configured
CVE: CVE-2021-41617
Component: openssh
CWE: CWE-273
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-09-26T00:00:00+00:00

A flaw was found in OpenSSH. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. Depending on system configuration, inherited groups may allow AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to gain unintended privileges, potentially leading to local privilege escalation.

Statement: Neither the `AuthorizedKeysCommand` directive nor `AuthorizedPrincipalsCommand` are enabled by default in the versions of OpenSSH as shipped with Red Hat Enterprise Linux 7 and 8.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Undefined-shift in Imf_2_5::hufDecode
CVE: CVE-2021-20304
Component: OpenEXR
CWE: CWE-190
Severity: Low
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-02-15T00:00:00+00:00

A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability.


Remediation:
can: vxcan: vxcan_xmit: fix use after free bug
CVE: CVE-2021-47669
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: vxcan: vxcan_xmit: fix use after free bug

After calling netif_rx_ni(skb), dereferencing skb is unsafe.
Especially, the canfd_frame cfd which aliases skb memory is accessed
after the netif_rx_ni().


Remediation:
Use after free in Fonts
CVE: CVE-2021-21145
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-02-02T00:00:00+00:00

Use after free in Fonts in Google Chrome prior to 88.0.4324.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
CVE: CVE-2021-47393
Component: kernel
CWE: CWE-754
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's hwmon subsystem, specifically in the mlxreg-fan driver. The issue arises when the driver’s sysfs interface for controlling fan speed does not properly handle cases where the requested minimum fan speed exceeds the maximum allowable value. When the value provided is out of bounds, it results in a non-zero return code that prevents updates to thermal statistics, which can lead to a slab-out-of-bounds error, potentially causing system instability or crashes due to improper access to memory.

Statement: This vulnerability is rated as a moderate severity because it can disrupt system operation by causing crashes or unpredictable behaviour under specific conditions.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
net: usb: fix possible use-after-free in smsc75xx_bind
CVE: CVE-2021-47239
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: usb: fix possible use-after-free in smsc75xx_bind

The commit 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind")
fails to clean up the work scheduled in smsc75xx_reset->
smsc75xx_set_multicast, which leads to use-after-free if the work is
scheduled to start after the deallocation. In addition, this patch
also removes a dangling pointer - dev->data[0].

This patch calls cancel_work_sync to cancel the scheduled work and set
the dangling pointer to NULL.


Remediation:
Use after free in WebRTC
CVE: CVE-2021-30611
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2021-08-31T00:00:00+00:00

Chromium: CVE-2021-30611 Use after free in WebRTC

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: Optimizer unspecified vulnerability (CPU Apr 2021)
CVE: CVE-2021-2278
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-04-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
can: mcp251x: fix resume from sleep before interface was brought up
CVE: CVE-2021-46994
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: mcp251x: fix resume from sleep before interface was brought up

Since 8ce8c0abcba3 the driver queues work via priv->restart_work when
resuming after suspend, even when the interface was not previously
enabled. This causes a null dereference error as the workqueue is only
allocated and initialized in mcp251x_open().

To fix this we move the workqueue init to mcp251x_can_probe() as there
is no reason to do it later and repeat it whenever mcp251x_open() is
called.

[mkl: fix error handling in mcp251x_stop()]


Remediation:
Regular expression denial of service when the application is provided and checks a crafted invalid HWB string
CVE: CVE-2021-29060
Component: nodejs-color-string
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2021-06-21T00:00:00+00:00

A Regular Expression Denial of Service (ReDOS) vulnerability was found in Color-String, which occurs when the application is provided and checks a crafted invalid HWB string. The highest threat from this vulnerability is to system availability.

Statement: OpenShift Service Mesh 1.1.x is in its maintenance phase, only Important and Critical vulnerabilities will be fixed at this time.

In OpenShift Container Platform (OCP) and OpenShift Service Mesh (OSSM) some components include the vulnerable color-string library, but access is protected by OpenShift OAuth what reducing impact by this flaw to LOW.
Starting in OCP 4.7, the kibana component is shipping as "container first" content and as a part of the OpenShift Logging product (openshift-logging/kibana6-rhel8) and is not affected by this vulnerability. The kibana components delivered in OCP 4.6 and earlier are marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.

In Red Hat Advanced Cluster Management for Kubernetes (RHACM) all containers are using the 1.5.5 fixed version, hence not RHACM version is affected by this flaw.

In Red Hat Virtualization a vulnerable version of color-string is used in ovirt-web-ui and ovirt-engine-ui-extensions. It is a build-time dependency not exploitable in the delivered product. Therefore impact is rated Low and it will not be immediately fixed. An update may be provided in future releases.

Remediation:
XSS via HTML attributes
CVE: CVE-2021-35043
Component: AntiSamy
CWE: CWE-79
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-07-19T00:00:00+00:00

A flaw was found in AnitSamy, where it allows a Cross-site Scripting attack (XSS) via HTML attributes when using the HTML output serializer (XHTML is not affected). This issue was demonstrated by a javascript: URL with : as the replacement for the : character. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: Marking Red Hat JBoss Fuse 6 as having a low impact. Although AntiSamy is present in the offline repository, it is not used.

This vulnerability is out of security support scope for the following products:

 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Remediation:
open redirect in oidc_validate_redirect_url()
CVE: CVE-2021-32786
Component: mod_auth_openidc
CWE: CWE-601
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2021-07-22T00:00:00+00:00

A flaw was found in mod_auth_openidc where it does not sanitize redirection URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.


Remediation:
buffer overflow in CDataMoji of the jwwlib component allows remote code execution via a crafted JWW document
CVE: CVE-2021-45341
Component: librecad
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-12-18T00:00:00+00:00

A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
QXL: integer overflow in cursor_alloc() can lead to heap buffer overflow
CVE: CVE-2021-4206
Component: QEMU
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

Statement: Releases of Red Hat OpenStack Platform 15 and newer consume fixes directly from the Red Hat Enterprise Linux 8 Advanced Virtualization repository. A future update may address this issue in Red Hat Enterprise Linux 8 and RHEL 8 Advanced Virtualization. The versions of `qemu-kvm` as shipped with Red Hat Enterprise Linux 9 are not affected by this flaw as they do not include support for QXL display device emulation.

Remediation:
Impersonation vulnerability in Foreman
CVE: CVE-2021-3469
Component: Foreman
CWE: CWE-863
Severity: Low
CVSS v3: 4.3/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Release date: 2021-03-26T00:00:00+00:00

Foreman is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.

Statement: Red Hat Satellite is not affected by the flaw as the product required the Puppet CA as the primary trusted CA which does not allow to sign certificate requests that have subject alternative names by default.

Remediation:
To mitigate the flaw, users are advised to set `allow-authorization-extensions` to the `false` in `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration file.
Division by zero in WriteJP2Image() in coders/jp2.c
CVE: CVE-2021-20241
Component: ImageMagick
CWE: CWE-369
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2021-02-01T00:00:00+00:00

A flaw was found in ImageMagick in coders/jp2.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

Statement: This flaw is out of support scope for Red Hat Enterprise Linux 6 and 7. To learn more about Red Hat Enterprise Linux support scope, please see https://access.redhat.com/support/policy/updates/errata/ .

Remediation:
Regression of CVE-2017-12613 fix in apr 1.7
CVE: CVE-2021-35940
Component: apr
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2021-08-23T00:00:00+00:00

An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue.


Remediation:
Use-after-free in WebCore::GraphicsContext leading to information leak and possibly code execution
CVE: CVE-2021-21779
Component: webkitgtk
CWE: CWE-416
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-07-28T00:00:00+00:00

A use-after-free vulnerability exists in the way Webkit’s GraphicsContext handles certain events in WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

GDM must be restarted for this update to take effect. The GNOME session must be restarted (log out, then log back in) for this update to take effect.
mtd: require write permissions for locking and badblock ioctls
CVE: CVE-2021-47055
Component: kernel
Severity: Moderate
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in the Linux Kernel, requiring write permissions for locking and badblock ioctls, as they modify protection bits.

Statement: Red Hat Enterprise Linux 9 is not affected by this vulnerability.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.