huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
cache attack against RSA key import in SGX
CVE: CVE-2020-10941
Component: mbedtls
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-02-20T00:00:00+00:00

Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
remote clients may cause Varnish to assert and restart which could result in DoS
CVE: CVE-2020-11653
Component: varnish
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-02-04T00:00:00+00:00

An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.


Remediation:
An user can mitigate the problem by setting the proxy protocol to version 1 on the TLS Proxy side, as this flaw only affects the proxy protocol version 2.
outside the range of representable values of type 'unsigned long' at coders/palm.c
CVE: CVE-2020-27761
Component: ImageMagick
CWE: CWE-190
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2020-01-01T00:00:00+00:00

WritePALMImage() in /coders/palm.c used size_t casts in several areas of a calculation which could lead to values outside the range of representable type `unsigned long` undefined behavior when a crafted input file was processed by ImageMagick. The patch casts to `ssize_t` instead to avoid this issue.

Statement: This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regarding support scopes, please see https://access.redhat.com/support/policy/updates/errata.

Red Hat Product Security marked the Severity as Low because although it could potentially lead to an impact to application availability, no specific impact was shown in this case.

Remediation:
regression in JWT signature validation
CVE: CVE-2020-15240
Component: rubygem-omniauth
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-10-20T00:00:00+00:00

omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all of the following conditions apply: 1. You are using `omniauth-auth0`. 2. You are using `JWTValidator.verify` method directly OR you are not authenticating using the SDK’s default Authorization Code Flow. The issue is patched in version 2.4.1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
dram: circumvent TRR to induce bit flips via Rowhammer
CVE: CVE-2020-10255
Component: hw
CWE: CWE-440
Severity: Important
CVSS v3: 6.4/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H
Release date: 2020-03-10T15:00:00+00:00

A Rowhammer flaw was found in latest DDR4 DRAM hardware chips. These chips implement Target Row Refresh (TRR) mitigation to prevent a Rowhammer flaw-induced bit corruption across memory space. An unprivileged system user may leverage this flaw and use Rowhammer attack variants to induce bit corruptions across memory space, potentially resulting in a denial of service or privileges escalation scenarios. The highest threat from this vulnerability is to system availability.

Statement: This hardware issue cannot be fixed via usual software updates. For additional information, please refer to the Red Hat Knowledgebase article:  https://access.redhat.com/articles/1377393.

Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
heap-based buffer overflow in jbig2_image_compose in jbig2_image.c
CVE: CVE-2020-12268
Component: jbig2dec
CWE: CWE-122
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-01-27T00:00:00+00:00

An integer overflow was found in jbig2dec, which causes an out-of-bounds read/write in the jbig2_image_compose function. This flaw could potentially result in the execution of code on the system. Applications that use jbig2dec with untrusted input may be vulnerable to this flaw. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
Use after free in IndexedDB
CVE: CVE-2020-6550
Component: chromium-browser
CWE: CWE-416
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-08-10T00:00:00+00:00

Use after free in IndexedDB in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
sending malformed XML signatures could result in a crash
CVE: CVE-2020-7711
Component: goxmldsig
CWE: CWE-476
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-08-14T00:00:00+00:00

This affects all versions of package github.com/russellhaering/goxmldsig. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.

Statement: Whilst the OpenShift Container Platform (OCP) and OpenShift Service Mesh (OSSM) grafana container does include goxmldsig, it is only included as part of the SAML implementation. SAML is only available in the enterprise version of Grafana (https://grafana.com/docs/grafana/latest/auth/saml/). Hence the openshift4/ose-grafana and servicemesh-grafana containers have been marked as wont-fix and may be addressed in a future update.

