huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Heap buffer overflow in media
CVE: CVE-2020-6452
Component: chromium-browser
CWE: CWE-122
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-03-31T00:00:00+00:00

Heap buffer overflow in media in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
buffer overflow in GetNumSameData() in contrib/lips4/gdevlips.c could result in a DoS
CVE: CVE-2020-17538
Component: ghostscript
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-08-13T00:00:00+00:00

A buffer overflow vulnerability in GetNumSameData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
buffer uses out of index in ext3/4 filesystem
CVE: CVE-2020-14314
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-06-05T16:45:00+00:00

A memory out-of-bounds read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
If any directories of the partition (or image) broken, the command "e2fsck -Df .../partition-name" fixes it.
Information exposure when DH secret are reused across multiple TLS connections
CVE: CVE-2020-12413
Component: nss
CWE: CWE-200
Severity: Low
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-09-09T00:00:00+00:00

A flaw was found in Mozilla nss. A raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman(DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The highest threat from this vulnerability is to data confidentiality.

Statement: NSS as shipped with Red Hat Enterprise Linux 6, 7, and 8 does not re-use Diffie-Hellman Ephemeral (DHE) keys. It reuses Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) keys by default, but Attacking ECDH and ECDHE cipher suites are not in the scope of the Raccoon Attack and generally considered to be unaffected [1]. Further, reuse of ECDHE keys can be disabled starting in nss 3.17 [2].

For these reasons, Red Hat Product Security has marked the Severity of this flaw as Low. Please see [3] for more information about Low Severity ratings.

1. https://raccoon-attack.com/RacoonAttack.pdf pg. 13
2. https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17_release_notes
3. https://access.redhat.com/security/updates/classification

Remediation:
Any risk involving the ECDHE key reuse on the nss server can be mitigated by setting the SSL_REUSE_SERVER_ECDHE_KEY socket option to PR_FALSE.
Code injection through user input to xhr.send
CVE: CVE-2020-28502
Component: nodejs-xmlhttprequest
CWE: CWE-20
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

An arbitrary code injection vulnerability was found in nodejs-xmlhttprequest. For this vulnerability to occur, the connection must be initialized during the function call XMLHttpRequest.open to send requests synchronously using the parameter `async=False`. If the subsequent calls to xhr.send functions are with user-controllable input, this flaw allows an attacker to execute arbitrary code. If the xhr.send function is called on the server on behalf of a user, this allows execution on the Node.js server using the privileges of the Node.js process. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: While the OpenShift ServiceMesh (OSSM) grafana-container source does have a vulnerable version of the nodejs-xmlhttprequest, it does not bundle or use the library in the released product. Therefore, the container has been marked `not affected`.

For the OpenShift Container Platform (OCP), the grafana-container for OCP 4.5 is already using a non-affected version of xmlhttprequest (v1.8.0). Later versions of the container (4.6+) don't include xmlhttprequest.

For Red Hat Advanced Cluster Management for Kubernetes (RHACM), the different components using xmlhttprequest is already using a non-affected version (v1.8.0). Therefore, all supported RHACM versions have been marked `not affected`.

For Red Hat Ceph Storage (RHCS) 3 and 4 the grafana-container is already using a non-affected version of xmlhttprequest (v1.8.0).

Remediation:
Panic in language.ParseAcceptLanguage while parsing -u- extension
CVE: CVE-2020-28851
Component: golang.org/x/text
CWE: CWE-129
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in golang.org. In x/text, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension.

Statement: Below Red Hat products include the affected version of 'golang.org/x/text', however the language package is not being used and hence they are rated as having a security impact of Low. A future update may address this issue.

* Red Hat OpenShift Container Storage 4
* OpenShift ServiceMesh (OSSM)
* Red Hat Gluster Storage 3
* Windows Container Support for Red Hat OpenShift

Only three components in OpenShift Container Platform include the affected package, 'golang.org/x/text/language' , the installer, baremetal installer and thanos container images. All other components that include a version of 'golang.org/x/text' do not include the 'language' package and are therefore not affected.

Remediation:
The OpenShift Service Mesh release notes provide information on the features and known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
For Windows Machine Config Operator upgrades, see the following documentation: https://docs.openshift.com/container-platform/latest/windows_containers/windows-node-upgrades.html
Inappropriate implementation in Blink
CVE: CVE-2020-16000
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-10-20T00:00:00+00:00

Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
segmentation fault issue discovered in StreamSerializer::extractStreams
CVE: CVE-2020-21723
Component: oggvideotools
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A Segmentation Fault issue discovered StreamSerializer::extractStreams function in streamSerializer.cpp in oggvideotools 0.9.1 allows remote attackers to cause a denial of service (crash) via opening of crafted ogg file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
A specially crafted large TCP payload can trigger an assertion failure in tcpdns.c
CVE: CVE-2020-8620
Component: bind
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-08-20T00:00:00+00:00

In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit.

Statement: This version only affects bind-9.16.x. Therefore versions of bind package shipped with Red Hat Enterprise Linux are not affected by this flaw.

Remediation:
xss via HTML messages with malicious svg content
CVE: CVE-2020-16145
Component: roundcubemail
CVSS v3: 5.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2020-08-11T00:00:00+00:00

Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection
CVE: CVE-2020-16846
Component: salt
CWE: CWE-78
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-11-03T00:00:00+00:00

A flaw was found in salt. A shell injection vulnerability was found where an unauthenticated user with network access to the Salt API can use shell injections to run code on the Salt-API using the SSH client. An attacker could use this flaw to cause a denial of service, information disclosure, or privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Red Hat Ceph Storage 2 shipped salt for the usage of Red Hat Storage Console 2 (RHSCON-2), which required salt to administrate ceph nodes. RHSCON-2 has reached End Of Life, hence salt is no longer used and supported. Therefore, the salt package provided by Red Hat Ceph Storage 2 has been marked as 'will not fix'.

Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
usb: hcd-ohci: infinite loop issue while processing transfer descriptors
CVE: CVE-2020-25625
Component: QEMU
CWE: CWE-835
Severity: Low
CVSS v3: 2.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L
Release date: 2020-09-11T00:00:00+00:00

An infinite loop flaw was found in the USB OHCI controller emulator of QEMU. This flaw occurs while servicing OHCI isochronous transfer descriptors (TD) in the ohci_service_iso_td routine, as it retires a TD if it has passed its time frame. It does not check if the TD was already processed and holds an error code in TD_CC. This issue may happen if the TD list has a loop. This flaw allows a guest user or process to consume CPU cycles on the host, resulting in a denial of service.


Remediation:
iconv when processing invalid multi-byte input sequences fails to advance the input state, which could result in an infinite loop
CVE: CVE-2020-27618
Component: glibc
CWE: CWE-835
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-07-09T00:00:00+00:00

A flaw was found in glibc. If an attacker provides the iconv function with invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, IBM1399 encodings, it fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service.

Statement: Red Hat Product Security has rated this flaw as a "Low" severity rating because the affected encodings are uncommon, and an attacker would need to either have local privileges or depend on an application feeding untrusted encoding input to iconv. Low and Moderate severity flaws are out of support scope for glibc as shipped with:

* Red Hat Enterprise Linux 5
* Red Hat Enterprise Linux 6
* Red Hat Enterprise Linux 7

For more detailed information about Red Hat Enterprise Linux support phases, please see [1].

1. https://access.redhat.com/support/policy/updates/errata

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the glibc library must be restarted, or the system rebooted.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Setting a master password post-Thunderbird 52 does not delete unencrypted previously stored passwords
CVE: CVE-2020-6794
Component: Mozilla
CWE: CWE-312
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2020-02-11T00:00:00+00:00

If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird < 68.5.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
Denial of service via mail MIME parsing
CVE: CVE-2020-25275
Component: dovecot
CWE: CWE-20
Severity: Low
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.


Remediation:
A potential mitigation is configuring the mail transfer agent to not accept messages with more than 10,000 MIME parts.
Heap buffer overflow in Skia
CVE: CVE-2020-6540
Component: chromium-browser
CWE: CWE-122
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-07-27T00:00:00+00:00

Buffer overflow in Skia in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams
CVE: CVE-2020-12278
Component: libgit2
CWE: CWE-73
Severity: Low
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.

Statement: Even if the code in the versions of libgit2 as shipped with Red Hat Enterprise Linux 7, and 8 are affected by this flaw, Red Hat does not support the NTFS filesystem. For this reason, the flaw has a Low Impact.

Remediation:
@import statements in CSS could bypass the Content Security Policy nonce feature
CVE: CVE-2020-6813
Component: Mozilla
CWE: CWE-284
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2020-03-10T00:00:00+00:00

When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Content Security Policy. This vulnerability affects Firefox < 74.


Remediation:
child process is able to access parent mm through hfi dev file handle
CVE: CVE-2020-27835
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-11-25T00:00:00+00:00

A flaw use after free in the Linux kernel infiniband hfi1 driver was found in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system.

Statement: This flaw is rated as having a Moderate impact because the issue can only be triggered by an authorized local user with access to a system with specific hardware present.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent the module hfi1 from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to denylist a kernel module to prevent it from loading automatically.
Server: Locking unspecified vulnerability (CPU Jul 2020)
CVE: CVE-2020-14656
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-07-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
incomplete fix for CVE-2020-1747
CVE: CVE-2020-14343
Component: PyYAML
CWE: CWE-20
Severity: Moderate
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-07-22T00:00:00+00:00

A vulnerability was discovered in the PyYAML library, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Statement: This CVE has already been fixed in RHEL-9 with initial release of PyYaml v5.4-1.

Ansible Tower 3.7 uses affected version of PyYAML 3.12 from RHEL, but the use of load() is specified with a SafeLoader when it is called. So Ansible Tower and Ansible Engine are not affected.

Red Hat Quay, from version 3.4 uses the safe_load function which is not affected by this issue. See [1].

Even though the CVSSv3 for this flaw is 9.8, the Impact has been set to Moderate because PyYAML provides a specific method to deal with untrusted input, which is `yaml.safe_load`. `yaml.safe_load` or the SafeLoader loader should be used whenever the input YAML can be modified by a malicious user.

[1] https://github.com/quay/quay/pull/603

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Use `yaml.safe_load` or the SafeLoader loader when you parse untrusted input.
sys.path allowing code to be loaded from arbitrary locations
CVE: CVE-2020-15801
Component: python
CWE: CWE-94
Severity: Important
CVSS v3: 8.4/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-07-15T00:00:00+00:00

In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected.

Statement: This flaw does not affect versions of python shipped with Red Hat Enterprise Linux, Red Hat Software Collections or Red Hat Quay; the vulnerable code exists in a module specific to Microsoft Windows deployment.

Remediation:
integer overflow in exif_data_load_data_thumbnail function in exif-data.c
CVE: CVE-2020-0181
Component: libexif
CWE: CWE-787
Severity: Moderate
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2020-06-01T00:00:00+00:00

In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076


Remediation: