huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair()
CVE: CVE-2020-10723
Component: dpdk
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-05-18T00:00:00+00:00

A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and truncated into a uint16, which can lead to out of bound indexing and possible memory corruption.

Statement: This issue did not affect the versions of Ceph as shipped with Red Hat Ceph Storage 3 and 4, as they did not include support for DPDK.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
Insufficient policy enforcement in tab strip
CVE: CVE-2020-6476
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-05-19T00:00:00+00:00

Insufficient policy enforcement in tab strip in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Server: Optimizer unspecified vulnerability (CPU Oct 2020)
CVE: CVE-2020-14760
Component: mysql
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Release date: 2020-10-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).


Remediation:
out-of-bound read in glyph_cache_put
CVE: CVE-2020-11098
Component: freerdp
CWE: CWE-125
Severity: Low
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2020-06-22T00:00:00+00:00

In FreeRDP before version 2.1.2, there is an out-of-bound read in glyph_cache_put. This affects all FreeRDP clients with `+glyph-cache` option enabled This is fixed in version 2.1.2.


Remediation:
Do not use the +glyph_cache option in the freerdp client, which is disabled by default in freerdp-2.0.0.rc4 (shipped with Red Hat Enterprise Linux 7 and 8), but required to connect to xrdp.
masked keys for uri module are exposed into content and json output
CVE: CVE-2020-14330
Component: Ansible
CWE: CWE-532
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-03-23T00:00:00+00:00

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.

Statement: Red Hat Ansible Engine 2.9.12 (downstream) and Ansible Engine 2.9.11 (upstream), as well as previous versions are affected by this flaw. Ansible Engine 2.9.12 version (upstream) on towards fixes the issue for upstream and Red Hat Ansible Engine 2.9.13 version is fixed (downstream).

Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of Ansible, but they no longer maintain their own version of Ansible. Both the products will consume fixes directly from the Ansible repository. As we still ship Ansible separately for Ceph on Ubuntu, a future update may address this issue.

In Red Hat OpenStack Platform, because ansible is not directly customer exposed (so that the flaw could not be exploited) and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package. Note: Red Hat Open Stack Platform 15 and newer consume fixes directly from the Ansible repository.

Remediation:
There is no mitigation for this issue.
cutmem command allows privileged user to remove memory regions when Secure Boot is enabled
CVE: CVE-2020-27779
Component: grub2
CWE: CWE-285
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in grub2. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Remediation:
Heap buffer overflow in UI
CVE: CVE-2020-16024
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-11-17T00:00:00+00:00

Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.


Remediation:
weak permissions for /etc/target/saveconfig.json
CVE: CVE-2020-14019
Component: python-rtslib
CWE: CWE-282
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Release date: 2020-06-19T00:00:00+00:00

A flaw was found in Open-iSCSI rtslib-fb through versions 2.1.72, where it has weak permissions for /etc/target/saveconfig.json because the shutil.copyfile, instead of shutil.copy is used, and permissions are not preserved upon editing. This flaw allows an attacker with prior access to /etc/target/saveconfig.json to access a later version, resulting in a loss of integrity, depending on their permission settings. The highest threat from this vulnerability is to confidentiality.

Statement: Red Hat Ceph Storage 2 and 3 are not affected because within the affected method, shutil.copyfile is not used. However, the affected method, save_to_file is outdated and contains a race condition. Hence, this issue has been rated as having a security impact of low.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
user content can redirect the logout button to different URL
CVE: CVE-2020-10959
Component: mediawiki
CWE: CWE-601
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in MediaWiki, where an attacker can control the MediaWiki logout redirect URL. This flaw allows an attacker with the ability to create wiki pages, to change the logout URL that a user is redirected to when logging out.

Statement: The MediaWiki Ansible playbook has been removed from OpenShift Container Platform in version 4.3 and later.

Remediation:
multiple vulnerabiltiies
CVE: CVE-2020-13676
Component: drupal
Release date: 2020-01-01T00:00:00+00:00

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
lack of preemption in evtchn_reset() / evtchn_destroy() (XSA-344)
CVE: CVE-2020-25601
Component: xen
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.2/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Release date: 2020-09-22T12:00:00+00:00

A security flaw was found in Xen. A lack of preemption in the FIFO event channel model may cause the CPU to spend an almost unbounded amount of processing time. This flaw allows malicious or buggy guest kernels to mount a denial of service (DoS) attack affecting the entire system. The highest threat from this vulnerability is to system availability.

Statement: This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
This issue can be avoided by reducing the number of event channels available to all guests to a suitably low limit. For example, setting "max_event_channels=256" in the xl domain configurations may be low enough for all hardware Xen is able to run on.
disable spam embeds from disabled sites on a multisite network
CVE: CVE-2020-28033
Component: wordpress
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2020-10-29T00:00:00+00:00

WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server-side request forgery via img tags
CVE: CVE-2020-28463
Component: python-reportlab
CWE: CWE-918
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in python-reportlab. A Server-side Request Forgery (SSRF) vulnerability is possible via img tags.

Statement: This flaw is out of support scope for the following products:

* Red Hat Enterprise Linux 6
* Red Hat Enterprise Linux 7

To learn more about Red Hat Enterprise Linux support scope, please see https://access.redhat.com/support/policy/updates/errata/

Remediation:
Standard library asyncftpclient lacks a check for newline character
CVE: CVE-2020-15690
Component: nim
Release date: 2020-01-01T00:00:00+00:00

In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline character.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Server: DML unspecified vulnerability (CPU Oct 2020)
CVE: CVE-2020-14828
Component: mysql
Severity: Moderate
CVSS v3: 8.2/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-10-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
Incorrect security UI in sharing
CVE: CVE-2020-6397
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-02-04T00:00:00+00:00

Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
outside the range of representable values of type 'long' and integer overflow at MagickCore/pixel.c and MagickCore/cache.c
CVE: CVE-2020-25676
Component: ImageMagick
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2020-01-01T00:00:00+00:00

A flaw was found ImageMagick. Multiple unconstrained pixel offset calculations produce undefined behavior in the form of out-of-range and integer overflows. These instances of undefined behavior could be triggered by an attacker who is able to supply a crafted input file. The highest threat from this vulnerability is to system availability.

