huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-27415: kernel: netfilter: bridge: confirm multicast packets before passing them up the stack
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

A security vulnerability was identified in the Linux kernel's netfilter subsystem, specifically affecting the handling of multicast and broadcast packets on network bridges. The issue arises from a race condition in the connection tracking (conntrack) module when processing cloned socket buffers (skbs) that reference the same connection entry (nf_conn). This condition can lead to system instability or potential security risks.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.15.151, 6.1.81, 6.6.21, 6.7.9, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7c3f28599652acf431a2211168de4a583f30b6d5
CVE-2024-27417: kernel: ipv6: fix potential &#34;struct net&#34; leak in inet6_rtm_getaddr()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

A flaw was discovered in the Linux kernel's IPv6 implementation, specifically within the inet6_rtm_getaddr() function. The issue arises when user space provides a valid IFA_TARGET_NETNSID value but omits the IFA_ADDRESS and IFA_LOCAL attributes. In such cases, the function returns an -EINVAL error while inadvertently increasing the reference count of the struct net object, leading to a potential memory leak. This flaw has been addressed by ensuring that the reference count is properly managed, preventing unintended resource retention. Users are advised to update their Linux kernel to a version that includes this fix to maintain system stability and prevent resource leaks.


Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.212, 5.15.151, 5.4.271, 6.1.81, 6.6.21, 6.7.9, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9d4ffb5b9d879a75e4f7460e8b10e756b4dfb132
CVE-2024-27431: kernel: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cpumap: Zero-initialise xdp_rxq_info struct before running XDP program

The Linux kernel CVE team has assigned CVE-2024-27431 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051723-CVE-2024-27431-30ae@gregkh/T


Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.10.213, 5.15.152, 6.1.82, 6.6.22, 6.7.10, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5f4e51abfbe6eb444fa91906a5cd083044278297
CVE-2024-27434: kernel: wifi: iwlwifi: mvm: don&#39;t set the MFP flag for the GTK
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

CVE-2024-27434 is a flaw in the Linux kernel’s iwlwifi driver related to handling Management Frame Protection (MFP) in certain Wi-Fi configurations. When connecting to an access point using TKIP as the group cipher, the driver incorrectly applies the MFP flag to the Group Temporal Key (GTK), which is not supported in this context. This can result in firmware crashes and instability. The issue has been fixed by ensuring the driver does not set the MFP flag for incompatible group ciphers like TKIP. Updating to a patched kernel version is recommended to resolve this vulnerability.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b4f1b0b3b91762edd19bf9d3b2e4c3a0740501f8
CVE-2024-27435: kernel: nvme: fix reconnection fail due to reserved tag allocation
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

CVE-2024-27435 is a Linux kernel vulnerability in the NVMe over RDMA implementation, where a reconnection failure occurs due to a deadlock caused by reserved tag allocation. The issue arises when the admin queue is quiesced while resetting the controller, causing a keep-alive request to hold the only reserved tag. As the admin queue and fabric queue share this tagset, the reconnection fails because no available tags are left for the connection command.


Affected upstream versions: 5.12
Fixed upstream versions: 0, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 149afee5c7418ec5db9d7387b9c9a5c1eb7ea2a8
CVE-2024-27436: kernel: ALSA: usb-audio: Stop parsing channels bits when all channels are found.
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Stop parsing channels bits when all channels are found.

The Linux kernel CVE team has assigned CVE-2024-27436 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051711-CVE-2024-27436-2227@gregkh/T


Affected upstream versions: 3.8
Fixed upstream versions: 0, 4.19.311, 5.10.214, 5.15.153, 5.4.273, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7e2c1b0f6dd9abde9e60f0f9730026714468770f
CVE-2024-27437: kernel: vfio/pci: Disable auto-enable of exclusive INTx IRQ
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-05T00:00:00+00:00

An incorrect handling flaw was found in the Linux kernel framework for secure userspace device drivers functionality that may interrupt some of the devices. This issue could allow a local user to crash the system.


Affected upstream versions: 3.6
Fixed upstream versions: 0, 5.10.215, 5.15.154, 5.4.274, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 26389925d6c2126fb777821a0a983adca7ee6351
CVE-2024-28102: python-jwcrypto: malicious JWE token can cause denial of service
Component: python-jwcrypto
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Public date: 2024-03-08T00:00:00+00:00

An uncontrolled resource consumption vulnerability was found in python-jwcrypto. If a malicious JWE token with a high compression ratio is passed to the server, the server will consume a lot of memory and processing time, leading to a denial of service.

Statement: The CVE-2024-28102 vulnerability in JWCrypto represents a moderate severity issue due to its potential impact on system availability and resource consumption. While the vulnerability allows for a denial of service (DoS) attack, it requires an attacker to craft a malicious JWE Token with a high compression ratio. This specific condition limits the practical exploitability of the vulnerability to some extent, as it demands a more sophisticated attack approach than common vulnerabilities. Nonetheless, if exploited, the vulnerability can lead to significant memory exhaustion and increased server processing time, impacting the overall performance and availability of the affected system.

Affected upstream versions: < 1.5.6
Fixed upstream versions: v1.5.6
Upstream repository: https://github.com/latchset/jwcrypto
Upstream fix commit: 90477a3b6e73da69740e00b8161f53fea19b831f
CVE-2024-28110: cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials
Component: cloudevents/sdk-go
Severity: Moderate
CWE: CWE-522 (Insufficiently Protected Credentials)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-03-06T00:00:00+00:00

A vulnerability was found in cloudevents/sdk-go. This issue involves using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper results in the go-sdk leaking credentials to arbitrary endpoints. When the transport is populated with an authenticated transport, http.DefaultClient is modified with the authenticated transport, causing it to send Authorization tokens to any endpoint it communicates with. This flaw allows an attacker to intercept and abuse these leaked credentials, potentially leading to unauthorized access to sensitive information or executing unauthorized actions on the affected system.


Affected upstream versions: < 2.15.2
Fixed upstream versions: v2.15.2
Upstream repository: https://github.com/cloudevents/sdk-go
Upstream fix commit: de2f28370b0d2a0f64f92c0c6139fa4b8a7c3851
CVE-2024-28175: argo-cd: XSS vulnerability in application summary component
Component: argo-cd
Severity: Important
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 8.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H)
Public date: 2024-03-13T00:00:00+00:00

A flaw was found in Argo CD. Due to improper filtering of URL protocols in the application summary component, a remote attacker can execute a cross-site scripting (XSS) attack with privileges to edit the application.


Affected upstream versions: >= 1.0.0, < 2.8.12, >= 2.9.0, < 2.9.8, >= 2.10.0, < 2.10.3
Fixed upstream versions: v2.11.0
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 479b5544b57dc9ef767d49f7003f39602c480b71
CVE-2024-28176: jose: resource exhaustion
Component: jose
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-03-09T00:00:00+00:00

Jose was found to have an uncontrolled resource consumption vulnerability. Under certain conditions, the user's environment can consume an unreasonable amount of CPU time or memory during JWE decryption operations, leading to a denial of service.


Affected upstream versions: >= 3.0.0, <= 4.15.4, < 2.0.7
Fixed upstream versions: v2.0.7
Upstream repository: https://github.com/panva/jose
Upstream fix commit: 02a65794f7873cdaf12e81e80ad076fcdc4a9314
CVE-2024-28180: jose-go: improper handling of highly compressed data
Component: jose-go
Severity: Moderate
CWE: CWE-409 (Improper Handling of Highly Compressed Data (Data Amplification))
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-03-09T00:00:00+00:00

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti.


Affected upstream versions: < 4.0.1, < 3.0.3, < 2.6.3
Fixed upstream versions: v2.6.3
Upstream repository: https://github.com/go-jose/go-jose
Upstream fix commit: 0dd4dd541c665fb292d664f77604ba694726f298
CVE-2024-28182: nghttp2: CONTINUATION frames DoS
Component: nghttp2
Severity: Moderate
CWE: CWE-390 (Detection of Error Condition Without Action)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-04-03T00:00:00+00:00

A vulnerability was found in how nghttp2 implements the HTTP/2 protocol. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated remote attacker to send packets to vulnerable servers, which could use up compute or memory resources to cause a Denial of Service.

Statement: Red Hat rates the security impact of this vulnerability as Moderate, in alignment with upstream nghttp2. The worst case scenario is excessive CPU utilization causing a denial of service. Once an attack has ended, the system should return to normal operations on its own.

Affected upstream versions: < 1.61.0
Fixed upstream versions: v1.61.0
Upstream repository: https://github.com/nghttp2/nghttp2
Upstream fix commit: 00201ecd8f982da3b67d4f6868af72a1b03b14e0
CVE-2024-28849: follow-redirects: Possible credential leak
Component: follow-redirects
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-03-14T00:00:00+00:00

A vulnerability was found in the follow-redirects package. While processing the cross-domain redirection, `follow-redirects` clears authorization headers, however, it misses clearing proxy-authentication headers, which contain credentials as well. This issue may lead to credential leaking, having a high impact on data confidentiality.


Affected upstream versions: < 1.15.6
Fixed upstream versions: v1.15.6
Upstream repository: https://github.com/follow-redirects/follow-redirects
Upstream fix commit: c4f847f85176991f95ab9c88af63b1294de8649b
CVE-2024-28863: node-tar: denial of service while parsing a tar file due to lack of folders depth validation
Component: node-tar
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2024-03-21T00:00:00+00:00

A flaw was found in ISAACS's node-tar, where it is vulnerable to a denial of service, caused by the lack of folder count validation. The vulnerability exists due to the application not properly controlling the consumption of internal resources while parsing a tar file. By sending a specially crafted request, a remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected upstream versions: < 6.2.1
Fixed upstream versions: v6.2.1
Upstream repository: https://github.com/isaacs/node-tar
Upstream fix commit: fe8cd57da5686f8695415414bda49206a545f7f7
CVE-2024-28869: traefik: denial of service
Component: traefik
Severity: Moderate
CWE: CWE-755 (Improper Handling of Exceptional Conditions)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-12T00:00:00+00:00

An improper handling of exceptional conditions vulnerability was found in Traefik. In affected versions, sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration, resulting in a denial of service.


Affected upstream versions: < 2.11.2, >= 3.0.0-rc1, < 3.0.0-rc5
Fixed upstream versions: v2.11.2
Upstream repository: https://github.com/traefik/traefik
Upstream fix commit: 240b83b77351dfd8cadb91c305b84e9d22e0f9c6
CVE-2024-29025: netty-codec-http: Allocation of Resources Without Limits or Throttling
Component: netty-codec-http
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-03-25T00:00:00+00:00

A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until it can decode a field, allowing data to accumulate without limits. This flaw allows an attacker to cause a denial of service by sending a chunked post consisting of many small fields that will be accumulated in the bodyListHttpData list.

Statement: The vulnerability in io.netty:netty-codec-http, allowing for Allocation of Resources Without Limits or Throttling issues, is assessed as moderate severity due to its potential impact on system availability and performance. By exploiting the flaw in HttpPostRequestDecoder, an attacker can craft chunked POST requests with numerous small fields, causing excessive accumulation of data in memory buffers. This unrestricted accumulation can lead to significant memory consumption on the server, potentially exhausting available resources and resulting in denial of service (DoS) conditions.

Affected upstream versions: < 4.1.108.Final
Fixed upstream versions: netty-4.1.108.Final
Upstream repository: https://github.com/netty/netty
Upstream fix commit: 0d0c6ed782d13d423586ad0c71737b2c7d02058c
CVE-2024-29041: express: cause malformed URLs to be evaluated
Component: express
Severity: Important
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2024-03-25T00:00:00+00:00

A flaw was found in the Express.js minimalist web framework for node. Upstream versions of Express.js before 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL, Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This issue can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()`, but this is also called from within `res.redirect()`. The vulnerability is fixed in upstream version 4.19.2 and 5.0.0-beta.3.

Statement: Red Hat Fuse 7 only uses express as part of build time development dependency, it is not part of the final product delivery.

Upstream versions should not be relied upon for ultimate determination of affectedness. Red Hat might backport fixes from upstream versions on a case by case basis.

Affected upstream versions: >=4.14.0, <4.19.0, >=5.0.0-alpha.1, <5.0.0-beta.3
Fixed upstream versions: 4.19.0
Upstream repository: https://github.com/expressjs/express
Upstream fix commit: 0867302ddbde0e9463d0564fea5861feb708c2dd
CVE-2024-29131: commons-configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
Component: commons-configuration
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
Public date: 2024-03-20T00:00:00+00:00

A vulnerability was found in Apache Commons-Configuration2, where a Stack Overflow Error can occur when adding a property in AbstractListDelimiterHandler.flattenIterator(). This issue could allow an attacker to corrupt memory or execute a denial of service attack by crafting malicious property that triggers an out-of-bounds write issue when processed by the vulnerable method.


Affected upstream versions: 2.0 < 2.10.1
Fixed upstream versions: 2.10.1
Upstream repository: https://github.com/apache/commons-configuration
Upstream fix commit: 56b5c4dcdffbde27870df5a3105d6a5f9b22f554
CVE-2024-29133: commons-configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree
Component: commons-configuration
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
Public date: 2024-03-20T00:00:00+00:00

A vulnerability was found in Apache Commons-Configuration2, where a Stack Overflow Error occurs when calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree. This issue could allow an attacker to trigger an out-of-bounds write that could lead to memory corruption or cause a denial of service condition.


Affected upstream versions: 2.0 < 2.10.1
Fixed upstream versions: 2.10.1
Upstream repository: https://github.com/apache/commons-configuration
Upstream fix commit: 43f4dab021e9acb8db390db2ae80aa0cee4f9ee4
CVE-2024-29156: YAQL: OpenStack Murano Component Information Leakage
Component: YAQL
Severity: Important
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-03-14T00:00:00+00:00

A flaw was found in the Murano component of OpenStack. This vulnerability allows ordinary users capable of importing and deploying app packages to access sensitive information within OpenStack services. Specifically, through this exploit, unauthorized users can obtain Murano service account credentials, potentially escalating their privileges to an administrator level. Subsequently, unauthorized users can gain complete control over various resources, including user roles, hosts, and networks. The exploit allows access to the Murano service's oslo configuration storage, thereby exposing critical Murano service account credentials, and granting unauthorized users administrative privileges.


Affected upstream versions: n/a
Fixed upstream versions: 3.0.0
Upstream repository: https://opendev.org/openstack/yaql
Upstream fix commit: 83e28324e1a0ce3970dd854393d2431123a909d3
CVE-2024-29180: webpack-dev-middleware: lack of URL validation may lead to file leak
Component: webpack-dev-middleware
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N)
Public date: 2024-03-21T00:00:00+00:00

A flaw was found in the webpack-dev-middleware package, where it failed to validate the supplied URL address sufficiently before returning local files. This flaw allows an attacker to craft URLs to return arbitrary local files from the developer's machine. The lack of normalization before calling the middleware also allows the attacker to perform path traversal attacks on the target environment.

Statement: The vulnerability in webpack-dev represents a important security issue due to its potential to expose sensitive files and compromise developer machines. By failing to validate URLs and normalize paths effectively, the middleware allows attackers to craft malicious requests that can retrieve arbitrary local files or perform unauthorized path traversal. This could lead to unauthorized access to confidential information, including source code, configuration files, and even system-level files. Given the widespread use of webpack-dev-middleware in web development environments, addressing this vulnerability promptly is important to prevent serious data breaches and protect the integrity of development processes.

Affected upstream versions: >= 7.0.0, < 7.1.0, >= 6.0.0, < 6.1.2, < 5.3.4
Fixed upstream versions: v5.3.4
Upstream repository: https://github.com/webpack/webpack-dev-middleware
Upstream fix commit: 189c4ac7d2344ec132a4689e74dc837ec5be0132
CVE-2024-29893: argo-cd: uncontrolled memory allocation vulnerability
Component: argo-cd
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-29T00:00:00+00:00

The ArgoCD repo-server component is vulnerable to a denial of service attack, where it is possible to crash the repo server component through an out-of-memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package does not limit the size or time while fetching the data. It fetches and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out.


Affected upstream versions: >= 2.4.0, < 2.8.14, >= 2.9.0, < 2.9.10, >= 2.10.0, < 2.10.5
Fixed upstream versions: v2.9.10
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 14f681e3ee7c38731943b98f92277e88a3db109d
CVE-2024-29902: cosign: Malicious attachments can cause system-wide denial of service
Component: cosign
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 4.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H)
Public date: 2024-04-10T00:00:00+00:00

A flaw was found in the Cosign package where a malicious attachment may trigger uncontrolled resource consumption by allocating too much memory. This flaw allows an attacker to craft a malicious attachment, resulting in a denial of service, possibly impacting other applications running on the same system.


Affected upstream versions: < 2.2.4
Fixed upstream versions: v2.2.4
Upstream repository: https://github.com/sigstore/cosign
Upstream fix commit: 629f5f8fa672973503edde75f84dcd984637629e