huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
XSS when pasting attacker-controlled data into a contenteditable element
CVE: CVE-2020-15676
Component: Mozilla
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2020-09-22T00:00:00+00:00

The Mozilla Foundation Security Advisory describes this flaw as:

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
SFD_GetFontMetaData() insufficient CVE-2020-5395 backport
CVE: CVE-2020-25690
Component: fontforge
CWE: CWE-119
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-01-21T00:00:00+00:00

An out-of-bounds write flaw was found in FontForge while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: The impact of this flaw is set to Moderate since upstream does not consider a network-facing application that accepts untrusted font files as a reasonable use of fontforge tool/library, making the impact of a possible exploitation of this flaw smaller.

Remediation:
SQL Injection in the API's search function
CVE: CVE-2020-15226
Component: glpi
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-10-07T00:00:00+00:00

In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or database user. The most likely scenario for this vulnerability is with someone who has an API account to the system. The issue is patched in version 9.5.2. A proof-of-concept with technical details is available in the linked advisory.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CRLF injection via HTTP request method in httplib/http.client
CVE: CVE-2020-26116
Component: python
CWE: CWE-113
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2020-02-10T00:00:00+00:00

A flaw was found in Python. The built-in modules httplib and http.client (included in Python 2 and Python 3, respectively) do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrity.

Statement: Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Remediation:
InnoDB unspecified vulnerability (CPU Apr 2020)
CVE: CVE-2020-2762
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-04-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Server: Parser unspecified vulnerability (CPU Jan 2020)
CVE: CVE-2020-2627
Component: mysql
Severity: Moderate
CVSS v3: 6.7/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
CVE: CVE-2020-1908
Component: CVE-2020-1908
Release date: 2020-01-01T00:00:00+00:00

Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
InnoDB unspecified vulnerability (CPU Oct 2020)
CVE: CVE-2020-14821
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-10-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Integer overflow in UnicodeString::doAppend()
CVE: CVE-2020-10531
Component: ICU
CWE: CWE-190
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-02-25T00:00:00+00:00

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
out-of-bounds write access in vcf_parse_format()
CVE: CVE-2020-36403
Component: htslib
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
a heap-based buffer overflow in ReadMNGImage in coders/png.c
CVE: CVE-2020-12672
Component: graphicsmagick
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-05-05T00:00:00+00:00

GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Sandbox escape with improperly guarded Access Tokens
CVE: CVE-2020-12388
Component: Mozilla
CWE: CWE-284
Severity: Critical
CVSS v3: 10/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2020-05-05T00:00:00+00:00

The Mozilla Foundation Security Advisory describes this flaw as:

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape.

Statement: This issue only affects Firefox on Windows operating systems.  Firefox on Linux is not affected.

Remediation:
buffer overflow
CVE: CVE-2020-20703
Component: vim
CWE: CWE-787
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A use-after-free flaw was found in Vim. This issue allows a heap buffer overflow leading to a write access violation. This flaw allows the attacker to possibly have control over the write address and value, which may lead to an application crash.

Statement: Red Hat Product Security has rated this issue as having a Low security impact, because the "victim" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.

For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/

Remediation:
Untrusted vim scripts with -s [scriptin] are not recommended to run.
improper usage of parsed claims for authorization leads to improper resource access
CVE: CVE-2020-1725
Component: keycloak-gatekeeper
CWE: CWE-863
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in keycloak-gatekeeper. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token. The highest threat from this vulnerability is to data confidentiality and integrity.


Remediation:
sandbox protection bypass through default parameter expressions in CPS-transformed methods
CVE: CVE-2020-2109
Component: jenkins-pipeline-groovy-plugin
CWE: CWE-20
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-02-12T00:00:00+00:00

Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.


Remediation:
See the following documentation, which will be updated shortly for release
3.11.232, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
For OpenShift Container Platform 4.3 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.4 see the following documentation, which
will be updated shortly for release 4.4.10, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
audit not logging access to syscall open_by_handle_at for users with CAP_DAC_READ_SEARCH capability
CVE: CVE-2020-35501
Component: kernel
CWE: CWE-863
Severity: Low
CVSS v3: 4.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem


Remediation:
This syscall can still be audited by using the 'syscall auditing feature' by passing open_by_handle_at to it in the rule.  Existing auditing ruleset requirements generally use this mechanism.
multiple vulnerabilities
CVE: CVE-2020-8154
Component: nextcloud
Release date: 2020-03-18T00:00:00+00:00

An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CSRF (in graphQL requests)
CVE: CVE-2020-14319
Component: amq-on
CWE: CWE-352
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
Release date: 2020-07-29T00:00:00+00:00

A flaw was found in the AMQ Online console, where it is vulnerable to a Cross-Site Request Forgery attack (CSRF), which is exploitable in cases where preflight checks are not instigated or bypassed. This flaw allows an attacker to target authorized users using an older browser with Adobe Flash. The highest threat from this vulnerability is to integrity and system availability.


Remediation:
The Red Hat OpenShift Container Platform 3.11 and 4.4/4.5 container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available from https://access.redhat.com.

Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.

Before applying this update, make sure all previously released errata relevant to your system have been applied.
In-band key negotiation issue in AWS S3 Crypto SDK for golang
CVE: CVE-2020-8912
Component: aws-sdk-go
CWE: CWE-327
Severity: Low
CVSS v3: 2.6/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-08-11T00:00:00+00:00

A flaw was found in the AWS S3 Crypto SDK where algorithm parameters for the data encryption key are not authenticated. This flaw allows attackers with S3 bucket write access to change the negotiated encryption algorithm, potentially providing viable brute force methods to recover plaintext. This is not an issue in V2 of the API or for applications not encrypting files in S3 buckets. The highest threat from this vulnerability is to confidentiality.

Statement: The following products include components that use the AWS SDK (aws/aws-sdk-go), however they do not include code that encrypts or decrypts files in S3 buckets (aws/aws-sdk-go/service/s3/s3crypto). The below products are not affected by this flaw:
* Red Hat Cluster Application Migration
* Red Hat OpenShift Container Platform
* Red Hat OpenShift ServiceMesh
* Red Hat OpenShift Container Storage
* Red Hat Ceph Storage
* Red Hat Gluster Storage

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_3scale_api_management/2.11/html-single/installing_3scale/index
integer casting vulnerability in update_recv_secondary_order
CVE: CVE-2020-4032
Component: freerdp
CWE: CWE-681
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2020-06-22T00:00:00+00:00

In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /relax-order-checks are affected. This is fixed in version 2.1.2.

Statement: This flaw does not affect versions of freerdp as shipped with any version of Red Hat Enterprise Linux as the vulnerable code was introduced in a newer version of freerdp.

Remediation:
Do not run the freerdp client with the +glyph-cache and /relax-order-checks options.
A global buffer overflow in the put_font in genpict2e.c could result in a denial of service
CVE: CVE-2020-21684
Component: transfig
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A global buffer overflow in the put_font in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting a xfig file into pict2e format.


Remediation:
not verifying TKIP MIC of fragmented frames
CVE: CVE-2020-26141
Component: kernel
CWE: CWE-354
Severity: Moderate
CVSS v3: 6.4/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2020-01-01T00:00:00+00:00

A vulnerability was found in Linux kernel's WiFi implementation.  An attacker within wireless range can inject a control packet fragment where the kernel does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames.


Remediation:
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options does not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
use of unserialize function for the attachments value in compose.php
CVE: CVE-2020-14933
Component: squirrelmail
CWE: CWE-676
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2020-06-20T00:00:00+00:00

An unsafe deserialization vulnerability was found in SquirrelMail. This flaw allows an authenticated user to craft malicious form data when submitting mail.


Remediation: