huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Xenstore: guests can crash xenstored via watchs (XSA-324)
CVE: CVE-2020-29484
Component: xen
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-12-15T12:00:00+00:00

An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watch will receive a Xenstore message containing the path of the modified Xenstore entry that triggered the watch, and the tag that was specified when registering the watch. Any communication with xenstored is done via Xenstore messages, consisting of a message header and the payload. The payload length is limited to 4096 bytes. Any request to xenstored resulting in a response with a payload longer than 4096 bytes will result in an error. When registering a watch, the payload length limit applies to the combined length of the watched path and the specified tag. Because watches for a specific path are also triggered for all nodes below that path, the payload of a watch event message can be longer than the payload needed to register the watch. A malicious guest that registers a watch using a very large tag (i.e., with a registration operation payload length close to the 4096 byte limit) can cause the generation of watch events with a payload length larger than 4096 bytes, by writing to Xenstore entries below the watched path. This will result in an error condition in xenstored. This error can result in a NULL pointer dereference, leading to a crash of xenstored. A malicious guest administrator can cause xenstored to crash, leading to a denial of service. Following a xenstored crash, domains may continue to run, but management operations will be impossible. Only C xenstored is affected, oxenstored is not affected.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
REST APIs vulnerable to clickjacking
CVE: CVE-2020-2105
Component: jenkins
CWE: CWE-227
Severity: Low
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2020-01-29T00:00:00+00:00

REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.


Remediation:
Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.170, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
Before applying this update, ensure all previously released errata relevant
to your system have been applied.

For OpenShift Container Platform 4.3 see the following documentation, which
will be updated shortly for release 4.3.5, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
arbitrary content injection via the private archive login page
CVE: CVE-2020-15011
Component: mailman
CWE: CWE-79
Severity: Moderate
CVSS v3: 4.6/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2020-05-07T00:00:00+00:00

GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.


Remediation:
Server: Compiling unspecified vulnerability (CPU Apr 2020)
CVE: CVE-2020-2806
Component: mysql
Severity: Moderate
CVSS v3: 5.4/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-04-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling). Supported versions that are affected are 5.7.28 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).


Remediation:
SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader
CVE: CVE-2020-1729
Component: SmallRye
CWE: CWE-863
Severity: Low
CVSS v3: 4.2/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-02-13T00:00:00+00:00

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality.


Remediation:
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details about how to apply this update, which includes the changes described in this advisory, see:

https://access.redhat.com/articles/11258
Before applying this update, ensure all previously released errata relevant to your system have been applied.

For details about how to apply this update, see:

https://access.redhat.com/articles/11258
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258
Before applying this update, ensure all previously released errata relevant to your system have been applied.

For details about how to apply this update, see:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details about how to apply this update, see:

https://access.redhat.com/articles/11258
Before applying this update, ensure all previously released errata relevant to your system have been applied.

For details about how to apply this update, see:

https://access.redhat.com/articles/11258
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must log in to download the update).

The JBoss server process must be restarted for the update to take effect.
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must log in to download the update).

The JBoss server process must be restarted for the update to take effect.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
Policy bypass in CORS
CVE: CVE-2020-6516
Component: chromium-browser
Severity: Important
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2020-07-14T00:00:00+00:00

Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Null pointer deference in URL parsing
CVE: CVE-2020-25018
Component: envoyproxy/envoy
CWE: CWE-476
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-09-29T19:00:00+00:00

A flaw was found in envoy. An attacker can craft an HTTP request, which uses an Internationalized Domain Name (IDN) as the host component, resulting in an attempt to convert the host name (from Unicode to ASCII) potentially causing a segfault. The highest threat from this vulnerability is to system availability.


Remediation:
Credentials endpoint policy logic allows changing credential owner and target project ID
CVE: CVE-2020-12691
Component: openstack-keystone
CWE: CWE-863
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-05-06T15:00:00+00:00

A vulnerability was found in Keystone's EC2 credentials API. This flaw allows any authenticated user to create an EC2 credential for themselves for a project that they have a specified role, and then perform an update to the credential user and project, allowing them to masquerade as another user. This issue potentially allows the malicious user to act as the admin on a project another user has the admin role on, granting the user global admin privileges.

Statement: Red Hat Quay includes keystone-client, which is not vulnerable to this (server-side) vulnerability.

Remediation:
Inappropriate implementation in V8
CVE: CVE-2020-6453
Component: chromium-browser
CWE: CWE-358
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-03-31T00:00:00+00:00

Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
oauth tokens not encrypted when enabling encryption of data at rest
CVE: CVE-2020-10706
Component: openshift/openshift-apiserver
CWE: CWE-312
Severity: Moderate
CVSS v3: 6.3/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-04-30T00:00:00+00:00

A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via the WebUI or via the command line in the last 24 hours. Once the backup is older than 24 hours the OAuth tokens are no longer valid.

Statement: This issue only affects OpenShift Container Platform when the 'encryption at rest' feature enabled, see https://access.redhat.com/documentation/en-us/openshift_container_platform/4.3/html/authentication/encrypting-etcd. When backing up the encrypted data the keys should be stored separately to the data, making backups the most likely target of this attack.

Remediation:
For OpenShift Container Platform 4.6 see the following documentation, which
will be updated shortly for release 4.6.1, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html
If you have made a vulnerable backup public you can revoke leaked OAuth tokens by deleting them with the OpenShift API.
Heap-based buffer overflow in bfd_getl_signed_32() in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section() in elf.c
CVE: CVE-2020-35448
Component: binutils
CWE: CWE-119
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2020-09-04T00:00:00+00:00

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.


Remediation:
handling external inputs allows attacker to bypass sanity checks
CVE: CVE-2020-14315
Component: bsdiff
CVSS v3: 5.9/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2020-07-10T00:00:00+00:00

A flaw was found in bsdiff. Memory corruption is possible due to insufficient checks when handling external inputs allowing an attacker to bypass the sanity checks in place and write out of a dynamically allocated buffer boundaries. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
GTlsClientConnection silently ignores unset server identity
CVE: CVE-2020-13645
Component: glib-networking
CWE: CWE-297
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2020-05-04T00:00:00+00:00

In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host.


Remediation:
Use after free in site isolation
CVE: CVE-2020-16017
Component: chromium-browser
CWE: CWE-416
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-11-11T00:00:00+00:00

Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
there's a memory leak allowing remote attackers to cause a DoS
CVE: CVE-2020-10593
Component: tor
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-03-23T00:00:00+00:00

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH
CVE: CVE-2020-14929
Component: alpine
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-06-18T00:00:00+00:00

Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use-after-free in rmmod command
CVE: CVE-2020-25632
Component: grub2
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in grub2. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
A logic issue may lead to cross site scripting
CVE: CVE-2020-9925
Component: webkitgtk
CWE: CWE-79
Severity: Moderate
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Release date: 2020-07-29T00:00:00+00:00

A logic issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing maliciously crafted web content may lead to universal cross site scripting.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

GDM must be restarted for this update to take effect.
Inappropriate implementation in interstitials
CVE: CVE-2020-6500
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-02-04T00:00:00+00:00

Inappropriate implementation in interstitials in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
heap buffer overflow in iscsi_aio_ioctl_cb() in block/iscsi.c may lead to information disclosure
CVE: CVE-2020-11947
Component: QEMU
CWE: CWE-122
Severity: Low
CVSS v3: 3.5/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Release date: 2020-04-20T00:00:00+00:00

A heap buffer overflow flaw was found in the iSCSI support of QEMU. This flaw could lead to an out-of-bounds read access and possible information disclosure from the QEMU process memory to a malicious guest. The highest threat from this vulnerability is to data confidentiality.

Statement: This flaw has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 7. Red Hat Enterprise Linux 7 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
ath9k: information disclosure via specifically timed and handcrafted traffic
CVE: CVE-2020-3702
Component: kernel
CWE: CWE-319
Severity: Moderate
CVSS v3: 6.4/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-08-05T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of wireless drivers using the Atheros chipsets.  An attacker within wireless range could send crafted traffic leading to information disclosure.


Remediation:
Mitigation for this issue is either not available or the currently available options does not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Arbitrary local file access with 'Copy as cURL'
CVE: CVE-2020-12392
Component: Mozilla
CWE: CWE-552
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2020-05-05T00:00:00+00:00

The Mozilla Foundation Security Advisory describes this flaw as:

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
double free in update_read_cache_bitmap_v3_order function
CVE: CVE-2020-11044
Component: freerdp
CWE: CWE-672
Severity: Low
CVSS v3: 2.7/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-03-31T00:00:00+00:00

In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.


Remediation:
Empty UDP packet DoS in Samba AD DC nbtd
CVE: CVE-2020-14303
Component: samba
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-07-02T00:00:00+00:00

A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash.

Statement: This flaw does not affect the version of samba shipped with Red Hat Enterprise Linux and Red Hat Gluster Storage 3 because there is no support for samba as Active Directory Domain Controller.

Remediation:
The NetBIOS over TCP/IP name resolution protocol is implemented as a UDP datagram on port 137.

The AD DC client and server-side processing code for NBT name resolution will enter a tight loop if a UDP packet with 0 data length is received.  The client for this case is only found in the AD DC side of the codebase, not that used by the the member server or file server.