huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
direct memory leaks in AcquireMagickMemory because of an error in CLIListOperatorImages in MagickWand/operation.c for a NULL value
CVE: CVE-2019-13296
Component: ImageMagick
CWE: CWE-400
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2019-07-17T00:00:00+00:00

It was discovered that ImageMagick does not properly release acquired memory when some error conditions occur in the function CLIListOperatorImages() and compare option is used. An attacker could abuse this flaw by providing a specially crafted image and cause a Denial of Service by using all available memory.

Statement: This issue did not affect the versions of ImageMagick as shipped with Red Hat Enterprise Linux 7 as they did not include the vulnerable code.

Remediation:
invalid server certificate accepted in HTTPS-over-IPv6 boot
CVE: CVE-2019-14553
Component: edk2
CWE: CWE-295
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-09-25T00:00:00+00:00

Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access.

Statement: This issue did not affect the versions of edk2/ovmf as shipped with Red Hat Enterprise Linux 7, and 8 as they did not include support for HTTP boot nor TLS. Compile time options HTTP_BOOT_ENABLE and TLS_ENABLE are both disabled in the shipped packages.

Remediation:
XSS vulnerability via user description in Blue Ocean (SECURITY-1204)
CVE: CVE-2019-1003013
Component: jenkins-plugin-blueocean
CWE: CWE-79
Severity: Moderate
CVSS v3: 5.2/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Release date: 2019-01-28T00:00:00+00:00

An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.


Remediation:
Before applying this update, ensure all previously released errata relevant to your system have been applied.

See the following documentation, which will be updated shortly for release 3.11.82, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
Incorrect access control in condor_startd
CVE: CVE-2019-18823
Component: htcondor
Release date: 2019-01-01T00:00:00+00:00

HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control. It is possible to use a different authentication method to submit a job than the administrator has specified. If the administrator has configured the READ or WRITE methods to include CLAIMTOBE, then it is possible to impersonate another user to the condor_schedd. (For example to submit or remove jobs)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
memory leak in journald-server.c introduced by fix for CVE-2018-16864
CVE: CVE-2019-3815
Component: systemd
CWE: CWE-401
Severity: Low
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2019-01-14T00:00:00+00:00

A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash.

Statement: This issue affects version 219-62 of systemd as shipped with Red Hat Enterprise Linux 7.

Remediation:
str.format_map allows sandbox escape
CVE: CVE-2019-10906
Component: python-jinja2
CWE: CWE-138
Severity: Important
CVSS v3: 8.9/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2019-04-06T00:00:00+00:00

A flaw was found in Jinja. Python string formatting could allow an attacker to escape the sandbox. The highest threat from this vulnerability is to data confidentiality and integrity and system availability.

Statement: Red Hat Virtualization Management Appliance includes python-jinja2 as a dependency of ovirt-engine-backend, which only uses it with controlled format strings that are not exploitable.
Red Hat Satellite 6 will receive fixes through the underlying Red Hat Enterprise Linux, so it won't issue updates to its own affected package.

This issue does not affect versions of python-jinja2 as shipped with:
* Red Hat Enterprise Linux 6, and 7 as python2 does not support str.format_map.
* Red Hat Update Infrastructure as it does not use the Sandbox feature, nor does it allow untrusted jinja2 templates.
* Red Hat Ceph Storage 2, 3 and Red Hat Gluster Storage 3 as python2 does not support str.format_map.
* Red Hat OpenStack Platform 13 or 14 as python2 does not support str.format_map.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all applications using Jinja2 must be restarted.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all applications using Jinja2 must be restarted.
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/upgrading_and_updating_red_hat_satellite/updating_satellite_server_capsule_server_and_content_hosts
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all applications using Jinja2 must be restarted.
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
LibreLogo script can be manipulated into executing arbitrary python commands
CVE: CVE-2019-9848
Component: libreoffice
CWE: CWE-20
Severity: Moderate
CVSS v3: 7.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2019-08-05T00:00:00+00:00

LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of LibreOffice applications must be restarted for this update to take effect.
Schema info written with world-writeable permissions when cached
CVE: CVE-2019-11244
Component: kubernetes
CWE: CWE-732
Severity: Low
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2019-04-22T00:00:00+00:00

A flaw was found in kubectl that leaves http-cache files with read/write permissions for any user. In conjunction with a non-default value for --cache-dir, this may lead to the cache content being placed in a location accessible to other users on the system.

Statement: OpenShift Container Platform includes kubectl.  OCP 3.9 and later include this same flaw.

This issue does not affect the version of Kubernetes (embedded in heketi) shipped with Red Hat Gluster Storage 3 as it does not contain the vulnerable functionality.

Remediation:
See the following documentation, which will be updated shortly for release 3.11.161, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html
For OpenShift Container Platform 4.1 see the following documentation, which
will be updated shortly for release 4.1.24, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html
For OpenShift Container Platform 4.1 see the following documentation, which
will be updated shortly for release 4.1.z, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.1/updating/updating-cluster-cli.html.
Do not use --cache-dir, or ensure that --cache-dir is not set to a location that other users have access to.
ctorName in index.js allows external user input to overwrite certain internal attributes
CVE: CVE-2019-20149
Component: nodejs-kind-of
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2019-12-16T00:00:00+00:00

A flaw was found in nodejs-kind-of. An external user is allowed input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Statement: While some components do package a vulnerable version of `kind-of`, access to them requires OpenShift OAuth credentials and hence have been marked with a Low impact. This applies to the following products:
- OpenShift ServiceMesh (OSSM)
- Red Hat Advanced Cluster Management for Kubernetes (RHACM)
- OpenShift distributed tracing
- OpenShift Data Foundation 

In Openshift Container Platform (OCP) 4.6 the openshift4/ose-logging-kibana container delivers a vulnerable version of `kind-of`,  however OCP 4.6 is Out Of Support Scope (OOSS) for Moderate and Low impact vulnerabilities. Since the release of OCP 4.7 this component is now delivered as part of the OpenShift Logging product (openshift-logging/kibana6-rhel8 container). Further, OCP 3.11 has been set to Will not fix, as OCP 3.11 is moving into maintenance phase of support.

In Red Hat Virtualization some components do package a version of `kind-of`, however none use an affected version (later than 6.0.0, prior to 6.0.3)

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html-single/install/index#installing
arbitarary code execution in getStaticValue function
CVE: CVE-2019-15657
Component: npmjs-eslint-utils
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-08-20T00:00:00+00:00

A flaw was found in eslint-utils before version 1.4.1, where the getStaticValue function executed arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
out-of-bounds write in sldns_bget_token_par
CVE: CVE-2019-25035
Component: unbound
CWE: CWE-787
Severity: Moderate
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2019-12-11T00:00:00+00:00

A flaw was found in unbound. An out-of-bounds write in the sldns_bget_token_par function may be abused by a remote attacker. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability.

Statement: There is no available reproducer or proof of concept for this issue, nor it was ever proven the out-of-bounds write can happen in practice. Indeed in the original report this issue was considered one that might not be triggered and for this reason its Impact is Moderate. Upstream has also disputed this CVE.

Remediation:
potentially misleading information about whether sorting in library/glob.html
CVE: CVE-2019-17514
Component: python
Severity: None
CVSS v3: 0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2019-10-12T00:00:00+00:00

library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly.


Remediation:
OOB read in  function GfxPatchMeshShading::parse in GfxState.cc
CVE: CVE-2019-14292
Component: xpdf
CVSS v3: 6.7/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Release date: 2019-07-10T00:00:00+00:00

An issue was discovered in Xpdf 4.01.01. There is an out of bounds read in the function GfxPatchMeshShading::parse at GfxState.cc for typeA!=6 case 1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ECDSA signature timing vulnerabilities in TPM module
CVE: CVE-2019-11090
Component: hw
CWE: CWE-385
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2019-01-01T00:00:00+00:00

Cryptographic timing vulnerabilities were discovered in certain versions of the Trusted Platform Module (TPM) firmware distributed by Intel and STMicroelectronics. Software that uses the TPM to compute ECDSA signatures could leak information through the timing of ECDSA signature operations, allowing an attacker to recover parts of the private key.

