huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-25577: python-werkzeug: high resource usage when parsing multipart form data with many fields
Component: python-werkzeug
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-14T00:00:00+00:00

A flaw was found in python-werkzeug. Werkzeug is multipart form data parser, that will parse an unlimited number of parts, including file parts. These parts can be a small amount of bytes, but each requires CPU time to parse, and may use more memory as Python data. If a request can be made to an endpoint that accesses request.data, request.form, request.files, or request.get_data(parse_form_data=False), it can cause unexpectedly high resource usage, allowing an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests, and if many concurrent requests are sent continuously, this can exhaust or kill all available workers.


Affected upstream versions: < 2.2.3
Fixed upstream versions: 2.2.x
Upstream repository: https://github.com/pallets/werkzeug
Upstream fix commit: 517cac5a804e8c4dc4ed038bb20dacd038e7a9f1
CVE-2023-25652: git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents
Component: git
Severity: Important
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2023-04-25T00:00:00+00:00

A vulnerability was found in Git. This security flaw occurs when feeding specially crafted input to `git apply --reject`; a path outside the working tree can be overwritten with partially controlled contents corresponding to the rejected hunk(s) from the given patch.


Affected upstream versions: < 2.30.9, >= 2.31.0, < 2.31.8, >= 2.32.0, < 2.32.7, >= 2.33.0, < 2.33.8, >= 2.34.0, < 2.34.8, >= 2.35.0, < 2.35.8, >= 2.36.0, < 2.36.6, >= 2.37.0, < 2.37.7, >= 2.38.0, < 2.38.5, >= 2.39.0, < 2.39.3, >= 2.40.0, < 2.40.1
Fixed upstream versions: v2.30.9
Upstream repository: https://github.com/git/git
Upstream fix commit: 18e2b1cfc80990719275d7b08e6e50f3e8cbc902
CVE-2023-25725: haproxy: request smuggling attack in HTTP/1 header parsing
Component: haproxy
Severity: Important
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)
Public date: 2023-02-14T16:20:00+00:00

A flaw was found in HAProxy's headers processing that causes HAProxy to drop important headers fields such as Connection, Content-length, Transfer-Encoding, and Host after having partially processed them. A maliciously crafted HTTP request could be used in an HTTP request smuggling attack to bypass filtering and detection by HAProxy.

Statement: Red Hat OpenStack Platform doesn't ship any haproxy code of its own and instead the openstack-haproxy-container consumes the `haproxy` RPM provided by RHEL.

Affected upstream versions: n/a
Fixed upstream versions: v2.7.3
Upstream repository: https://git.haproxy.org/haproxy-2.7.git
Upstream fix commit: a0e561ad7f29ed50c473f5a9da664267b60d1112
CVE-2023-25809: runc: Rootless runc makes `/sys/fs/cgroup` writable
Component: runc
Severity: Moderate
CWE: CWE-276 (Incorrect Default Permissions)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L)
Public date: 2023-03-29T00:00:00+00:00

A flaw was found in runc, where it is vulnerable to a denial of service caused by improper access control in the /sys/fs/cgroup endpoint. This flaw allows a local authenticated attacker to cause a denial of service.


Affected upstream versions: < 1.1.5
Fixed upstream versions: v1.2.0
Upstream repository: https://github.com/opencontainers/runc
Upstream fix commit: 0d62b950e60f6980b54fe3bafd9a9c608dc1df17
CVE-2023-26054: buildkit: Data disclosure in provenance attestation describing a build
Component: buildkit
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2023-03-06T00:00:00+00:00

A flaw was found in the moby buildkit. When a build is performed under specific conditions where credentials were passed to BuildKit, it may be visible to everyone with access to provenance attestation.


Affected upstream versions: >= 0.10.0, < 0.11.4
Fixed upstream versions: v0.12.0
Upstream repository: https://github.com/moby/buildkit
Upstream fix commit: 75123c696506bdbca1ed69906479e200f1b62604
CVE-2023-26125: golang-github-gin-gonic-gin: Improper Input Validation
Component: golang-github-gin-gonic-gin
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2023-05-04T00:00:00+00:00

A flaw was found in Gin-Gonic Gin. This flaw allows a remote attacker to bypass security restrictions caused by improper input validation. An attacker can perform cache poisoning attacks by sending a specially-crafted request using the X-Forwarded-Prefix header.


Fixed upstream versions: 1.9.0
Upstream repository: https://github.com/t0rchwo0d/gin
Upstream fix commit: fd9f98e70fb4107ee68c783482d231d35e60507b
CVE-2023-26136: tough-cookie: prototype pollution in cookie memstore
Component: tough-cookie
Severity: Moderate
CWE: CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'))
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2023-07-01T00:00:00+00:00

A flaw was found in the tough-cookie package which allows Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.


Affected upstream versions: <= v4.1.2
Fixed upstream versions: 4.1.3
Upstream repository: https://github.com/salesforce/tough-cookie
Upstream fix commit: 12d474791bb856004e858fdb1c47b7608d09cf6e
CVE-2023-26141: sidekiq: DoS in dashboard-charts
Component: sidekiq
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-09-14T00:00:00+00:00

A denial of service vulnerability was found in Sidekiq. This flaw allows an attacker to manipulate the localStorage value in the dashboard-charts.js file and cause excessive polling requests.


Affected upstream versions: <= v7.1.2
Fixed upstream versions: 7.1.3
Upstream repository: https://github.com/sidekiq/sidekiq
Upstream fix commit: 62c90d7c5a7d8a378d79909859d87c2e0702bf89
CVE-2023-26144: graphql: Insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries
Component: graphql
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2023-09-18T00:00:00+00:00

A flaw was found in the graphql package. Affected versions of this package are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This issue may allow an attacker to degrade system performance.


Affected upstream versions: 16.3.0 < 16.8.1
Fixed upstream versions: 16.8.1
Upstream repository: https://github.com/graphql/graphql-js
Upstream fix commit: f94b511386c7e47bd0380dcd56553dc063320226
CVE-2023-2650: openssl: Possible DoS translating ASN.1 object identifiers
Component: openssl
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2023-05-30T00:00:00+00:00

A flaw was found in OpenSSL resulting in a possible denial of service while translating ASN.1 object identifiers. Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience long delays when processing messages, which may lead to a denial of service.

Statement: CVE-2023-2650 can't cause DoS on machines with OpenSSL 1.1.1 and so is considered LOW for RHEL 8.

Affected upstream versions: 3.1.1 < 3.1.1, 3.0.0 < 3.0.9, 1.1.1 < 1.1.1u, 1.0.2 < 1.0.2zh
Fixed upstream versions: 1.0.2zh, 1.1.1u, 3.0.9, 3.1.1
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: db779b0e10b047f2585615e0b8f2acdf21f8544a
CVE-2023-26545: kernel: mpls: double free on sysctl allocation failure
Component: kernel
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-15T00:00:00+00:00

A double-free flaw was found in the Linux kernel when the MPLS implementation handled sysctl allocation failures. This issue could allow a local user to cause a denial of service or possibly execute arbitrary code.

Statement: Red Hat Enterprise Linux 6 and 7 are not affected by this flaw as they did not include MPLS routing support, which was introduced upstream in version 4.1-rc1 (commit 0189197 "mpls: Basic routing support").

Affected upstream versions: n/a
Fixed upstream versions: v6.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: fda6c89fe3d9aca073495a664e1d5aea28cd4377
CVE-2023-2700: libvirt: Memory leak in virPCIVirtualFunctionList cleanup
Component: libvirt
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2023-05-15T00:00:00+00:00

A vulnerability was found in libvirt. This security flaw occurs due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup.


Affected upstream versions: libvirt-4.5.0
Fixed upstream versions: v9.3.0
Upstream repository: https://gitlab.com/libvirt/libvirt
Upstream fix commit: 6425a311b8ad19d6f9c0b315bf1d722551ea3585
CVE-2023-2731: libtiff: null pointer deference in LZWDecode() in libtiff/tif_lzw.c
Component: libtiff
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2023-04-22T00:00:00+00:00

A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.


Affected upstream versions: Fixed in libtiff v4.5.0
Fixed upstream versions: v4.5.1
Upstream repository: https://github.com/libsdl-org/libtiff
Upstream fix commit: 9be22b639ea69e102d3847dca4c53ef025e9527b
CVE-2023-27349: BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability
Component: BlueZ
Severity: Moderate
CWE: CWE-129 (Improper Validation of Array Index)
CVSS v3: 7.1 (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-05-03T00:00:00+00:00

A vulnerability was found in the BlueZ Audio Profile AVRCP, stemming from the improper validation of array indices. This flaw resides in the AVRCP protocol handling and arises due to inadequate validation of user-supplied data. Consequently, it may lead to writing beyond the bounds of an allocated buffer. This flaw possibly allows a network-adjacent attacker to execute code within the root context via Bluetooth.

Statement: This vulnerability is considered moderate due to its potential impact stemming from improper validation of array indices within the BlueZ Audio Profile AVRCP implementation. The inadequate validation of user-supplied data could result in buffer overflow, enabling a network-adjacent attacker to execute code with root privileges via Bluetooth, contingent upon specific conditions being met.

Affected upstream versions: 5.66
Fixed upstream versions: 5.67
Upstream repository: https://git.kernel.org/pub/scm/bluetooth/bluez.git
Upstream fix commit: f54299a850676d92c3dafd83e9174fcfe420ccc9
CVE-2023-27371: libmicrohttpd: remote DoS
Component: libmicrohttpd
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-28T00:00:00+00:00

An out-of-bounds flaw was found in GNU's libmicrohttpd due to improper parsing of a multipart/form-data boundary in the MHD_create_post_processor() method in postprocessor.c. This flaw allows an attacker to remotely send a malicious HTTP POST packet that includes one or more ‘\0’ bytes in a multipart/form-data boundary field, which, assuming a specific heap layout, will result in an out-of-bounds read and a crash in the find_boundary() function, causing a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v1.0.0
Upstream repository: https://git.gnunet.org/libmicrohttpd.git
Upstream fix commit: 6d6846e20bfdf4b3eb1b592c97520a532f724238
CVE-2023-27539: rubygem-rack: denial of service in header parsing
Component: rubygem-rack
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2023-03-15T00:00:00+00:00

A denial of service vulnerability was found in rubygem-rack in how it parses headers. A carefully crafted input can cause header parsing to take an unexpected amount of time, possibly resulting in a denial of service.


Affected upstream versions: 2.2.6.4 < 2.2.6.4, 3.0.6.1 < 3.0.6.1
Fixed upstream versions: 2.2.6.4, 3.0.6.1
Upstream repository: https://github.com/rack/rack
Upstream fix commit: 231ef369ad0b542575fb36c74fcfcfabcf6c530c
CVE-2023-2798: htmlUnit: Stack overflow crash causes Denial of Service (DoS)
Component: htmlUnit
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-05-25T00:00:00+00:00

A flaw was found in HtmlUnit. This issue may allow a malicious user to supply content to htmlUnit, which could cause a crash by stack overflow, leading to a Denial of Service (DoS).


Affected upstream versions: <= 2.69.0
Fixed upstream versions: 2.70.0
Upstream repository: https://github.com/HtmlUnit/htmlunit
Upstream fix commit: 940dc7fd
CVE-2023-28100: flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console
Component: flatpak
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Public date: 2023-03-16T00:00:00+00:00

A flaw was found in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. It contains a vulnerability similar to CVE-2017-5226 but using the `TIOCLINUX` ioctl command instead of `TIOCSTI.` If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal, and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2`, and others.


Affected upstream versions: < 1.10.8, >= 1.12.0, < 1.12.8, >= 1.14.0, < 1.14.4, >= 1.15.0, < 1.15.4
Fixed upstream versions: 1.15.4
Upstream repository: https://github.com/flatpak/flatpak
Upstream fix commit: 8e63de9a7d3124f91140fc74f8ca9ed73ed53be9
CVE-2023-28101: flatpak: Metadata with ANSI control codes can cause misleading terminal output
Component: flatpak
Severity: Moderate
CWE: CWE-116 (Improper Encoding or Escaping of Output)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2023-03-16T00:00:00+00:00

A flaw was found in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. Suppose an attacker publishes a Flatpak app with elevated permissions. In that case, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC.`


Affected upstream versions: < 1.10.8, >= 1.12.0, < 1.12.8, >= 1.14.0, < 1.14.4, >= 1.15.0, < 1.15.4
Fixed upstream versions: 1.15.4
Upstream repository: https://github.com/flatpak/flatpak
Upstream fix commit: 409e34187de2b2b2c4ef34c79f417be698830f6c
CVE-2023-28120: rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice
Component: rubygem-activesupport
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2023-03-15T00:00:00+00:00

A Cross-Site-Scripting vulnerability was found in rubygem ActiveSupport. If the new bytesplice method is called on a SafeBuffer with untrusted user input, malicious code could be executed.


Affected upstream versions: 7.0.4.3 < 7.0.4.3, 6.1.7.3 < 6.1.7.3
Fixed upstream versions: 6.1.7.3, 7.0.4.3
Upstream repository: https://github.com/rails/rails
Upstream fix commit: 3cf23c3f891e2e81c977ea4ab83b62bc2a444b70
CVE-2023-28362: actionpack: Possible XSS via User Supplied Values to redirect_to
Component: actionpack
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2023-06-27T00:00:00+00:00

A Cross-site Scripting (XSS) vulnerability was found in Actionpack due to improper sanitization of user-supplied values. This allows provided values to contain characters that are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned location header.


Affected upstream versions: 7.0.5.1 < 7.0.5.1, 6.1.7.4 < 6.1.7.4
Fixed upstream versions: 6.1.7.4, 7.0.5.1
Upstream repository: https://github.com/rails/rails
Upstream fix commit: 1c3f93d1e90a3475f9ae2377ead25ccf11f71441
CVE-2023-28366: mosquitto: memory leak leads to unresponsive broker
Component: mosquitto
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-09-01T00:00:00+00:00

A memory leak vulnerability was found in Eclipse Mosquitto. This issue is triggered by malicious initial packets or certain client actions and may allow a remote attacker to the deplete system resources causing memory exhaustion, leading to a disruption in services and a denial of service condition.


Affected upstream versions: n/a
Fixed upstream versions: v2.0.16
Upstream repository: https://github.com/eclipse/mosquitto
Upstream fix commit: 6113eac95a9df634fbc858be542c4a0456bfe7b9
CVE-2023-28410: hw: Intel: Improper restriction in memory buffer in graphics drivers cause escalation of privilege
Component: hw
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-05-11T06:30:00+00:00

A flaw has been identified in the Linux kernel i915 graphics driver that improperly restricts operations within the bounds of a memory buffer. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.

Statement: This has been rated as having a Moderate security impact until more information is available, such as exploit or description. The potential corruption of memory is expected to have impact on availability, leading to a system crash.

Affected upstream versions: before kernel version 6.2.10
Fixed upstream versions: v5.18
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 3886a86e7e6cc6ce2ce93c440fecd8f42aed0ce7
CVE-2023-28450: dnsmasq: default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232
Component: dnsmasq
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-03-15T00:00:00+00:00

A flaw was found in Dnsmasq. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.

Statement: The severity of this vulnerability is not important but moderate because exploiting the vulnerability can lead to a theoretical disruption of the availability of the service, but doesn’t directly compromise data integrity or confidentiality. This theoretical disruption would require an attacker to be able to induce IP fragmentation during transmission and can be mitigated with a simple configuration change in any affected version. A successful attack would require significant target specific preparation and the ability to act as a man-in-the-middle or control the path MTU of the authoritative DNS server. Additionally, this CVE is easily remediated by setting the edns-packet-max value to 1232 in the dnsmasq configuration.

The changes made for DNS Flag Day 2020 were primarily related to improving service reliability in order to make sure that DNS servers do not experience transmission failures due to IP fragmentation over networks of unknown MTU configurations. This change of the default maximum EDNS Buffer Size was coordinated so that default configurations of DNS services would provide more reliable default settings as well as avoid attacks on DNS services that can only be made possible when UDP packets are fragmented in transit. For example, if the DNS Query ID and UDP port are carried in the first IP fragment, an attacker could spoof the second fragment and poison the DNS cache by swapping the subsequent good IP fragments with their own. 

By using a default maximum EDNS value of 1232 (the largest value found to avoids fragmentation on nearly all modern networks) and relying on TCP for DNS queries with larger responses, IP Fragmentation issues can be reliably avoided with the default dnsmasq configuration.

Affected upstream versions: n/a
Fixed upstream versions: v2.90
Upstream repository: https://thekelleys.org.uk/gitweb/dnsmasq.git
Upstream fix commit: eb92fb32b746f2104b0f370b5b295bb8dd4bd5e5
CVE-2023-28466: kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-03-15T00:00:00+00:00

A use-after-free flaw was found in the do_tls_getsockopt function in net/tls/tls_main.c in the Transport Layer Security (TLS) in the Network subcompact in the Linux kernel. This flaw allows an attacker to cause a NULL pointer dereference problem due to a race condition.


Affected upstream versions: n/a
Fixed upstream versions: v6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 49c47cc21b5b7a3d8deb18fc57b0aa2ab1286962
CVE-2023-28486: sudo: Sudo does not escape control characters in log messages
Component: sudo
Severity: Moderate
CWE: CWE-117 (Improper Output Neutralization for Logs)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2023-03-16T00:00:00+00:00

A flaw was found in the sudo package, shipped with Red Hat Enterprise Linux 8 and 9, where sudo improperly escapes terminal control characters during logging operations. As sudo's log messages may contain user-controlled strings, this may allow an attacker to inject terminal control commands, leading to a leak of restricted information.


Affected upstream versions: n/a
Fixed upstream versions: v1.9.13
Upstream repository: https://github.com/sudo-project/sudo
Upstream fix commit: 334daf92b31b79ce68ed75e2ee14fca265f029ca