huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
integer overflow in ati_2d_blt() in hw/display/ati-2d.c could lead to DoS
CVE: CVE-2020-11869
Component: qemu
CWE: CWE-787
Severity: Low
CVSS v3: 2.7/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2020-04-07T00:00:00+00:00

An integer overflow flaw was found in QEMU in the way it implemented the ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations through ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.

Statement: This flaw did not affect the following versions of QEMU as they did not include support for ATI VGA emulation:
* `qemu-kvm-ma` as shipped with Red Hat Enterprise Linux 7.
* `qemu-kvm-rhev` as shipped with Red Hat Virtualization and Red Hat OpenStack.
* `qemu-kvm` as shipped with Red Hat Enterprise Linux 6, 7 and 8.

ATI VGA emulation feature was introduced in QEMU upstream version v4.0.0.

Remediation:
Resource exhaustion when proxying HTTP/2 requests or responses with small data frames
CVE: CVE-2020-12603
Component: envoy
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-06-30T19:00:00+00:00

A flaw was found in Envoy in versions through 1.14.1. An excessive amount of memory may be consumed when proxying HTTP/2 requests and responses that contain many small (e.g. 1 byte) data frames. The highest threat from this vulnerability is to system availability.

Statement: A uncontrolled resource consumption vulnerability was found in Envoy. An attacker could craft many HTTP/2 requests (or responses) with very small data frames, to cause the proxy to consume excessive amounts of memory potentially resulting in a denial of service.

Remediation:
The OpenShift Service Mesh release notes provide information on the features and known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html
The OpenShift Service Mesh release notes provide information on the features and
known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html
users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups
CVE: CVE-2020-1754
Component: moodle
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-01-01T00:00:00+00:00

In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups' capability were not restricted to viewing grades of users within their own groups.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
rsync-ssl does not verify the hostname in the server certificate when using openssl
CVE: CVE-2020-14387
Component: rsync
CWE: CWE-297
Severity: Important
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-09-03T18:10:00+00:00

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity.


Remediation:
This vulnerability can be mitigated by not using rsync-ssl in openssl mode.
stack-based buffer overflow in the read_textobject() in read.c
CVE: CVE-2020-21533
Component: transfig
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

In transfig's fig2dev 3.2.7b it is possible for an attacker to create a specially crafted file that causes a buffer overflow due to the usage of fgets. This leads to a denial of service, impacting availability of the program.


Remediation:
allows attackers to execute shell code via EXEC, PREXEC, or unknown_trap_exec
CVE: CVE-2020-24361
Component: snmptt
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-07-23T00:00:00+00:00

SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknown_trap_exec.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
specially crafted input leads to information disclosure and user privilege escalation
CVE: CVE-2020-13696
Component: xawtv
CVSS v3: 5.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2020-09-17T00:00:00+00:00

An issue was discovered in LinuxTV xawtv before 3.107. The function dev_open() in v4l-conf.c does not perform sufficient checks to prevent an unprivileged caller of the program from opening unintended filesystem paths. This allows a local attacker with access to the v4l-conf setuid-root program to test for the existence of arbitrary files and to trigger an open on arbitrary files with mode O_RDWR. To achieve this, relative path components need to be added to the device path, as demonstrated by a v4l-conf -c /dev/../root/.bash_history command.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
out-of-bounds read for certain table pointers in jdhuff.c
CVE: CVE-2020-14153
Component: libjpeg
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Release date: 2020-06-11T00:00:00+00:00

In IJG JPEG (aka libjpeg) from version 8 through 9c, jdhuff.c has an out-of-bounds array read for certain table pointers.

Statement: Red Hat Enterprise Linux 6 and later versions ships libjpeg-turbo which already contains the fixes, thus these products are not affected.

Remediation:
unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS
CVE: CVE-2020-28196
Component: krb5
CWE: CWE-674
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-11-06T00:00:00+00:00

A flaw was found in krb5. MIT Kerberos 5 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, running Kerberos services (krb5kdc, kadmin, and kprop) will be restarted automatically.
unrestricted access to abstract Unix domain socket can lead to privileges escalation
CVE: CVE-2020-15257
Component: containerd
CWE: CWE-269
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-11-30T00:00:00+00:00

A flaw was found in containerd. Access controls for the shim's API socket verified that a connecting process had an effective UID of 0, but otherwise did not restrict access to the abstract Unix domain socket. This could allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: * The container runtime in OpenShift Container Platform 4 is cri-o which is not affected by this flaw. It doesn't make use of abstract unix sockets like containerd, which lead to this vulnerability being possible.

* Red Hat Advanced Cluster Management for Kubernetes is not affected by this flaw.  While containerd is included in the multicloud-operators-subscription image as a dependency of helm, it is not used in any way that exposes the abstract unix socket that is involved in this vulnerability.

* The container-tools module in Red Hat Enterprise Linux is not affected by this flaw as these packages do not use abstract unix sockets for container management.

* For Red Hat OpenStack Platform, because containerd is not actually used in director-operator, the RHOSP Impact has been moved to Low.

Remediation:
OSP 16.2 Release - OSP Director Operator Containers tech preview
Mishandling of proxy_addr field in GSocketClient may lead to proxy being ignored
CVE: CVE-2020-6750
Component: glib
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.8/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Release date: 2020-01-09T00:00:00+00:00

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Statement: As per upstream versions of glib2 before 2.60 are unaffected, therefore glib2 package shipped with Red Hat Products are not affected by this flaw.

Remediation:
outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c
CVE: CVE-2020-27776
Component: ImageMagick
CWE: CWE-190
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned long. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior.

Statement: This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regarding support scopes, please see https://access.redhat.com/support/policy/updates/errata .

Remediation:
HTTP response splitting
CVE: CVE-2020-28483
Component: gin
CWE: CWE-444
Severity: Moderate
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Release date: 2020-01-20T00:00:00+00:00

A flaw was found in gin when exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.

Statement: Red Hat Advanced Cluster Management for Kubernetes (RHACM) 2.0 is affected by this flaw as it uses the gin framework within Hive component for provisioning. However, versions beginning with RHACM 2.1 are not affected as the gin framework is not being used.

Remediation:
Inappropriate implementation in sharing
CVE: CVE-2020-6479
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-05-19T00:00:00+00:00

Inappropriate implementation in sharing in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to spoof security UI via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
allows ../ directory traversal to access private resources
CVE: CVE-2020-25032
Component: python-flask-cors
CWE: CWE-22
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-08-31T00:00:00+00:00

A flaw was found in Flask-CORS (aka CORS Middleware for Flask). This issue allows the ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format. The highest threat from this vulnerability is to confidentiality.

Statement: Red Hat Quay includes Flask-CORS but does not use the vulnerable resource matching functionality. Therefore this issue is rated as low impact for Red Hat Quay.

Remediation:
server-side template injection and arbitrary file disclosure on templating components
CVE: CVE-2020-11994
Component: camel
CWE: CWE-88
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-07-08T00:00:00+00:00

A flaw was found in camel. Camel's templating components are suseptable to Server-Side Template Injection and arbitrary file disclosure.  The highest threat from this vulnerability is to data confidentiality.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are located in the download section of the customer portal.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.8.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.8/
remove other users MFA devices
CVE: CVE-2020-10686
Component: keycloak
CWE: CWE-285
Severity: Moderate
CVSS v3: 4.7/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Release date: 2020-04-29T00:00:00+00:00

A flaw was found in Keycloak version 8.0.2 and 9.0.0, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.


Remediation:
a specially crafted STL file can lead to code execution via out-of-bounds write in import_stl.cc:import_stl()
CVE: CVE-2020-28600
Component: openscad
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

An out-of-bounds write vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Response without Content-Type header  could result in cache poisoning
CVE: CVE-2020-5255
Component: php-symfony
CVSS v3: 2.7/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-03-30T00:00:00+00:00

In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response&#39;s content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
buffer overflow in jetp3852_print_page() in devices/gdev3852.c could result in a privilege escalation
CVE: CVE-2020-16302
Component: ghostscript
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-08-13T00:00:00+00:00

A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted PDF file. This is fixed in v9.51.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
SQL injection in color.php can lead to remote command execution
CVE: CVE-2020-14295
Component: cacti
CVSS v3: 8.2/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-06-17T00:00:00+00:00

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
out of bounds read in PRIMARY_DRAWING_ORDER_FIELD_BYTES
CVE: CVE-2020-11097
Component: freerdp
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Release date: 2020-06-22T00:00:00+00:00

In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.


Remediation:
ppp decapsulator can be convinced to allocate a large amount of memory
CVE: CVE-2020-8037
Component: tcpdump
CWE: CWE-400
Severity: Low
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-04-20T00:00:00+00:00

A flaw was found in tcpdump while printing PPP packets captured in a pcap file or coming from the network. This flaw allows a remote attacker to send specially crafted packets that, when printed, can lead the application to allocate a large amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.


Remediation:
buffer overflow vulnerability in heif_colorconversion.cc may lead to DoS and Information Disclosure
CVE: CVE-2020-23109
Component: libheif
CVSS v3: 6.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denial of service and disclose sensitive information, via a crafted HEIF file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out of bounds access during table rename
CVE: CVE-2020-35527
Component: sqlite
CWE: CWE-119
Severity: Moderate
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-02-23T00:00:00+00:00

An out-of-bounds read vulnerability was found in SQLite. This security flaw occurs when the ALTER TABLE for views has a nested FROM clause. This flaw allows an attacker to triage an out-of-bounds read and access confidential data successfully.


Remediation:
Integer overflow leading to buffer overflow in ImagingLibTiffDecode
CVE: CVE-2020-5310
Component: python-pillow
CWE: CWE-190
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-03T00:00:00+00:00

libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.

Statement: This issue did not affect the versions of python-pillow as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8 as they did not include support for tiled TIFF images, where the flaw lies.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function
CVE: CVE-2020-11078
Component: python-httplib2
CWE: CWE-113
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Release date: 2020-05-20T00:00:00+00:00

A flaw was found in python-httplib2. An attacker controlling an unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping.

Statement: While Red Hat Quay 3.0, and 3.1 used the httplib2 library it was removed in versions 3.2 and later. Upgrade to 3.2 or later to fix this vulnerability in Red Hat Quay.

Red Hat Gluster Storage 3 delivers the affected version of the python-httplib2 library. However the library is not used by Gluster hence the impact by this vulnerability is low.

This issue affects the version of the python-httplib2 library as shipped with Red Hat Ceph Storage (RHCS) version 2. Ceph-2 has reached End of Extended Life Cycle Support and no longer fixing moderates/lows.

There's currently no known vector to exploit this when using Python versions with CVE-2019-9740 and CVE-2019-9947 fixed.

In Red Hat OpenStack Platform13, because the flaw has a lower impact and the package's indirect usage in RHOSP cannot be exploited, no update will be provided at this time for the RHOSP python-httplib2 package.

Remediation:
Enumeration of users via the LDAP auth method
CVE: CVE-2020-35177
Component: vault
CWE: CWE-200
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-12-17T00:00:00+00:00

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.


Remediation:
TLS session reuse can lead to hostname verification bypass
CVE: CVE-2020-8172
Component: nodejs
CWE: CWE-285
Severity: Moderate
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-06-02T00:00:00+00:00

A TLS Hostname verification bypass vulnerability exists in NodeJS. This flaw allows an attacker to bypass TLS Hostname verification when a TLS client reuses HTTPS sessions.

Statement: This issue only affects the TLS 1.2 protocol, not TLS 1.3. This issue does not affect NodeJS 10.

Red Hat Quay installed NodeJS as a dependency of Yarn. It does not use NodeJS at runtime, but executes Javascript on the client's browser instead. Therefore the impact of this vulnerability on Red Hat Quay is low.

Remediation:
allows manipulation of the RMI registry to perform a MITM attack and capture user names and passwords used to access the JMX interface
CVE: CVE-2020-13946
Component: cassandra
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-09-01T00:00:00+00:00

A flaw was found in cassandra in versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2. A local attacker without access to the Apache Cassandra process or configuration files can manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. A JRE vulnerability (CVE-2019-2684) enables this issue to be exploited remotely. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation: