huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
grub 2.05 reintroduced CVE-2020-15705
CVE: CVE-2021-3418
Component: grub2
CWE: CWE-281
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-03-02T18:00:00+00:00

A flaw was found in grub. If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validation. The booted kernel will think it was booted in secureboot mode and will implement lockdown, yet it could have been tampered. This flaw is a reintroduction of CVE-2020-15705 and only affects upstream and distributions using the shim_lock mechanism.

Statement: Red Hat Enterprise Linux 7 and 8 are not affected by this issue, as both versions doesn't ship the shim_lock mechanism.

Remediation:
client certificate not correctly verified when redirect and verifyChain options are used
CVE: CVE-2021-20230
Component: stunnel
CWE: CWE-295
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in stunnel, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.

Statement: This issue did not affect the versions of stunnel as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include support for the "redirect" option.

Remediation:
RCE for scripted UDFs
CVE: CVE-2021-44521
Component: cassandra
CWE: CWE-94
Severity: Moderate
CVSS v3: 7.9/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2021-01-01T00:00:00+00:00

A flaw was found in Cassandra that allows users with certain permissions to execute user-defined functions to create scripts and run remote code execution. This flaw allows an attacker to gain unwanted access and also execute actions against Cassandra.

Statement: While the CVSS is quite high this flaw has been downgraded to moderate impact for three main reasons:
* Administrator privileges are required.
* The configuration required to enable this flaw is non-default.
* Cassandra documentation describes this configuration to be unsafe. This configuration should continue to be considered unsafe even after applying the fix for this CVE.

Remediation:
a head-based overflow may lead to DoS
CVE: CVE-2021-41689
Component: dcmtk
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue
CVE: CVE-2021-39154
Component: xstream
CWE: CWE-502
Severity: Important
CVSS v3: 8.3/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2021-08-22T00:00:00+00:00

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purposes.

OpenShift Container Platform (OCP) delivers the Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, the OCP Jenkins package is not affected by this flaw.
This version of the XStream library will be delivered in future Jenkins releases.

[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc
[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security

Remediation:
For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).
For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).
To install this update, do the following:
 
1. Download the Data Grid 8.3.0 Server patch from the customer portal[²].
2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.
3. Install the Data Grid 8.3.0 Server patch.
4. Restart Data Grid to ensure the changes take effect.

For more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[³]
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
udp: fix race between close() and udp_abort()
CVE: CVE-2021-47248
Component: kernel
CWE: CWE-362
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2021-01-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's UDP implementation, where a race condition exists between the close() and udp_abort() functions. This race can cause a system panic during socket operations, leading to unexpected crashes

Statement: This vulnerability is rated as a moderate severity because this issue results in system crashes under specific conditions and exploitation requires precise timing.

Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Local privilege escalation due to incorrect BPF JIT branch displacement computation
CVE: CVE-2021-29154
Component: kernel
CWE: CWE-119
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-04-08T00:00:00+00:00

A flaw was found in the Linux kernels eBPF implementation. By default, accessing the eBPF verifier is only accessible to privileged users with CAP_SYS_ADMIN.   A local user with the ability to insert eBPF instructions can abuse a flaw in eBPF to corrupt memory. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: This flaw is rated as having Moderate impact as eBPF requires a privileged user on Red Hat Enterprise Linux to correctly load eBPF instructions that can be exploited.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
This issue does not affect most systems by default. An administrator would need to have enabled the BPF JIT to be affected.

It can be disabled immediately with the command:

# echo 0 > /proc/sys/net/core/bpf_jit_enable

Or it can be disabled for all subsequent boots of the system by setting a value in /etc/sysctl.d/44-bpf-jit-disable

## start file ##

net.core.bpf_jit_enable=0

## end file ##
improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI
CVE: CVE-2021-32718
Component: rabbitmq-server
CWE: CWE-79
Severity: Low
CVSS v3: 5.2/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Release date: 2021-05-06T00:00:00+00:00

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.

Statement: Red Hat OpenStack Platform ships a vulnerable version of RabbitMQ but it is not exposed outside the management network. As this network is tightly-regulated to OpenStack administrators, the risk for abuse is significantly reduced.

Remediation:
Incorrect security UI in Page Info
CVE: CVE-2021-21134
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2021-01-19T00:00:00+00:00

Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker to spoof security UI via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
improper error handling allows remote attackers to gain full control over the communication content
CVE: CVE-2021-29504
Component: wp-cli
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2021-06-07T00:00:00+00:00

WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\Utils\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\Utils\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\Utils\http_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
incorrect handling of a special element in ash applet leads to denial of service when processing a crafted shell command
CVE: CVE-2021-42375
Component: busybox
CWE: CWE-20
Severity: Moderate
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-11-09T00:00:00+00:00

A flaw was found in BusyBox, where it did not properly sanitize while processing a special element in ash, leading to a denial of service. The highest threat from this vulnerability is to system availability.


Remediation:
iommu/vt-d: Fix sysfs leak in alloc_iommu()
CVE: CVE-2021-47177
Component: kernel
CWE: CWE-460
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Fix sysfs leak in alloc_iommu()

iommu_device_sysfs_add() is called before, so is has to be cleaned on subsequent
errors.


Remediation:
serial: core: fix transmit-buffer reset and memleak
CVE: CVE-2021-47527
Component: kernel
CWE: CWE-400
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

serial: core: fix transmit-buffer reset and memleak

Commit 761ed4a94582 ("tty: serial_core: convert uart_close to use
tty_port_close") converted serial core to use tty_port_close() but
failed to notice that the transmit buffer still needs to be freed on
final close.

Not freeing the transmit buffer means that the buffer is no longer
cleared on next open so that any ioctl() waiting for the buffer to drain
might wait indefinitely (e.g. on termios changes) or that stale data can
end up being transmitted in case tx is restarted.

Furthermore, the buffer of any port that has been opened would leak on
driver unbind.

Note that the port lock is held when clearing the buffer pointer due to
the ldisc race worked around by commit a5ba1d95e46e ("uart: fix race
between uart_put_char() and uart_shutdown()").

Also note that the tty-port shutdown() callback is not called for
console ports so it is not strictly necessary to free the buffer page
after releasing the lock (cf. d72402145ace ("tty/serial: do not free
trasnmit buffer page under port lock")).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
heap-buffer-overflow on write_header in htmldoc/htmldoc/html.cxx
CVE: CVE-2021-33236
Component: htmldoc
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2021-01-01T00:00:00+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
crash when processing combining chars
CVE: CVE-2021-26937
Component: screen
CWE: CWE-787
Severity: Important
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2021-02-10T00:00:00+00:00

A flaw was found in screen. A specially crafted sequence of combining characters could cause an out of bounds write leading to arbitrary code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
This flaw is in utf8 processing; if your screen configuration does not enable utf8 (through configuration such as "defencoding utf-8" in .screenrc), you are not vulnerable.
executing async search improperly stores HTTP headers leading to information disclosure
CVE: CVE-2021-22132
Component: elasticsearch
CWE: CWE-522
Severity: Moderate
CVSS v3: 4.9/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2021-01-14T00:00:00+00:00

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Improper implementation of block_invalidatepage() allows users to crash the kernel
CVE: CVE-2021-4148
Component: kernel
CWE: CWE-354
Severity: Moderate
CVSS v3: 5.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2021-09-13T00:00:00+00:00

A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem. A missing sanity check may allow a local attacker with user privilege to cause a denial of service (DOS) problem.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
XSS due to insufficient URL sanitization
CVE: CVE-2021-3377
Component: nodejs-ansi_up
CWE: CWE-79
Severity: Moderate
CVSS v3: 4.8/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2021-01-29T00:00:00+00:00

A flaw was found in npm package ansi_up versions < 5.0.0 when parsing untrusted user input. An attacker could take advantage of this by introducing ANSI escape codes to inject arbitrary HTML and JavaScript in result mounting a cross-site scripting (XSS) attack.


Remediation:
mt76: mt7915: fix tx skb dma unmap
CVE: CVE-2021-47032
Component: kernel
CWE: CWE-402
Severity: Low
CVSS v3: 2.9/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mt76: mt7915: fix tx skb dma unmap

The first pointer in the txp needs to be unmapped as well, otherwise it will
leak DMA mapping entries


Remediation:
scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
CVE: CVE-2021-47198
Component: kernel
CWE: CWE-416
Severity: Low
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine

An error is detected with the following report when unloading the driver:
  "KASAN: use-after-free in lpfc_unreg_rpi+0x1b1b"

The NLP_REG_LOGIN_SEND nlp_flag is set in lpfc_reg_fab_ctrl_node(), but the
flag is not cleared upon completion of the login.

This allows a second call to lpfc_unreg_rpi() to proceed with nlp_rpi set
to LPFC_RPI_ALLOW_ERROR.  This results in a use after free access when used
as an rpi_ids array index.

Fix by clearing the NLP_REG_LOGIN_SEND nlp_flag in
lpfc_mbx_cmpl_fc_reg_login().


Remediation:
Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
CVE: CVE-2021-38495
Component: Mozilla
CWE: CWE-120
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-09-07T00:00:00+00:00

Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.1 and Firefox ESR < 91.1.


Remediation:
Resource Injection via a url could result in RCE
CVE: CVE-2021-44537
Component: owncloud-client
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-01-01T00:00:00+00:00

ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free in io_uring feature
CVE: CVE-2021-20226
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-02-04T00:00:00+00:00

A use-after-free flaw was found in the io_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of service problem on the system.  The issue results from the lack of validating the existence of an object prior to performing operations on the object by not incrementing the file reference counter while in use. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.

Statement: The affected code was not introduced into any kernel versions shipped with Red Hat Enterprise Linux making this vulnerable not applicable to these platforms.

Remediation:
vulnerable to a Read Access Violation
CVE: CVE-2021-40827
Component: Clementine
CVSS v3: 6.5/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2021-12-15T00:00:00+00:00

Clementine Music Player through 1.3.1 (when a GLib 2.0.0 DLL is used) is vulnerable to a Read Access Violation on Block Data Move, affecting the MP3 file parsing functionality at memcpy+0x265. The vulnerability is triggered when the user opens a crafted MP3 file or loads a remote stream URL that is mishandled by Clementine. Attackers could exploit this issue to cause a crash (DoS) of the clementine.exe process or achieve arbitrary code execution in the context of the current logged-in Windows user.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap-based buffer overflow in Exiv2::Jp2Image::doWriteMetadata
CVE: CVE-2021-29457
Component: exiv2
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2021-04-18T00:00:00+00:00

There's a flaw in exiv2. An attacker who is able to supply a crafted file to an application linked against exiv2 could trigger an out-of-bounds write in heap memory. The highest risk of this flaw is to application confidentiality, integrity, and availability.


Remediation: