huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Crafted input tar file may lead to local file overwrite during image build process
CVE: CVE-2020-10696
Component: buildah
CWE: CWE-22
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-03-26T00:00:00+00:00

A path traversal flaw was found in Buildah. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

Statement: While OpenShift Container Platform does include the vulnerable buildah code, it doesn't make use of the vulnerable function. Podman is also included in OpenShift Container Platform, but it isn't used to perform a build, so it has been given a low impact rating.

OpenShift Container Platform 3.11 now used podman from the RHEL Extra repository, and not the podman package shipped in the OpenShift 3.11 RPM repository. This issue is fixed in podman in RHEL Extras so we won't fix the podman package shipped in the OpenShift 3.11 RPM repository.

Remediation:
For OpenShift Container Platform 4.1 see the following documentation, which
will be updated shortly for release 4.1.41, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.1/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.2 see the following documentation, which
will be updated shortly for release 4.2.28, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.2/release_notes/ocp-4-2-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.2/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.3 see the following documentation, which
will be updated shortly for release 4.3.12, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
mod_proxy_uwsgi buffer overflow
CVE: CVE-2020-11984
Component: httpd
CWE: CWE-400
Severity: Moderate
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-08-07T00:00:00+00:00

A flaw was found in Apache httpd in versions 2.4.32 to 2.4.46. The uwsgi protocol does not serialize more than 16K of HTTP header leading to resource exhaustion and denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: Red Hat Enterprise Linux 5, 6, and 7 do not ship the vulnerable version of httpd and, thus, are not affected.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
This flaw only affects specific httpd configurations which use the uwsgi protocol. It does not manifest itself when uwsgi protocol  is not used. Commenting out "LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so" in /etc/httpd/conf.modules.d/00-proxy.conf will disable the loading of the vulnerable module.
Insufficient policy enforcement in developer tools
CVE: CVE-2020-6469
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-05-19T00:00:00+00:00

Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
out-of-bounds read in ntlm_read_AuthenticateMessage
CVE: CVE-2020-11087
Component: freerdp
CWE: CWE-125
Severity: Low
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Release date: 2020-05-29T00:00:00+00:00

In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage. This has been fixed in 2.1.0.


Remediation:
Server: DDL unspecified vulnerability (CPU Jan 2020)
CVE: CVE-2020-2580
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-14T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
circumvention of file size limits in ActiveStorage
CVE: CVE-2020-8162
Component: rubygem-activestorage
CWE: CWE-20
Severity: Important
CVSS v3: 0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2020-05-18T00:00:00+00:00

A flaw was found in rubygem-activestorage. The ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user. The highest threat from this vulnerability is to data integrity.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
specially crafted KV entry could be used to perform a XSS attack
CVE: CVE-2020-25864
Component: consul
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2020-01-01T00:00:00+00:00

In consul  a specially crafted KV (key/value store) entry could be used by attacker to perform a XSS (Cross Site Scripting) attack when viewed in the raw mode.

Statement: OpenShift Container Platform (OCP) and OpenShift Service Mesh (OSSM) components ship only consul api which could be used for connection to consul service mesh solution, therefore are not affected by this flaw.

Some OpenShift Virtualization components reference consul in go.sum files, however none of the projects or container images depend on or ship consul, therefore are not affected by this flaw.

Remediation:
Server: PS unspecified vulnerability (CPU Oct 2020)
CVE: CVE-2020-14790
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-10-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Insufficient policy enforcement in navigations
CVE: CVE-2020-6486
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-05-19T00:00:00+00:00

Insufficient policy enforcement in navigations in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
uncontrolled recursion via an infinite stream response leading to stack exhaustion
CVE: CVE-2020-25219
Component: libproxy
CWE: CWE-674
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-09-09T00:00:00+00:00

A flaw was found in libproxy in versions 0.4 through 0.4.15. A remote HTTP server can trigger an uncontrolled recursion via a response composed of an infinite stream that lacks a newline character leading to a stack exhaustion. The highest threat from this vulnerability is to system availability.

Statement: Red Hat has determined this flaw to be of moderate impact as the attack triggers an uncontrolled recursion beyond the attacker's control and results in a DoS, which can cause service disruptions but does not directly enable privilege escalation or arbitrary code execution.

Remediation:
mishandling shell metacharacters during use of the --output may lead to command injection
CVE: CVE-2020-17368
Component: firejail
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Release date: 2020-08-11T00:00:00+00:00

Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
missing password strength checks on some forms
CVE: CVE-2020-7940
Component: plone
CWE: CWE-522
Severity: Low
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2020-01-23T00:00:00+00:00

Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.


Remediation:
Single-word search queries were also broadcast to local network
CVE: CVE-2020-26966
Component: Mozilla
CWE: CWE-200
Severity: Low
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-11-17T00:00:00+00:00

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.


Remediation:
x86 PV guest INVLPG-like flushes may leave stale TLB entries (XSA-286)
CVE: CVE-2020-27674
Component: xen
CWE: CWE-772
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2020-10-20T00:00:00+00:00

A flaw was found in the Xen hypercalls with INVLPG-like behavior used by x86 PV guests to invalidate TLB entries. This flaw allows a malicious unprivileged guest user to escalate their privileges to the kernel level within the guest.

Statement: This flaw has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in  the Extended Life Phase of the support and maintenance life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
There is no known mitigation for this flaw apart from applying the patch.
Fail kernel validation without shim protocol
CVE: CVE-2020-15705
Component: grub2
CWE: CWE-440
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-07-29T17:00:00+00:00

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258
heap-based buffer overflow in bfd_getl32() in bfd/libbfd.c
CVE: CVE-2020-19726
Component: binutils
Severity: Moderate
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

A heap-based buffer overflow was found in binutils in the bfd_getl32() function, relating to the auxiliary symbol data. This flaw allows an attacker to read or write to system memory or cause a denial of service.


Remediation:
CVE: CVE-2020-1894
Component: CVE-2020-1894
Release date: 2020-01-01T00:00:00+00:00

A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and WhatsApp Business for iPhone prior to v2.20.30 could have allowed arbitrary code execution when playing a specially crafted push to talk message.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
mishandling of certificate validation
CVE: CVE-2020-7043
Component: openfortivpn
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2020-02-27T00:00:00+00:00

An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com attack.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
libvncserver/scale.c has a pixel_value integer overflow
CVE: CVE-2020-14401
Component: libvncserver
CWE: CWE-190
Severity: Low
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2020-06-17T00:00:00+00:00

An issue was discovered in LibVNCServer before 0.9.13. libvncserver/scale.c has a pixel_value integer overflow.


Remediation:
heap-based buffer overflow in sc_oberthur_read_file
CVE: CVE-2020-26570
Component: opensc
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.4/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-10-06T00:00:00+00:00

The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.


Remediation:
This flaw can be mitigated in cases where you can use opensc without the Oberthur driver enabled. In such cases, the vulnerable driver can be disabled by specifying them in /etc/opensc.conf card_drivers field in allowlist fashion.
One such example:

```
app default {
   card_drivers = cac, cac1, PIV-II;
}
```

This would only enable the cac, cac1, and PIV-II smart card drivers, and all others would be disabled, including the Oberthur driver. With the Oberthur driver disabled, this flaw is mitigated. It is important to list all drivers that you need in the card_drivers field so that they are not disabled too.
XML parser is not preventing XML external entity (XXE) attacks
CVE: CVE-2020-2304
Component: jenkins-2-plugins/subversion
CWE: CWE-611
Severity: Important
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-11-04T00:00:00+00:00

A flaw was found in the subversion Jenkins plugin. The XML parser is not properly configured to prevent XML external entity (XXE) attacks allowing an attacker the ability to control an agent process and have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. The highest threat from this vulnerability is to data confidentiality.


Remediation:
Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.394, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.
For OpenShift Container Platform 4.4 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.5 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.
For OpenShift Container Platform 4.6 see the following documentation, which
will be updated shortly for this release, for important instructions on how
to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html.
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
stack-based buffer overflow in src/base/PdfDictionary.cpp
CVE: CVE-2020-18971
Component: podofo
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/PdfDictionary.cpp:65'.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
XSS due to lack of escaping on some pages
CVE: CVE-2020-7106
Component: cacti
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2020-01-15T00:00:00+00:00

Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
XSS exists in the MobileFrontend extension
CVE: CVE-2020-26120
Component: mediawiki
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2020-09-27T00:00:00+00:00

XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even without the element being appended to the DOM.

Statement: OpenShift Container Platform (OCP)  delivers the mediawiki package, but the vulnerable code is not bundled, therefore OCP is not affected by this flaw.

Remediation:
partial Denial of Service due to Integer Underflow
CVE: CVE-2020-14378
Component: dpdk
CWE: CWE-191
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2020-09-28T15:00:00+00:00

An integer underflow flaw was found in the `move_desc` function that can lead to large amounts of CPU cycles being consumed in a long-running loop. This flaw allows an attacker to cause `move_desc` to get stuck in a 4,294,967,295-count iteration loop. Depending on how `vhost_crypto` is being used, this issue could prevent other VMs or network tasks from being serviced by the busy DPDK lcore for an extended period. The highest threat from this vulnerability is to system availability.

Statement: This flaw does not affect the versions of `dpdk` as shipped with Red Hat Enterprise Linux 7 and 8 or the versions embedded in Red Hat Virtualization or the Fast Datapath `openvswitch` package, as they do not enable generic crypto device library support. This causes the vulnerable code in vhost_crypto.c to not be included.

This flaw does not affect Red Hat Ceph Storage 3 and 4 as dpdk (embedded in ceph source rpm) is not built in the packages, therefore the vulnerable code is not available in the resulting RPM and the issue cannot be exploited.

Remediation: