huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-53164: kernel: net: sched: fix ordering of qlen adjustment
Component: kernel
Severity: Low
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: sched: fix ordering of qlen adjustment

Changes to sch->q.qlen around qdisc_tree_reduce_backlog() need to happen
_before_ a call to said function because otherwise it may fail to notify
parent qdiscs when the child is about to become empty.

Statement: The bug is in Common Applications Kept Enhanced (CAKE) queue management algorithm. The support of this algorithm enabled starting from Red Hat Enterprise Linux 9.2. It is disabled by default (can be enabled by tc qdisc cake command). The security impact of this issue is limited.

Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.10.233, 5.15.176, 5.4.289, 6.1.122, 6.12.7, 6.13, 6.6.68
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 44782565e1e6174c94bddfa72ac7267cd09c1648
CVE-2024-53173: kernel: NFSv4.0: Fix a use-after-free problem in the asynchronous open()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFSv4.0: Fix a use-after-free problem in the asynchronous open()

Yang Erkun reports that when two threads are opening files at the same
time, and are forced to abort before a reply is seen, then the call to
nfs_release_seqid() in nfs4_opendata_free() can result in a
use-after-free of the pointer to the defunct rpc task of the other
thread.
The fix is to ensure that if the RPC call is aborted before the call to
nfs_wait_on_sequence() is complete, then we must call nfs_release_seqid()
in nfs4_open_release() before the rpc_task is freed.

Statement: This issue is considered to be a moderate impact flaw, as the reproduction (and exploit) for this is complex.

Affected upstream versions: 2.6.16
Fixed upstream versions: 0, 4.19.325, 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.11.11, 6.12.2, 6.13, 6.6.64
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1cfae9575296f5040cdc84b0730e79078c081d2d
CVE-2024-53174: kernel: SUNRPC: make sure cache entry active before cache_show
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: make sure cache entry active before cache_show

The function `c_show` was called with protection from RCU. This only
ensures that `cp` will not be freed. Therefore, the reference count for
`cp` can drop to zero, which will trigger a refcount use-after-free
warning when `cache_get` is called. To resolve this issue, use
`cache_get_rcu` to ensure that `cp` remains active.

------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 7 PID: 822 at lib/refcount.c:25
refcount_warn_saturate+0xb1/0x120
CPU: 7 UID: 0 PID: 822 Comm: cat Not tainted 6.12.0-rc3+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.16.1-2.fc37 04/01/2014
RIP: 0010:refcount_warn_saturate+0xb1/0x120

Call Trace:
 <TASK>
 c_show+0x2fc/0x380 [sunrpc]
 seq_read_iter+0x589/0x770
 seq_read+0x1e5/0x270
 proc_reg_read+0xe1/0x140
 vfs_read+0x125/0x530
 ksys_read+0xc1/0x160
 do_syscall_64+0x5f/0x170
 entry_SYSCALL_64_after_hwframe+0x76/0x7e


Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.11.11, 6.12.2, 6.13, 6.6.64
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e9be26735d055c42543a4d047a769cc6d0fb1504
CVE-2024-53176: kernel: smb: During unmount, ensure all cached dir instances drop their dentry
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: During unmount, ensure all cached dir instances drop their dentry

The unmount process (cifs_kill_sb() calling close_all_cached_dirs()) can
race with various cached directory operations, which ultimately results
in dentries not being dropped and these kernel BUGs:

BUG: Dentry ffff88814f37e358{i=1000000000080,n=/}  still in use (2) [unmount of cifs cifs]
VFS: Busy inodes after unmount of cifs (cifs)
------------[ cut here ]------------
kernel BUG at fs/super.c:661!

This happens when a cfid is in the process of being cleaned up when, and
has been removed from the cfids->entries list, including:

- Receiving a lease break from the server
- Server reconnection triggers invalidate_all_cached_dirs(), which
  removes all the cfids from the list
- The laundromat thread decides to expire an old cfid.

To solve these problems, dropping the dentry is done in queued work done
in a newly-added cfid_put_wq workqueue, and close_all_cached_dirs()
flushes that workqueue after it drops all the dentries of which it's
aware. This is a global workqueue (rather than scoped to a mount), but
the queued work is minimal.

The final cleanup work for cleaning up a cfid is performed via work
queued in the serverclose_wq workqueue; this is done separate from
dropping the dentries so that close_all_cached_dirs() doesn't block on
any server operations.

Both of these queued works expect to invoked with a cfid reference and
a tcon reference to avoid those objects from being freed while the work
is ongoing.

While we're here, add proper locking to close_all_cached_dirs(), and
locking around the freeing of cfid->dentry.


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.11.11, 6.12.2, 6.13, 6.6.64
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 73934e535cffbda1490fa97d82690a0f9aa73e94
CVE-2024-53190: kernel: wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

A deadlock condition exists in the Linux kernel. During the probe of rtl8192cu, the driver ends-up performing an refuse read procedure and the read_efuse() function calls read_efuse_byte() based on the efuse size.


Affected upstream versions: 2.6.38
Fixed upstream versions: 0, 6.1.120, 6.11.11, 6.12.2, 6.13, 6.6.64
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c386fb76f01794f1023d01a6ec5f5c93d00acd3b
CVE-2024-53197: kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
Component: kernel
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L)
Public date: 2024-12-27T00:00:00+00:00

A vulnerability was found in the Linux kernel's USB Audio driver. This flaw allows an attacker with physical access to the system to use a malicious USB device to gain additional access. This is possible by manipulating system memory, potentially escalating privileges, or executing arbitrary code.

Statement: This CVE marked as important vulnerability because it allows a malicious or compromised USB device to trigger out-of-bounds memory accesses in the Linux kernel’s ALSA USB audio subsystem. This occurs due to improper handling of bNumConfigurations, which can lead to memory corruption or even privilege escalation if exploited. Since USB devices can be dynamically plugged in, an attacker with physical access could potentially exploit this flaw to execute arbitrary code in kernel space or cause a system crash.
Because the kernel supports virtual USB devices, this vulnerability could still be exploited by an attacker without physical access, but is able to create virtual USB devices which use the vulnerable device drivers.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.19.325, 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.11.11, 6.12.2, 6.13, 6.6.64
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0b4ea4bfe16566b84645ded1403756a2dc4e0f19
CVE-2024-53203: kernel: usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
Component: kernel
Severity: Moderate
CWE: CWE-129 (Improper Validation of Array Index)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: fix potential array underflow in ucsi_ccg_sync_control()

The "command" variable can be controlled by the user via debugfs.  The
worry is that if con_index is zero then "&uc->ucsi->connector[con_index
- 1]" would be an array underflow.

Statement: This issue is considered to be a moderate impact flaw, as the exploitation for this will need an ADMIN (or ROOT) privilege (PR:H).

Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.10.238, 5.15.184, 6.1.140, 6.11.11, 6.12.2, 6.13, 6.6.88
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 627c2a5056aba42a8a96a8fffe8996aeccf919a9
CVE-2024-53213: kernel: net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

A double free vulnerability was found in the Linux kernel. In lan78xx_probe(), the `buf` buffer is freed twice: once implicitly through `usb_free_urb(dev->urb_intr)` with the `URB_FREE_BUFFER` flag and again explicitly by `kfree(buf)`, resulting in loss of availability of the system.


Affected upstream versions: 5.10.252 < 5.10.258, 5.15.202 < 5.15.209, 5.17
Fixed upstream versions: 0, 5.10.258, 5.15.209, 6.1.120, 6.11.11, 6.12.2, 6.13, 6.6.64
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cc5aa8e3ad69dcedeba79e667d4a2efb72a305af
CVE-2024-53222: kernel: zram: fix NULL pointer in comp_algorithm_show()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

zram: fix NULL pointer in comp_algorithm_show()

LTP reported a NULL pointer dereference as followed:

 CPU: 7 UID: 0 PID: 5995 Comm: cat Kdump: loaded Not tainted 6.12.0-rc6+ #3
 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 pc : __pi_strcmp+0x24/0x140
 lr : zcomp_available_show+0x60/0x100 [zram]
 sp : ffff800088b93b90
 x29: ffff800088b93b90 x28: 0000000000000001 x27: 0000000000400cc0
 x26: 0000000000000ffe x25: ffff80007b3e2388 x24: 0000000000000000
 x23: ffff80007b3e2390 x22: ffff0004041a9000 x21: ffff80007b3e2900
 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000
 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
 x11: 0000000000000000 x10: ffff80007b3e2900 x9 : ffff80007b3cb280
 x8 : 0101010101010101 x7 : 0000000000000000 x6 : 0000000000000000
 x5 : 0000000000000040 x4 : 0000000000000000 x3 : 00656c722d6f7a6c
 x2 : 0000000000000000 x1 : ffff80007b3e2900 x0 : 0000000000000000
 Call trace:
  __pi_strcmp+0x24/0x140
  comp_algorithm_show+0x40/0x70 [zram]
  dev_attr_show+0x28/0x80
  sysfs_kf_seq_show+0x90/0x140
  kernfs_seq_show+0x34/0x48
  seq_read_iter+0x1d4/0x4e8
  kernfs_fop_read_iter+0x40/0x58
  new_sync_read+0x9c/0x168
  vfs_read+0x1a8/0x1f8
  ksys_read+0x74/0x108
  __arm64_sys_read+0x24/0x38
  invoke_syscall+0x50/0x120
  el0_svc_common.constprop.0+0xc8/0xf0
  do_el0_svc+0x24/0x38
  el0_svc+0x38/0x138
  el0t_64_sync_handler+0xc0/0xc8
  el0t_64_sync+0x188/0x190

The zram->comp_algs[ZRAM_PRIMARY_COMP] can be NULL in zram_add() if
comp_algorithm_set() has not been called.  User can access the zram device
by sysfs after device_add_disk(), so there is a time window to trigger the
NULL pointer dereference.  Move it ahead device_add_disk() to make sure
when user can access the zram device, it is ready.  comp_algorithm_set()
is protected by zram->init_lock in other places and no such problem.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.12.2, 6.13, 6.6.84
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c7ee791e538537b281f60945298796f0a3971bbd
CVE-2024-53232: kernel: iommu/s390: Implement blocking domain
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommu/s390: Implement blocking domain

This fixes a crash when surprise hot-unplugging a PCI device. This crash
happens because during hot-unplug __iommu_group_set_domain_nofail()
attaching the default domain fails when the platform no longer
recognizes the device as it has already been removed and we end up with
a NULL domain pointer and UAF. This is exactly the case referred to in
the second comment in __iommu_device_set_domain() and just as stated
there if we can instead attach the blocking domain the UAF is prevented
as this can handle the already removed device. Implement the blocking
domain to use this handling.  With this change, the crash is fixed but
we still hit a warning attempting to change DMA ownership on a blocked
device.


Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.11.11, 6.12.2, 6.13
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3be34fa1cdbf180c1a948cfededfdf2cdc497199
CVE-2024-53241: kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-12-17T12:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/xen: don't do PV iret hypercall through hypercall page

Instead of jumping to the Xen hypercall page for doing the iret
hypercall, directly code the required sequence in xen-asm.S.

This is done in preparation of no longer using hypercall page at all,
as it has shown to cause problems with speculation mitigations.

This is part of XSA-466 / CVE-2024-53241.


Affected upstream versions: 2.6.27
Fixed upstream versions: 0, 5.10.232, 5.15.175, 6.1.121, 6.12.6, 6.13, 6.6.67
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 05df6e6cd9a76b778aee33c3c18c9f3b3566d4a5
CVE-2024-53259: quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux
Component: quic-go
Severity: Moderate
CWE: CWE-345 (Insufficient Verification of Data Authenticity)
CVSS v3: 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-02T16:12:40.605000+00:00

A vulnerability was found in Quic-Go where an attacker can inject malicious data into network packets, potentially allowing them to cause harm. The issue arises from a configuration option used by some affected versions of the code that sends out information about packet size limitations. As a result, when Quic-Go attempts to send a packet larger than it claims to be able to handle, the operating system will reject it due to a "message too large" error.


Affected upstream versions: < 0.48.2
Fixed upstream versions: v0.49.0
Upstream repository: https://github.com/quic-go/quic-go
Upstream fix commit: ca31dd355cbe5fc6c5807992d9d1149c66c96a50
CVE-2024-53263: git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs
Component: git-lfs
Severity: Important
CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Public date: 2025-01-14T19:33:21.876000+00:00

A flaw was found in the Git LFS git extension. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials.

Statement: This vulnerability in Git LFS is important rather than moderate because it directly impacts the security of credential handling, a core aspect of repository access control. By allowing an attacker to inject line-ending control characters, such as LF or CR, into URLs passed to the `git-credential` command, it bypasses a fundamental trust boundary between Git and the credential helper. This issue could enable attackers to intercept or exfiltrate user credentials, granting unauthorized access to repositories, including private and sensitive data.

Affected upstream versions: >= 0.1.0, < 3.6.1
Fixed upstream versions: v3.6.1
Upstream repository: https://github.com/git-lfs/git-lfs
Upstream fix commit: 0345b6f816e611d050c0df67b61f0022916a1c90
CVE-2024-53270: envoy: HTTP/1: sending overload crashes when the request is reset beforehand in envoy
Component: envoy
Severity: Important
CWE: CWE-670 (Always-Incorrect Control Flow Implementation)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-12-18T19:12:18.775000+00:00

A flaw was found in Envoy. In systems where `http1_server_abort_dispatch` is configured, Envoy does not properly handle the control flow during H1 stream resets. This can trigger a null pointer error and lead to an application crash.

Statement: This vulnerability in Envoy Proxy is marked as important severity rather than moderate due to its ability to cause a null pointer dereference, leading to a complete crash of the proxy under specific conditions. As Envoy is commonly deployed in mission-critical roles such as a high-performance edge, middle, or service proxy, a crash can disrupt downstream and upstream communication, effectively bringing down services dependent on Envoy. The issue is exacerbated by its potential to occur during load shedding, a mechanism typically invoked during resource exhaustion, which is a critical time for maintaining service availability.

Affected upstream versions: >= 1.32.0, < 1.32.3, >= 1.31.0, < 1.31.5, >= 1.30.0, < 1.30.9, < 1.29.12
Upstream repository: https://github.com/envoyproxy/envoy
Upstream fix commit: 6cf8afda956ba67c9afad185b962325a5242ef02
CVE-2024-53681: kernel: nvmet: Don't overflow subsysnqn
Component: kernel
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-01-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvmet: Don't overflow subsysnqn

nvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed
size buffer, even though it is dynamically allocated to the size of the
string.

Create a new string with kstrndup instead of using the old buffer.


Affected upstream versions: 6.9
Fixed upstream versions: 0, 6.12.9, 6.13
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 86645d8d062af3fdcbdaa0a289b95de55bca827d
CVE-2024-53990: async-http-client: AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s
Component: async-http-client
Severity: Important
CWE: CWE-287 (Improper Authentication)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-12-02T17:10:28.229000+00:00

A flaw was found in the AsyncHttpClient (AHC) library. When making any HTTP request, the automatically enabled and self-managed CookieStore will silently replace explicitly defined cookies with any that have the same name from the CookieStore. For services that operate with multiple users, this can result in one user's cookie being used for another user's requests.


Affected upstream versions: < 3.0.1
Fixed upstream versions: async-http-client-project-3.0.1
Upstream repository: https://github.com/AsyncHttpClient/async-http-client
Upstream fix commit: d5a83362f7aed81b93ebca559746ac9be0f95425
CVE-2024-54456: kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()

name is char[64] where the size of clnt->cl_program->name remains
unknown. Invoking strcat() directly will also lead to potential buffer
overflow. Change them to strscpy() and strncat() to fix potential
issues.


Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.12.16, 6.13.4, 6.14, 6.6.79
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 19b3ca651b4b473878c73539febe477905041442
CVE-2024-5535: openssl: SSL_select_next_proto buffer overread
Component: openssl
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-27T00:00:00+00:00

A flaw was found in OpenSSL. Affected versions of this package are vulnerable to Information Exposure through the SSL_select_next_proto function. This flaw allows an attacker to cause unexpected application behavior or a crash by exploiting the buffer overread condition when the function is called with a zero-length client list. This issue is only exploitable if the application is misconfigured to use a zero-length server list and mishandles the 'no overlap' response in ALPN or uses the output as the opportunistic protocol in NPN.

Statement: The FIPS modules in versions 3.3, 3.2, 3.1, and 3.0 are not affected by this issue.
The packages shim and shim-unsigned-x64 are not impacted by this CVE, as the affected OpenSSL code path is not utilized.

Affected upstream versions: 3.3.0 < 3.3.2, 3.2.0 < 3.2.3, 3.1.0 < 3.1.7, 3.0.0 < 3.0.15, 1.1.1 < 1.1.1za, 1.0.2 < 1.0.2zk
Fixed upstream versions: 1.0.2zk, 1.1.1za, 3.0.15, 3.1.7, 3.2.3, 3.3.2
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: e86ac436f0bd54d4517745483e2315650fae7b2c
CVE-2024-5569: github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp
Component: github.com/jaraco/zipp
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-09T00:00:00+00:00

A flaw was found in jaraco/zipp. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects.


Affected upstream versions: unspecified < 3.19.1
Fixed upstream versions: 3.19.1
Upstream repository: https://github.com/jaraco/zipp
Upstream fix commit: fd604bd34f0343472521a36da1fbd22e793e14fd