huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Policy bypass in CSP
CVE: CVE-2020-6519
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-07-14T00:00:00+00:00

Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
incorrectly allows existing files in volumes to be overwritten by a container when it is created
CVE: CVE-2020-1726
Component: podman
CWE: CWE-552
Severity: Low
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2020-02-11T00:00:00+00:00

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.

Statement: Podman versions earlier than 1.6.0 are not affected. That includes the podman versions in OCP 4.2 and earlier.

Remediation:
For OpenShift Container Platform 4.3 see the following documentation, which
will be updated shortly for release 4.3.5, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
If a volume needs to be attached as read-only to an untrusted container or container image, first attach it to a trusted container. Using the volume for the first time will make the attack impossible for other containers that are going to use the volume.
Arbitrary Code Execution vulnerability (APSB20-58)
CVE: CVE-2020-9746
Component: flash-plugin
CWE: CWE-476
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-10-13T00:00:00+00:00

Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vulnerability that could result in a crash and arbitrary code execution. Exploitation of this issue requires an attacker to insert malicious strings in an HTTP response that is by default delivered over TLS/SSL.


Remediation:
potential SQL injection via StringAgg(delimiter)
CVE: CVE-2020-7471
Component: django
CWE: CWE-89
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-02-03T00:00:00+00:00

A flaw was found in Django, where it may allow SQL injection if improperly sanitized data is used as a StringAgg delimiter.  If a suitably crafted delimiter is passed to a 'contrib.postgres.aggregates.StringAgg' instance, it is possible to break escaping and inject malicious SQL. An attacker could use this flaw to cause a denial of service, information disclosure, or privilege escalation.

Statement: Even though the version of python-django as shipped in Red Hat Update Infrastructure contains the vulnerable code, the Product is not vulnerable because the vulnerable function is not used. Red Hat Update Infrastructure is based on pulp 2, which still uses MongoDB as database and not postgresql, where the flaw lies.

Although Red Hat OpenStack Platform 13, 15, & 16 contain the vulnerable code, postgresql is not a supported database hence the lowered impact.

Satellite 6 versions include vulnerable version of python-django however vulnerability is not directly exposed through code since the product does not use 'StringAgg' delimiter implementation. This issue may be get fixed in future updates.

Red Hat Update Infrastructure 3 is in Maintenance Support phase and product only fixing Critical or Important impact flaws. Please refer lifecycle page for more details: https://access.redhat.com/support/policy/updates/rhui

Remediation:
Information disclosure via audit logging with emit_request_body option enabled
CVE: CVE-2020-7021
Component: elasticsearch
CWE: CWE-200
Severity: Low
CVSS v3: 2.3/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-01-01T00:00:00+00:00

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.


Remediation:
Stored XSS vulnerability in console links
CVE: CVE-2020-2223
Component: jenkins
CWE: CWE-79
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-07-15T00:00:00+00:00

A flaw was found in Jenkins versions 2.244 and prior and in LTS 2.235.1 and prior. HREF attribute of links to downstream jobs are not escaped on build console pages which could lead to a stored cross-site scripting (XSS) vulnerability. The user must have the Agent/Configure permission for this exploit to function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
See the following documentation, which will be updated shortly for release
3.11.272, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
For OpenShift Container Platform 4.3 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.4 see the following documentation, which
will be updated shortly for release 4.4.18, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.5 see the following documentation, which
will be updated shortly for release 4.5.7, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.
arbitrary content injection via the options login page
CVE: CVE-2020-12108
Component: mailman
CWE: CWE-79
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2020-05-06T00:00:00+00:00

/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.


Remediation:
bluetooth: BR/EDR Bluetooth Impersonation Attacks (BIAS)
CVE: CVE-2020-10135
Component: kernel
CWE: CWE-290
Severity: Moderate
CVSS v3: 5.3/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2020-05-18T00:00:00+00:00

A flaw was discovered in the Bluetooth protocol affecting the Bluetooth BR/EDR authentication. An attacker with physical access to the Bluetooth connection could perform a spoofing attack impersonating the address of a previously paired remote device. This attack may result in the attacking device completing the authentication procedure successfully despite not possessing the link key. This flaw, in turn, could permit an attacker to initiate the Bluetooth Key Negotiation (KNOB) attack more efficiently, potentially gaining full access as the remote paired device.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Enforce the Secure Connections Only mode for implementations that do not require support for pairing with legacy devices. Disabling Bluetooth may be a suitable alternative for some environments, please refer to the Red Hat knowledgebase solution [1] for how to disable Bluetooth in Red Hat Enterprise Linux.

[1] https://access.redhat.com/solutions/2682931
improper access control in file_download.php
CVE: CVE-2020-25781
Component: mantis
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-09-23T00:00:00+00:00

An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ati-vga: potential crash via invalid x y parameter values
CVE: CVE-2020-27616
Component: QEMU
CWE: CWE-125
Severity: Low
CVSS v3: 2.7/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2020-10-18T00:00:00+00:00

An out-of-bounds access flaw was found in the ati-vga emulator of the QEMU. This flaw occurs when the source and destination x y display parameters in ati_2d_blt() have invalid values. This flaw allows a guest user or process to crash the QEMU process, resulting in a denial of service.


Remediation:
memory leaks in AcquireMagickMemory function
CVE: CVE-2020-27753
Component: ImageMagick
CWE: CWE-401
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a specially crafted input file. These leaks could potentially lead to an impact to application availability or cause a denial of service. It was originally reported that the issues were in `AcquireMagickMemory()` because that is where LeakSanitizer detected the leaks, but the patch resolves issues in the MIFF coder, which incorrectly handles data being passed to `AcquireMagickMemory()`.

Statement: This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regarding support scopes, please see https://access.redhat.com/support/policy/updates/errata .

Remediation:
RCE vulnerability in auth-enabled standalone master
CVE: CVE-2020-9480
Component: apache-spark
CWE: CWE-287
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-06-22T00:00:00+00:00

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).


Remediation:
stack-based buffer overflow in stdscan() in stdscan.c
CVE: CVE-2020-21687
Component: nasm
CWE: CWE-119
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-06T00:00:00+00:00

Buffer Overflow vulnerability in scan function in stdscan.c in nasm 2.15rc0 allows remote attackers to cause a denial of service via crafted asm file.


Remediation:
processing fragmented frames as full frames
CVE: CVE-2020-26142
Component: kernel
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in the Linux kernel, where the WiFi implementations treat fragmented frames as full frames. This flaw allows an attacker to inject arbitrary network packets independent of the network configuration. The highest threat from this vulnerability is to integrity.


Remediation:
Mitigation for this issue is either not available or the currently available options does not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
use-after-free via crafted input file containing a NULL byte can lead to DoS
CVE: CVE-2020-24240
Component: bison
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-07-28T00:00:00+00:00

GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.

Statement: bison as shipped in Red Hat Enterprise Linux 7 and 8 does not reproduce this flaw. It properly detects the NULL byte and errors out accordingly instead of causing use-after-free. This is likely due to introduction of vulnerable code in a more recent version of bison.

Remediation:
media: aspeed: fix clock handling logic
CVE: CVE-2020-36787
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A clock handling logic flaw was found in the Linux kernel, which introduces an improper reset on the Video Engine hardware and may generate unexpected DMA memory transfers that can corrupt the memory region in random and sporadic ways.

Statement: Red Hat Enterprise Linux 8 and 9 are not affected by this vulnerability.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
information disclosure via special URLs
CVE: CVE-2020-17520
Component: apache-pulsar
CWE: CWE-863
Severity: Important
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-12-17T00:00:00+00:00

In the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's admin, permission verification mechanism by constructing special URLs, thereby accessing any HTTP API.


Remediation:
denial of service when handling AES-CTR (or DES) ciphers
CVE: CVE-2020-1730
Component: libssh
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-04-09T09:00:00+00:00

A flaw was found in the way libssh handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing these updated packages, all running applications using libssh must be restarted for this update to take effect.
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
Traffic amplification triggered by random subdomains in the NSDNAME in NS records
CVE: CVE-2020-12667
Component: knot-resolver
CVSS v3: 6.7/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Release date: 2020-05-19T00:00:00+00:00

Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, aka an "NXNSAttack" issue. This is triggered by random subdomains in the NSDNAME in NS records.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: Parser unspecified vulnerability (CPU Jul 2020)
CVE: CVE-2020-14619
Component: mysql
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-07-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
/etc/kubernetes/kubeconfig is given incorrect privileges
CVE: CVE-2020-35514
Component: openshift/machine-config-operator
CWE: CWE-266
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-11-05T00:00:00+00:00

An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShift cluster. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: The kubeconfig file on the node is that of the bootstrap certificate. This means that to successfully exploit this vulnerability, the kubeconfig file must be taken and used within the first 24 hours of creation as it is created with a short expiration time. Otherwise, attempting to use the credentials after this time will result in the following:
`Failed while requesting a signed certificate from the master: cannot create certificate signing request: Unauthorized`

Further, if taken, the certificate signing request (CSR) of the joining rogue OpenShift node is not automatically approved by default. The node still needs to be approved through the use of the commands `oc get csr` and `oc adm certificate approve`.

Remediation:
NULL pointer dereference in find_color_or_error function
CVE: CVE-2020-19752
Component: gifsicle
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
HTTP request smuggling via two copies of a header field in an http request
CVE: CVE-2020-8287
Component: nodejs
CWE: CWE-444
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in nodejs. Affected versions of Node.js allow two copies of a header field in an HTTP request. The first header field is recognized while the second is ignored leading to HTTP request smuggling. The highest threat from this vulnerability is to data confidentiality and integrity.


Remediation:
sending more than 102400 bytes in PAC without a Content-Length present could result in buffer overflow
CVE: CVE-2020-26154
Component: libproxy
CWE: CWE-121
Severity: Moderate
CVSS v3: 7.5/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-07-16T00:00:00+00:00

A vulnerability was found in libproxy, where a buffer overflow can occur if a server serving a PAC file sends more than 102400 bytes without a Content-Length header, this flaw allows an attacker to trigger an overflow of PAC_HTTP_BLOCK_SIZE (512 bytes), potentially leading to application crashes or unexpected behavior when processing large PAC files.

Statement: This vulnerability is rated as moderate because libproxy can overflow its buffer by PAC_HTTP_BLOCK_SIZE (512 bytes) if a server serving a PAC file sends more than 102400 bytes without a Content-Length header, specific conditions related to PAC file handling, and while it could lead to crashes or unexpected behavior, its overall impact is limited.

Remediation:
Use after free in payments
CVE: CVE-2020-16018
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-11-17T00:00:00+00:00

Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.


Remediation:
potential buffer overflows from use of unpackmem()
CVE: CVE-2020-27745
Component: slurm
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-11-14T00:00:00+00:00

Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
weak permissions for /etc/target and backup files
CVE: CVE-2020-13867
Component: targetcli
CWE: CWE-276
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-06-05T00:00:00+00:00

An access flaw was found in targetcli, where the `/etc/target` and underneath backup directory/files were world-readable. This flaw allows a local attacker to access potentially sensitive information such as authentication credentials from the /etc/target/saveconfig.json and backup files. The highest threat from this vulnerability is to confidentiality.

Statement: The version of targetcli shipped with Red Hat Ceph Storage 3 sets the world-readable permissions for `/etc/target` and `/etc/target/backup` directory that store the sensitive information, hence affected by this vulnerability.

Remediation:
$ chmod -R og-rwx /etc/target

Future backup files will still be created with incorrect permissions, but attackers will not be able to access the target directory.