Remediation:
open redirection allowed via login page
CVE: CVE-2020-6803
Component: mozilla-iot-gateway
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2020-02-26T00:00:00+00:00

An open redirect is present on the gateway's login page, which could cause a user to be redirected to a malicious site after logging in.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free in the ftrace ring buffer resizing logic due to a race condition
CVE: CVE-2020-27825
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-10-06T01:00:00+00:00

A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel. There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user  privilege to a kernel information leak threat.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use
CVE: CVE-2020-15954
Component: kmail
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-06-24T00:00:00+00:00

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
frontends can trigger OOM in backends by update a watched path (XSA-349)
CVE: CVE-2020-29568
Component: xen
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-12-15T12:00:00+00:00

An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
HTTP Request Splitting could result in cache poisoning
CVE: CVE-2020-15811
Component: squid
CWE: CWE-444
Severity: Important
CVSS v3: 9.3/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Release date: 2020-08-23T00:00:00+00:00

A flaw was found in squid. Due to incorrect data validation, an HTTP Request Splitting attack against HTTP and HTTPS traffic is possible leading to cache poisoning. The highest threat from this vulnerability is to data confidentiality and integrity.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the squid service will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the squid service will be restarted automatically.
Disable the relaxed HTTP parser in `squid.conf`:

```
relaxed_header_parser off
```
DTLS client hello contains a random value of all zeroes
CVE: CVE-2020-11501
Component: gnutls
CWE: CWE-327
Severity: Moderate
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-03-27T00:00:00+00:00

A cryptographic weakness was found in the way DLTS implementation of GnuTLS, used zeros in place of random numbers. This flaw can break the security guarantee of the DTLS protocol.

Statement: The earliest affected version is gnuTLS-3.6.3. Therefore versions of gnuTLS shipped with Red Hat Enterprise Linux 5, 6 and 7 are not affected by this flaw.

Remediation:
a buffer overflow via the "invertImage()" may lead to DoS
CVE: CVE-2020-19131
Component: libtiff
CWE: CWE-119
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

The libtiff package is susceptible to a heap/buffer overflow via the "invertImage()" which may lead to a DoS. 
The highest threat from this vulnerability is to system availability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications linked against libtiff must be restarted for this update to take effect.
keys: for keyctl prevent creating a different user's keyrings in RHEL-6.10
CVE: CVE-2020-14353
Component: kernel
Severity: None
CVSS v3: 0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2020-01-01T00:00:00+00:00

[REJECTED CVE] A keys creation with an incorrect permissions flaw was found in the Linux kernel’s keyctl subsystem. This flaw allows a local user to create user session keyrings for another user. The highest threat from this vulnerability is to integrity.

Statement: This flaw was found to be a duplicate of CVE-2017-18270. Please see https://access.redhat.com/security/cve/CVE-2017-18270 for information about affected products and security errata.

Remediation:
DoS in wal/wal.go
CVE: CVE-2020-15112
Component: etcd
CWE: CWE-400
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-08-06T00:00:00+00:00

A flaw was found in etcd, where it is possible to have an entry index greater than the number of entries in the ReadAll method in wal/wal.go. This can cause issues when WAL entries are being read during consensus, as an arbitrary etcd consensus participant can go down from a runtime panic when reading the entry. The highest threat from this vulnerability is to system availability.

Statement: In Red Hat OpenShift Container Platform (RHOCP), the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable etcd to authenticated users only, therefore the impact of this vulnerability is Low.
A similar access restriction is in place in Red Hat OpenStack Platform (RHOSP) as etcd is limited to use within the internal API network, which is not accessible to any OpenStack tenants.

Remediation:
For OpenShift Container Platform 4.8 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-cli.html
Assertion failure in slapd in the saslAuthzTo validation
CVE: CVE-2020-36222
Component: openldap
CWE: CWE-617
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.

Statement: This flaw does not affect openldap as shipped with Red Hat Enterprise Linux 8 because the slapd server is not shipped. While Red Hat Enterprise Linux 7 does ship the slapd server, this flaw is out of support scope for Red Hat Enterprise Linux 7 and earlier. For more information on support scope, see https://access.redhat.com/support/policy/updates/errata/ .

Remediation:
Inappropriate implementation in JavaScript
CVE: CVE-2020-6415
Component: chromium-browser
Severity: Low
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-02-04T00:00:00+00:00

Inappropriate implementation in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Red Hat only CVE-2020-12352 regression
CVE: CVE-2020-25662
Component: kernel
CWE: CWE-665
Severity: Moderate
CVSS v3: 5.2/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-11-03T00:00:00+00:00

A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initialization of stack memory when handling certain AMP packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the system by sending specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality.

Statement: This issue only affects the Linux kernel version as shipped with the Red Hat Enterprise Linux 8.3 GA release, kernel-4.18.0-240.el8 (and any kernel derived from this release such as kernel rt-4.18.0-240.rt7.54.el8). Red Hat was unable to include the fix for the original CVE-2020-12352 issue in the GA release, as the Red Hat Enterprise Linux 8.3 GA release was in its final stages of release preparation when CVE-2020-12352 was made public. All of the subsequent Red Hat Enterprise Linux 8 kernel versions, including the version included in the so-called 0day (released on the same day or very close to that day) erratum, contain the fix, thus immune to the original CVE-2020-12352 issue.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate these vulnerabilities on the operating system level, disable the Bluetooth functionality via blocklisting kernel modules in the Linux kernel. The kernel modules can be prevented from being loaded by using system-wide modprobe rules. Instructions on how to disable Bluetooth modules are available on the Customer Portal at https://access.redhat.com/solutions/2682931.

Alternatively, Bluetooth can be disabled within the hardware or at BIOS level which will also provide an effective mitigation as the kernel will not be able to detect that Bluetooth hardware is present on the system.
Type confusion in V8
CVE: CVE-2020-6383
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-02-18T00:00:00+00:00

Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Memory safety bugs fixed in Firefox 82
CVE: CVE-2020-15684
Component: Mozilla
CWE: CWE-120
Severity: Important
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-10-20T00:00:00+00:00

Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 82.


Remediation:
Use of freed hash key in the phar_parse_zipfile function
CVE: CVE-2020-7068
Component: php
CWE: CWE-416
Severity: Low
CVSS v3: 3.7/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
Release date: 2020-08-06T00:00:00+00:00

In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
Server: Pluggable Auth unspecified vulnerability (CPU Apr 2020)
CVE: CVE-2020-2790
Component: mysql
Severity: Moderate
CVSS v3: 6.7/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-04-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 5.7.28 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


Remediation:
Certain modules do not always validated SSL certificates
CVE: CVE-2020-35662
Component: salt
CWE: CWE-295
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in Salt where several places did not verify the SSL cert by default. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Salt has been deprecated as of Red Hat Ceph Storage 2.5, as Salt was used to install RHSCON-2 and RHSCON-2 has reached End Of Life.

Remediation:
Directory Traversal with spring-cloud-config-server
CVE: CVE-2020-5405
Component: spring-cloud-config-server
CWE: CWE-22
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2020-02-26T00:00:00+00:00

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.


Remediation:
CVE: CVE-2020-1915
Component: CVE-2020-1915
Release date: 2020-01-01T00:00:00+00:00

An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Prototype pollution via `__proto__` assignment could result in DoS
CVE: CVE-2020-8237
Component: nodejs-json-bigint
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-08-26T00:00:00+00:00

A flaw was found in nodejs-json-bigint.  A Prototype pollution in json-bigint npm may lead to a denial-of-service (DoS) attack.

Statement: In Red Hat Openshift Container Storage 4 the noobaa-core container includes the affected version of json-bigint as a dependency of googleapis, however the json-bigint library is not being used and hence this issue has been rated as having a security impact of Low.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Heap buffer overflow in postprocess_terminfo function in tinfo/parse_entry.c:997
CVE: CVE-2020-19189
Component: ncurses
CWE: CWE-122
Severity: Low
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw has been identified in the ncurses library. This issue occurs when processing a crafted terminfo database, causing a heap-based buffer overflow, resulting in an application crash.

Statement: Red Hat Product Security has rated this issue as having a Low security impact because processing terminfo descriptions in the source form should be handled the same way as executable files or source code of any programming language. Users are not supposed to use untrusted terminfo descriptions.

The ncurses library shipped with Red Hat Enterprise Linux 9 is not affected by this vulnerability because it has a newer, fixed ncurses version.

Remediation:
Do not compile or decompile untrusted terminfo descriptions.