Statement: This is a vulnerability in TPM firmware distributed by hardware vendors, not by Red Hat. Red Hat Enterprise Linux exposes the TPM device at /dev/tpm* where it is available for software with the correct privileges to use. Customers are advised to always ensure that firmware updates from hardware vendors are kept up to date with security fixes.

Remediation:
To remediate this vulnerability, install relevant firmware updates from your hardware vendor and follow their advice to regenerate keys that may be vulnerable or compromised. STMicroelectronics, Intel and OEMs have published firmware updates and advice at the links provided in the External References section.
multiple interger overflow in mat.c, mat4.c, mat5.c, mat73.c and matvar_struct.c
CVE: CVE-2019-13107
Component: matio
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2019-06-30T00:00:00+00:00

Multiple integer overflows exist in MATIO before 1.5.16, related to mat.c, mat4.c, mat5.c, mat73.c, and matvar_struct.c

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
HTTP request smuggling in configurations with URL redirect used as error_page
CVE: CVE-2019-20372
Component: nginx
CWE: CWE-444
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2019-01-01T00:00:00+00:00

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

Statement: Ansible Tower 3.5 and 3.6 are not vulnerable by default as are not using error_page variable in the nginx configuration. However, Ansible Tower 3.5 and 3.6 are distributing nginx 1.14 and 1.16 vulnerable versions as a dependency and configuration could be modified making it vulnerable.

Red Hat CloudForms Management Engine 5.9 and 5.10 are not vulnerable by default as are not using error_page variable in the nginx configuration. However, both mentioned builds ships vulnerable nginx versions 1.10 and 1.14 respectively. CloudForms 5.11 does not use nginx directly hence it is not vulnerable.

Red Hat Quay's configuration of nginx means it's not affected by this issue. It doesn't use error_page to do a 302 redirect. It's only use of error_page uses a named location ie:
error_page 404 /404.html;
   location = /40x.html {
 }
error_page 500 502 503 504 /50x.html;
    location = /50x.html {
}

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The rh-nginx116-nginx service must be restarted for this update to take effect.
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
To mitigate this issue, use a named location instead of having the error_page handler do the redirect, this configuration is not vulnerable to request smuggling on all versions of NGINX we tested.
server {
 listen 80;
 server_name localhost;
 error_page 401 @401;
 location / {
 return 401;
 }
 location @401 {
 return 302 http://example.org;
 }
}
integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c
CVE: CVE-2019-17451
Component: binutils
CWE: CWE-190
Severity: Low
CVSS v3: 4.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Release date: 2019-10-07T00:00:00+00:00

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm.


Remediation:
handling of property names in property expressions on the left-hand side of assignment expression leads to execute arbitrary code in sandboxed scripts
CVE: CVE-2019-10394
Component: jenkins-script-security-plugin
CWE: CWE-94
Severity: Important
CVSS v3: 4.3/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2019-09-12T00:00:00+00:00

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the left-hand side of assignment expressions allowed attackers to execute arbitrary code in sandboxed scripts.


Remediation:
See the following documentation, which will be updated shortly for release 3.11.157, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html
For OpenShift Container Platform 4.1 see the following documentation, which will be updated shortly for release 4.1.27, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html

Details on how to access this content are available at https://docs.openshift.com/container-platform/4.1/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.2 see the following documentation, which will be updated shortly for release 4.2.10, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.2/release_notes/ocp-4-2-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.2/updating/updating-cluster-cli.html.
Omnibox spoof
CVE: CVE-2019-13691
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2019-09-10T00:00:00+00:00

Insufficient validation of untrusted input in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
buffer overflow in CalDAV request handling triggered by a long iCalendar property name
CVE: CVE-2019-11356
Component: cyrus-imapd
CWE: CWE-119
Severity: Important
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2019-06-04T00:00:00+00:00

A flaw was found in the CalDAV feature in httpd in Cyrus IMAP. This flaw allows a remote attacker to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.


Remediation: