huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body
CVE: CVE-2020-12657
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-05-05T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of the BFQ IO scheduler. This flaw allows a local user able to groom system memory to cause kernel memory corruption and possible privilege escalation by abusing a race condition in the IO scheduler.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
The default io scheduler for Red Hat Enterprise Linux 8 is the mq-deadline scheduler, however it can be 
configured to any of the available schedulers available on the system on a per-device basis.

The schedulers in use can be verified by the block devices entry in sysfs, for example for "sda":

# cat /sys/block/sda/queue/scheduler 
[mq-deadline] kyber bfq none

All block devices in the system will need to be changed to be mitigated.  If the system workload requires
bfq, this may not be an acceptable workaround however some systems may find changing io schedulers to be an
acceptable workaround until system updates can be applied.

See https://access.redhat.com/solutions/3756041 for how to configure the io scheduler persistently across
system reboots or contact Red Hat Global Support Services.
Insufficient policy enforcement in developer tools
CVE: CVE-2020-6495
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-06-03T00:00:00+00:00

Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
receiving IRC message 005 with longer nick prefixes could result in buffer overflow and crash
CVE: CVE-2020-9760
Component: weechat
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-02-20T00:00:00+00:00

An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). When a new IRC message 005 is received with longer nick prefixes, a buffer overflow and possibly a crash can happen when a new mode is set for a nick.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap-based buffer overflow in TIFF2PDF tool
CVE: CVE-2020-35524
Component: libtiff
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-12-14T00:00:00+00:00

A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications linked against libtiff must be restarted for this update to take effect.
CVE: CVE-2020-8521
Component: CVE-2020-8521
Release date: 2020-01-01T00:00:00+00:00

SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
out-of-bounds read in ImagingFliDecode when loading FLI images
CVE: CVE-2020-5313
Component: python-pillow
CWE: CWE-125
Severity: Moderate
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Release date: 2020-01-03T00:00:00+00:00

An out-of-bounds read was discovered in python-pillow in the way it decodes FLI images. An application that uses python-pillow to load untrusted images may be vulnerable to this flaw, which can allow an attacker to read the memory of the application they should be not allowed to read.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
buffer overflow in okiibm_print_page1() in devices/gdevokii.c could result in a DoS
CVE: CVE-2020-16301
Component: ghostscript
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-08-13T00:00:00+00:00

A buffer overflow vulnerability in okiibm_print_page1() in devices/gdevokii.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Server-Side Request Forgery (SSRF) in Ansible Tower Provider
CVE: CVE-2020-14296
Component: CloudForms
CWE: CWE-918
Severity: Moderate
CVSS v3: 7.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Release date: 2020-08-03T13:30:00+00:00

A Server-Side Request Forgery flaw was found in Red Hat CloudForms where malicious requests can be sent from the vulnerable server. An attacker with the privileges to add Ansible Tower provider could inject URLs with port details or with internal IPs to observe internal network.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
avoid cyclic entity chains due to malformed USB descriptors
CVE: CVE-2020-0404
Component: kernel
CWE: CWE-284
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw linked list corruption in the Linux kernel for USB Video Class driver functionality was found in the way user connects web camera to the USB port. A local user could use this flaw to crash the system.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent the module uvcvideo from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.
ati-vga: infinite recursion in ati_mm_read/write calls may lead to DoS
CVE: CVE-2020-13800
Component: QEMU
CWE: CWE-835
Severity: Low
CVSS v3: 2.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L
Release date: 2020-06-03T00:00:00+00:00

An infinite recursion flaw was found in the ati-vga emulator of the QEMU. The issue occurs in ati_mm_read/write routines while accessing VGA registers, for certain values of the 'mm_index' variable. This flaw allows a guest user or process to crash the QEMU process, resulting in a denial of service.


Remediation:
specially crafted HTTP request may cause an authentication bypass
CVE: CVE-2020-17510
Component: shiro
CWE: CWE-290
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-11-05T00:00:00+00:00

A flaw was found in Apache shiro. When using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. This highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Whilst the OpenDaylight version that is included in Red Hat OpenStack Platform includes the affected code, the vulnerable function is not used and therefore not exploitable.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.9.0 product
documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.9/
modules which use files encrypted with vault are not properly cleaned up
CVE: CVE-2020-10685
Component: Ansible
CWE: CWE-459
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-03-18T00:00:00+00:00

A flaw was found on Ansible Engine when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules.  The temporary directory is created in /tmp leaves the secrets unencrypted.

On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decrypted data remains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted is sensible.

Statement: * Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.

* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.

* In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.

Remediation:
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
Currently, there is no mitigation for this issue except by removing manually the temporary created file after every run.
inconsistent history access restriction may lead to IP adress disclosure
CVE: CVE-2020-11997
Component: guacamole-server
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-01-01T00:00:00+00:00

Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the same connection, those users may be able to see which other users have accessed that connection, as well as the IP addresses from which that connection was accessed, even if those users do not otherwise have permission to see other users.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
virt-handler daemonset clusterroles allows retrieval of secrets
CVE: CVE-2020-1701
Component: virt-handler
CWE: CWE-732
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-01-07T00:00:00+00:00

A flaw was found in the KubeVirt main virt-handler regarding the access permissions of virt-handler.  An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
This issue can only be resolved by applying updates.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
MMIO ops null pointer dereference may lead to DoS
CVE: CVE-2020-15469
Component: QEMU
CWE: CWE-476
Severity: Low
CVSS v3: 2.9/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-06-17T00:00:00+00:00

A NULL pointer dereference flaw was found in various system emulators of QEMU that occurs while performing MMIO r/w operations when the respective handler function is not defined. This flaw allows a privileged guest user to invoke the MMIO operation to crash the QEMU process on the host, resulting in a denial of service.

Statement: In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP qemu-kvm-rhev package.

Remediation:
gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation lacks certain domain_release calls, leading to a memory leak.
CVE: CVE-2020-12656
Component: kernel
CWE: CWE-401
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-05-05T00:00:00+00:00

A flaw was found in the implementation of the Linux kernel’s GSS mechanism registration functionality. During this period, memory allocation was not freed when the module was unloaded, leading to a memory leak. This flaw allows an attacker with the ability to repeat loads and unloads, to cause the system to run out of free memory and crash eventually.

Statement: This issue is rated as having Low impact because of the preconditions needed to trigger the issue (privileges requried to mount/unmount a module). The issue is also being disputed with MITRE (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12656) as being a non-issue because of the privileges required.

Remediation:
There is no mitigation to this flaw other than to prevent the loading of the affected kernel module. 

A user with permission to load a kernel module would also likely have permission to overcome any blacklisting on the system.
insecure temporary file
CVE: CVE-2020-11979
Component: ant
CWE: CWE-377
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2020-10-01T00:00:00+00:00

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Statement: ant as shipped in Red Hat Enterprise Linux 8 is not affected by this flaw because this flaw is caused by the patch for CVE-2020-1945, however, it was never applied to ant as shipped in Red Hat Enterprise Linux 8, because the decision was made by Engineering to WONTFIX that flaw.

In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of ant package.
Since the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.
This may be fixed in the future.

[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated

Remediation:
Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.394, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
For OpenShift Container Platform 4.5 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.6 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.
Incorrect security UI in payments
CVE: CVE-2020-6494
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-06-03T00:00:00+00:00

Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Null pointer derreference in src/select.c
CVE: CVE-2020-35525
Component: sqlite
CWE: CWE-476
Severity: Low
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-02-20T00:00:00+00:00

A NULL pointer dereference flaw was found in select.c of SQLite. An out-of-memory error occurs while an early out on the INTERSECT query is processing. This flaw allows an attacker to execute a potential NULL pointer dereference.

Statement: This flaw is rated as low because this flaw type of vulnerability is believed to require unlikely circumstances to be able to be exploited, or where a successful exploit would give minimal consequences. Also, this flaw is present in a program’s source code but to which no current or theoretically possible, but unproven, exploitation vectors exist or were found during the technical analysis of the flaw.

Remediation:
CVE: CVE-2020-8520
Component: CVE-2020-8520
Release date: 2020-01-01T00:00:00+00:00

SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
out of bound write when writing 0 bytes to PSI files which could result in local privilege escalation
CVE: CVE-2020-0110
Component: kernel
CWE: CWE-787
Severity: Low
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-05-07T00:00:00+00:00

A flaw was found in the Pressure stall information subsystem. This flaw allows a local attacker with the ability to write to root-owned files to corrupt kernel stack memory.


Remediation:
As the attacker must have the ability to write to these files, a possible mitigation would be to reduce the access that users and their processes would have to the files used in the attack.  The files within the /proc/ filesystem can be temporarily modified with the chmod/chown command for each boot.
improperly restricted operations on memory buffer in libImaging/PcxDecode.c
CVE: CVE-2020-5312
Component: python-pillow
CWE: CWE-119
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-03T00:00:00+00:00

A flaw was discovered in python-pillow does where it does not properly restrict operations within the bounds of a memory buffer when decoding PCX images. An application that uses python-pillow to decode untrusted images may be vulnerable to this flaw, which can allow an attacker to crash the application or potentially execute code on the system.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
out-of-bounds read because __gc handler frame traversal is mishandled
CVE: CVE-2020-15890
Component: luajit
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-07-11T00:00:00+00:00

A flaw was found in luajit. An out-of-bounds read can occur due to a frame traversal being mishandled.

Statement: OpenShift ServiceMesh proxy does package a vulnerable version of luajit. The segmentation fault is triggered via creating a inline code rule in the envoy filter, however envoy can also be caused to exit via a code rule which is also not syntactically correct either. A user who has permissions to change the filter rule can have the same affect regardless, hence this issue will not be addressed at this time and might be fixed in a future release.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
ide: atapi: OOB access while processing read commands
CVE: CVE-2020-29443
Component: QEMU
CWE: CWE-125
Severity: Moderate
CVSS v3: 3.4/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L
Release date: 2020-11-18T00:00:00+00:00

An out-of-bounds read-access flaw was found in the ATAPI Emulator of QEMU. This issue occurs while processing the ATAPI read command if the logical block address(LBA) is set to an invalid value. A guest user may use this flaw to crash the QEMU process on the host resulting in a denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2974891
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258