Statement: This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regarding support scopes, please see https://access.redhat.com/support/policy/updates/errata .

Remediation:
CVE: CVE-2020-1901
Component: CVE-2020-1901
Release date: 2020-01-01T00:00:00+00:00

Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Jackson configuration allows code execution with unknown serialization gadgets
CVE: CVE-2020-5411
Component: spring-batch-core
CWE: CWE-502
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-06-10T00:00:00+00:00

When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true: * Spring Batch's Jackson support is being leveraged to serialize a job's ExecutionContext. * A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored). In order to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being deserialized. Spring Batch should be proactive against blocking unknown "deserialization gadgets" when enabling default typing.


Remediation:
maliciously crafted archive can install files anywhere in the user's home directory
CVE: CVE-2020-16116
Component: ark
CWE: CWE-552
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2020-07-30T00:00:00+00:00

In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.

Statement: ark as shipped with Red Hat Enterprise Linux 7 prompts the user before allowing extraction into home directory, and also displays an error. Because the user must agree to perform the extraction in the home directory, Red Hat Product Security does not view this as a security vulnerability in ark as shipped with Red Hat Enterprise Linux 7.

Remediation:
accepts and trusts an invalid X.509 certificate chain
CVE: CVE-2020-35733
Component: erlang
CWE: CWE-295
Severity: Low
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-01-01T00:00:00+00:00

A flaw was found in the OTP component of Erlang. The SSL application accepts and trusts invalid X.509 certificate chains. An attacker, able to create a fake certificate chain, could create a man-in-the-middle attack. The highest threat from this vulnerability is to data confidentiality.

Statement: Red Hat CloudForms 5.10 ships affected erlang-OTP component but the product does not use it in a vulnerable way; therefore, the impact is low. The newer version of CloudForms 5.11 does not include the affected component.

Red Hat Ansible Tower 3.6 ships 20.3.8.21 erlang-OTP component but this version never introduced the vulnerability, therefore is not affected. The newer versions of Red Hat Ansible Tower 3.7 and Red Hat Ansible Automation Platform which ships Ansible Tower 3.8 do not include the erlang dependency.

All supported releases of Red Hat OpenStack Platform ship the affected Erlang component, however it is only used as a dependency for RabbitMQ and is not exposed outside the management network. As this network is tightly-regulated to OpenStack administrators, the risk for abuse is significantly reduced.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
use-after-free in speech recognizer
CVE: CVE-2020-6378
Component: chromium-browser
CWE: CWE-416
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-01-16T00:00:00+00:00

Use after free in speech in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
XML source markup processing remote code execution
CVE: CVE-2020-1147
Component: dotnet
CWE: CWE-502
Severity: Critical
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2020-07-14T17:00:00+00:00

It was discovered that .NET Core did not properly check the source markup of XML files. A remote, unauthenticated attacker could possibly exploit this flaw to execute arbitrary code by sending specially crafted requests to an application parsing certain kinds of XML files or an ASP.NET Core application.


Remediation:
Privilege escalation within a course when restoring role overrides
CVE: CVE-2020-25699
Component: moodle
CVSS v3: 8.2/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2020-11-16T04:00:00+00:00

A flaw was found in Moodle. Insufficient capability checks could allow users who can restore courses to escalate their privileges to roles within the course. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
missing SSL hostname validation allows MITM
CVE: CVE-2020-13482
Component: rubygem-em-http-request
CWE: CWE-297
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2020-05-24T00:00:00+00:00

A flaw was found in rubygem-em-http-request. The eventmachine library does not verify the hostname in a TLS server certificate which can allow an attacker to perform a man-in-the-middle attack. The highest threat from this vulnerability is to data confidentiality and integrity.


Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
Leak of uninitialized heap memory from the X server to clients in AllocatePixmap of dix/pixmap.c
CVE: CVE-2020-14347
Component: xorg-x11-server
CWE: CWE-665
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2020-07-31T00:00:00+00:00

A flaw was found in the way the Xserver memory was not properly initialized. This issue leak parts of server memory to the X client. In cases where the Xorg server runs with elevated privileges, this flaw results in a possible ASLR bypass.


Remediation:
user configuration not honoured leaving the connection unauthenticated via insecure defaults
CVE: CVE-2020-10754
Component: NetworkManager
CWE: CWE-455
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2020-05-29T04:41:00+00:00

A flaw was found in nmcli, where the command-line interface to the NetworkManager did not accept the 802-1x.ca-path and 802-1x.phase2-ca-path settings when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and an insecure connection occurs.


Remediation:
DoS via concurrent calls to dw_spi_irq and dw_spi_transfer_one functions in drivers/spi/spi-dw.c
CVE: CVE-2020-12769
Component: kernel
CWE: CWE-362
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2020-01-03T00:00:00+00:00

A flaw was found in the Linux kernel. A kernel panic can occur when concurrent calls to dw_spi_irq and dw_spi_transfer_one are made. The highest threat from this vulnerability is to system availability.

Statement: This issue is rated as having Low impact because of the preconditions needed to trigger the issue.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Insufficient validation of untrusted input in Omnibox
CVE: CVE-2020-6401
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2020-02-04T00:00:00+00:00

Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.