huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2020-8597: ppp: Buffer overflow in the eap_request and eap_response functions in eap.c
Component: ppp
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-02-03T00:00:00+00:00

A buffer overflow flaw was found in the ppp package in versions 2.4.2 through 2.4.8. The bounds check for the rhostname was improperly constructed in the EAP request and response functions which could allow a buffer overflow to occur. Data confidentiality and integrity, as well as system availability, are all at risk with this vulnerability.

Statement: The ppp packages distributed with Red Hat Enterprise Linux versions are compiled using gcc's stack-protector feature. The "Stack Smashing Protection" may help mitigate code execution attacks for this flaw and limit its impact to crash only.

Affected upstream versions: n/a
Fixed upstream versions: 2.4.9
Upstream repository: https://github.com/paulusmack/ppp
Upstream fix commit: 8d7970b8f3db727fe798b65f3377fe6787575426
CVE-2020-8608: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages
Component: QEMU
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2020-01-27T00:00:00+00:00

An out-of-bounds heap buffer access flaw was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in tcp_emu() routine while emulating IRC and other protocols due to unsafe usage of the snprintf(3) function. A user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.

Statement: This issue affects user-mode or SLiRP networking implementation of the QEMU emulator. Though qemu-kvm package is built with SLiRP networking support, due to its limitations, it is not used by the virtual machine guests by default.

This issue affects versions of the qemu-kvm package as shipped with Red Hat Enterprise Linux 5, 6, 7, 8 and Red Hat Enterprise Linux Advanced Virtualization 8. Future qemu-kvm package updates for Red Hat Enterprise Linux 6, 7, 8 and Red Hat Enterprise Linux Advanced Virtualization 8 may address this issue.

Red Hat Enterprise Linux 5 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This issue is currently not planned to be addressed in its future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat OpenStack Platform:                                                                                                                 
This flaw impacts KVM user-mode or SLIRP networking, which is not used in Red Hat OpenStack Platform. Although updating is recommended for affected versions (see below), Red Hat OpenStack Platform environments are not vulnerable.

Affected upstream versions: n/a
Fixed upstream versions: v4.2.0
Upstream repository: https://gitlab.freedesktop.org/slirp/libslirp
Upstream fix commit: 68ccb8021a838066f0951d4b2817eb6b6f10a843
CVE-2020-8908: guava: local information disclosure via temporary directory created with unsafe permissions
Component: guava
Severity: Low
CWE: CWE-379 (Creation of Temporary File in Directory with Insecure Permissions)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2020-09-08T00:00:00+00:00

A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure.

Statement: Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Important and Critical flaws.

Affected upstream versions: 1.0 < 32.0
Fixed upstream versions: 32.0
Upstream repository: https://github.com/google/guava
Upstream fix commit: fec0dbc4634006a6162cfd4d0d09c962073ddf40
CVE-2020-8945: proglottis/gpgme: Use-after-free in GPGME bindings during container image pull
Component: proglottis/gpgme
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2020-01-16T00:00:00+00:00

A use-after-free vulnerability was found in the Go GPGME wrapper library, github.com/proglottis/gpgme. An attacker could use this flaw to crash or cause potential code execution in Go applications that use this library, under certain conditions, during GPG signature verification.

Statement: OpenShift 3.11 consumes updates for podman from the RHEL-7 extras channel, hence why it has been marked as wontfix in this instance.

After extensive testing of the mentioned vulnerability Red Hat has chosen a severity of Moderate instead of High, because the deallocation of GPGME objects while other parts of code are still using it, the vulnerability can only result in a crash and cannot be used to execute code in any feasible manner, moreover the vulnerability only results in crash if finalizers are called to clean up variables while objects are still being used by the underlying C code. Given the inherent attack complexity being high and the exploitability of the vulnerability limited to a crash, Moderate severity seems adequate.

Affected upstream versions: n/a
Fixed upstream versions: v5.2.0
Upstream repository: https://github.com/containers/image
Upstream fix commit: 4c7a23f82ef09127b0ff28366d1cf31316dd6cc1
CVE-2020-9359: okular: local binary execution via specially crafted PDF files
Component: okular
Severity: Moderate
CWE: CWE-184 (Incomplete List of Disallowed Inputs)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2020-03-12T00:00:00+00:00

KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.


Affected upstream versions: n/a
Fixed upstream versions: v20.03.80
Upstream repository: https://invent.kde.org/kde/okular
Upstream fix commit: 6a93a033b4f9248b3cd4d04689b8391df754e244
CVE-2020-9383: kernel: out-of-bounds read in set_fdc in drivers/block/floppy.c
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2020-02-21T00:00:00+00:00

An out-of-bounds (OOB) memory access flaw was found in the floppy driver module in the Linux kernel. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2e90ca68b0d2f5548804f22f0dd61145516171e3
CVE-2021-0920: kernel: Use After Free in unix_gc() which could result in a local privilege escalation
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-07-28T00:00:00+00:00

A vulnerability was found in unix_dgram_recvmsg in net/unix/af_unix.c in the Linux kernel's garbage collection for Unix domain socket file handlers.  In this flaw, a missing cleanup may lead to a use-after-free due to a race problem. This flaw allows a local user to crash the system or escalate their privileges on the system.

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system.


Affected upstream versions: Android kernel
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: cbcf01128d0a92e131bd09f1688fe032480b65ca
CVE-2021-20230: stunnel: client certificate not correctly verified when redirect and verifyChain options are used
Component: stunnel
Severity: Important
CWE: CWE-295 (Improper Certificate Validation)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2020-10-11T00:00:00+00:00

A flaw was found in stunnel, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.

Statement: This issue did not affect the versions of stunnel as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they did not include support for the "redirect" option.

Affected upstream versions: stunnel 5.57
Fixed upstream versions: stunnel-5.57
Upstream repository: https://github.com/mtrojnar/stunnel
Upstream fix commit: ebad9ddc4efb2635f37174c9d800d06206f1edf9
CVE-2021-20257: QEMU: net: e1000: infinite loop while processing transmit descriptors
Component: QEMU
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 3.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L)
Public date: 2021-02-10T00:00:00+00:00

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Statement: This issue affects the version of the qemu-kvm package shipped with Red Hat Enterprise Linux 6, 7 and 8. Future qemu-kvm package updates for Red Hat Enterprise Linux 7 and 8 may address this issue.

This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 5 and 6. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: Fixed-In v6.2.0
Fixed upstream versions: v6.0.0
Upstream repository: https://github.com/qemu/qemu
Upstream fix commit: 3de46e6fc489c52c9431a8a832ad8170a7569bd8
CVE-2021-20265: kernel: increase slab leak leads to DoS
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-01-24T00:00:00+00:00

A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by exhausting available memory. The highest threat from this vulnerability is to system availability.


Affected upstream versions: Linux kernel 4.5-rc3
Fixed upstream versions: v4.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: fa0dc04df259ba2df3ce1920e9690c7842f8fa4b
CVE-2021-20271: rpm: Signature checks bypass via corrupted rpm package
Component: rpm
Severity: Moderate
CWE: CWE-345 (Insufficient Verification of Data Authenticity)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-03-11T22:53:00+00:00

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

Statement: To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM.  It is strongly recommended to only use RPMs from trusted repositories.

Affected upstream versions: all versions
Fixed upstream versions: rpm-4.17.0-release
Upstream repository: https://github.com/rpm-software-management/rpm
Upstream fix commit: d6a86b5e69e46cc283b1e06c92343319beb42e21
CVE-2021-20317: kernel: timer tree corruption leads to missing wakeup and system freeze
Component: kernel
Severity: Moderate
CWE: CWE-665 (Improper Initialization)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-09-23T16:20:00+00:00

A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the system while running OSP. The highest threat from this vulnerability is system availability.


Affected upstream versions: Kernel 5.3 rc1
Fixed upstream versions: v5.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
Upstream fix commit: 511885d7061eda3eb1faf3f57dcc936ff75863f1
CVE-2021-20319: coreos-installer: incorrect signature verification on gzip-compressed install images
Component: coreos-installer
Severity: Moderate
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-10-07T00:00:00+00:00

An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.

Statement: This vulnerability impacts only a specific User-Provisioned Infrastructure (UPI) installation flow where coreos-installer is used and when gzip-compressed images are configured as the installation source. 

Because this flow does not occur in default usage, Red Hat considers this case as a Moderate impact flaw.

Affected upstream versions: Affects coreos-installer before v0.10.1, Fixed in v0.10.1.
Fixed upstream versions: v0.10.1
Upstream repository: https://github.com/coreos/coreos-installer
Upstream fix commit: ad243c6f0eff2835b2da56ca5f7f33af76253c89
CVE-2021-20322: kernel: new DNS Cache Poisoning Attack based on ICMP fragment needed packets replies
Component: kernel
Severity: Moderate
CWE: CWE-330 (Use of Insufficiently Random Values)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2021-08-26T08:00:00+00:00

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.

Statement: This issue is rated as having Moderate impact because of the attack scenario limitation. It is possible to harm the networking services only, but not for the overall system under attack, and impossible to get access to this remote system under attack.

Affected upstream versions: kernel 5.15-rc1
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 4785305c05b25a242e5314cc821f54ade4c18810
CVE-2021-21240: python-httplib2: Regular expression denial of service via malicious header
Component: python-httplib2
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-01-09T00:00:00+00:00

An uncontrolled resource consumption flaw as found in python-httplib2, due to a flawed regular expression used while parsing the WWW-Authenticate header in an HTTP response. This flaw allows a malicious or compromised server to reply with a crafted sequence of characters in the WWW-Authenticate header, leading to a denial of service of the httplib2 client accessing the server. The highest threat from this vulnerability is to system availability.

Statement: This flaw has been rated as having a security impact of Low, because it requires a malicious or compromised server in order to be exploited, and it only affects the HTTP client. In Red Hat OpenStack Platform 13, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP 13 python-httplib2 package.

Affected upstream versions: < 0.19.0
Fixed upstream versions: v0.19.0
Upstream repository: https://github.com/httplib2/httplib2
Upstream fix commit: bd9ee252c8f099608019709e22c0d705e98d26bc
CVE-2021-21261: flatpak: sandbox escape via spawn portal
Component: flatpak
Severity: Important
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2021-01-14T00:00:00+00:00

A flaw was found in Flatpak. The Flatpak portal D-Bus service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is outside the sandbox. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: >= 0.11.4, < 1.8.5, >= 1.9.0, < 1.10.0
Fixed upstream versions: 1.10.0
Upstream repository: https://github.com/flatpak/flatpak
Upstream fix commit: 6d1773d2a54dde9b099043f07a2094a4f1c2f486
CVE-2021-21290: netty: Information disclosure via the local system temporary directory
Component: netty
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-02-09T00:00:00+00:00

In Netty there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used, a local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure.


Affected upstream versions: < 4.1.59.Final
Fixed upstream versions: netty-4.1.59.Final
Upstream repository: https://github.com/netty/netty
Upstream fix commit: c735357bf29d07856ad171c6611a2e1a0e0000ec
CVE-2021-21295: netty: possible request smuggling in HTTP/2 due missing validation
Component: netty
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2021-03-09T00:00:00+00:00

In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling.

Statement: Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Important and Critical flaws.

Affected upstream versions: < 4.1.60.Final
Fixed upstream versions: netty-4.1.60.Final
Upstream repository: https://github.com/netty/netty
Upstream fix commit: 89c241e3b1795ff257af4ad6eadc616cb2fb3dc4
CVE-2021-21330: python-aiohttp: Open redirect in aiohttp.web_middlewares.normalize_path_middleware
Component: python-aiohttp
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)
Public date: 2021-02-25T00:00:00+00:00

An open redirect flaw was found in python-aiohttp. This flaw allows a remote, unauthenticated attacker to trick users into visiting a malicious webpage, disguised as a legitimate webpage and affects applications using the normalize_path_middleware functionality. The highest threat from this vulnerability is to confidentiality and integrity.

Statement: Red Hat Satellite version 6.7 onward (mostly pulp part) does ship an affected version of aiohttp, however, is not vulnerable since the product code does not use the normalize_path_middleware function, which the attacker may use for an attack. We may update the python-aiohttp dependency in a future release.

Affected upstream versions: < 3.7.4
Upstream repository: https://github.com/aio-libs/aiohttp
Upstream fix commit: 2545222a3853e31ace15d87ae0e2effb7da0c96b
CVE-2021-21381: flatpak: "file forwarding" feature can be used to gain unprivileged access to files
Component: flatpak
Severity: Important
CWE: CWE-284 (Improper Access Control)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2021-03-09T00:00:00+00:00

A sandbox escape flaw was found in the way flatpak handled special tokens in ".desktop" files. This flaw allows an attacker to gain access to files that are not ordinarily allowed by the app's permissions. The highest threat from this vulnerability is to confidentiality and integrity.

Statement: This is essentially a sandbox escape flaw and needs a malicious app publisher to execute the exploit.

Affected upstream versions: >= 0.9.4, < 1.10.2
Fixed upstream versions: 1.10.2
Upstream repository: https://github.com/flatpak/flatpak
Upstream fix commit: 8279c5818425b6812523e3805bbe242fb6a5d961
CVE-2021-21409: netty: Request smuggling via content-length header
Component: netty
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2021-03-30T00:00:00+00:00

A flaw was found in Netty. There is an issue where the content-length header is not validated correctly if the request uses a single Http2HeaderFrame with the endstream set to true. This flaw leads to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. The highest threat from this vulnerability is to integrity.

Statement: Red Hat Satellite ships a vulnerable Netty version embedded in Candlepin. However, it is not directly vulnerable since the HTTP requests are handled by Tomcat and not by Netty.
Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Important and Critical flaws.

In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec-http package.
Since the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.
This may be fixed in the future.

Affected upstream versions: < 4.1.61.Final
Fixed upstream versions: netty-4.1.61.Final
Upstream repository: https://github.com/netty/netty
Upstream fix commit: b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432