huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-40029: ArgoCD: secrets can be leak through kubectl.kubernetes.io/last-applied-configuration
Component: ArgoCD
Severity: Critical
CVSS v3: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L)
Public date: 2023-09-05T00:00:00+00:00

A flaw was found in the ArgoCD package, used by Red Hat GitOps, that allows cluster secrets to be managed declaratively using the `kubectl apply` functionality, resulting in the full secret body being stored in `kubectl.kubernetes.io/last-applied-configuration` annotation. Since ArgoCD has included the ability to manage cluster labels and annotations via its API, an attacker can retrieve sensitive authentication information by leveraging this capability, imposing a high impact on data confidentiality and integrity for the targeted ArgoCD cluster. To perform a successful attack, the malicious actor should have `clusters, get` RBAC access granted to its user.


Affected upstream versions: >= 2.2.0, < 2.6.15, >= 2.7.0, < 2.7.14, >= 2.8.0, < 2.8.3
Fixed upstream versions: v2.9.0
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 4b2e5b06bff2ffd8ed1970654ddd8e55fc4a41c4
CVE-2023-4015: kernel: use after free in nft_immediate_deactivate
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-09-06T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's netfilter: nf_tables component, which can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can unbind the chain and objects can be deactivated but used later.

Statement: Exploiting this flaw will require CAP_NET_ADMIN access privilege in any user or network namespace and on non-containerized deployments of Red Hat Enterprise Linux, you can disable user namespaces by setting user.max_user_namespaces to 0:
~~~
 echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf
 sysctl -p /etc/sysctl.d/userns.conf
~~~
On containerized deployments such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.

Affected upstream versions: 6.4 < 6.5
Fixed upstream versions: 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0a771f7b266b02d262900c75f1e175c7fe76fec2
CVE-2023-4016: procps: ps buffer overflow
Component: procps
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2023-08-02T00:00:00+00:00

A heap-based buffer overflow vulnerability was found in the procps project when handling untrusted input with the -C option. This issue may allow a user with "ps" utility access to write unfiltered data into the process heap, triggering an out-of-bounds write, consuming memory and causing a crash, resulting in a denial of service.

Statement: The affected package is procps, the command line utility known as “ps” used to understand the current state of any running processes.  On 32 bit systems it is possible to use specific parameters with the -C option to trigger more memory allocation than should be allowed. As this outcome is restricted to local authenticated users, a malicious user in this situation has far more powerful tools at their disposal to bring down the server, for example by simply turning it off. For this reason Red Hat Product Security rates the impact as Low.

Affected upstream versions: 3.3.0 (might be earlier) - latest
Fixed upstream versions: v4.0.4
Upstream repository: https://gitlab.com/procps-ng/procps
Upstream fix commit: 2c933ecba3bb1d3041a5a7a53a7b4078a6003413
CVE-2023-40175: rubygem-puma: HTTP request smuggling when parsing chunked transfer encoding bodies and zero-length content-length headers
Component: rubygem-puma
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2023-08-18T00:00:00+00:00

An HTTP request smuggling attack vulnerability was found in Rubygem Puma. This flaw allows an attacker to gain unauthorized access to sensitive data due to an inconsistent interpretation of HTTP requests.


Affected upstream versions: < 5.6.7, >= 6.0.0, < 6.3.1
Fixed upstream versions: v6.4.0
Upstream repository: https://github.com/puma/puma
Upstream fix commit: 690155e7d644b80eeef0a6094f9826ee41f1080a
CVE-2023-40225: haproxy: Proxy forwards malformed empty Content-Length headers
Component: haproxy
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2023-08-10T00:00:00+00:00

A flaw was found in HAProxy. Empty Content-Length headers are forwarded, which could cause an HTTP/1 server behind it to interpret the payload as an extra request. This may render the HTTP/1 server vulnerable to attacks in some uncommon cases.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.0
Upstream repository: https://github.com/haproxy/haproxy
Upstream fix commit: 6492f1f29d738457ea9f382aca54537f35f9d856
CVE-2023-40267: GitPython: Insecure non-multi options in clone and clone_from is not blocked
Component: GitPython
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-08-11T00:00:00+00:00

An improper input validation vulnerability was found in GitPython. This flaw allows an attacker to inject a maliciously crafted remote URL into the clone command, possibly leading to remote code execution.

Statement: In Red Hat Openstack, Red Hat Ansible Automation Platform, and Red Hat Certification Program, while the gitpython dependency is present, the affected codebase is not being used. 

Red Hat Satellite does not use the affected functions during runtime, therefore the possible impact is limited to Moderate.

Affected upstream versions: n/a
Fixed upstream versions: 3.1.32
Upstream repository: https://github.com/gitpython-developers/GitPython
Upstream fix commit: ca965ecc81853bca7675261729143f54e5bf4cdd
CVE-2023-40283: kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-08-14T00:00:00+00:00

A flaw was found in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Bluetooth subsystem in the Linux Kernel. This issue may allow a user to cause a use-after-free problem due to sk's children being mishandled.


Affected upstream versions: n/a
Fixed upstream versions: v6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1
CVE-2023-40584: ArgoCD: Denial of Service to Argo CD repo-server
Component: ArgoCD
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-09-05T00:00:00+00:00

A flaw was found in ArgoCD, where it failed to properly validate the user-controlled tar.gz file uploaded to the repo-server component. As a result, a maliciously crafted tar.gz file sent by a low-privileged user may result in resource starvation and further denial of service of the ArgoCD server. Additionally, the lack of permissions checking for the inner files in the tar.gz file may lead to an attacker creating files that cannot be further deleted from the server.


Affected upstream versions: >= 2.4.0, < 2.6.15, >= 2.7.0, < 2.7.14, >= 2.8.0, < 2.8.3
Fixed upstream versions: v2.9.0
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: b8f92c4ff226346624f43de3f25d81dac6386674
CVE-2023-40589: freerdp: buffer overflow in ncrush_decompress causes crash with crafted input
Component: freerdp
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-08-31T00:00:00+00:00

A flaw was found in the FreeRDP implementation. Feeding crafted input into the ncrush_decompress function may cause a buffer overflow, resulting in a crash.


Affected upstream versions: < 2.11.0, >= 3.0.0-beta1, < 3.0.0-beta3
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 16141a30f983dd6f7a6e5b0356084171942c9416
CVE-2023-41040: GitPython: Blind local file inclusion
Component: GitPython
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2023-08-31T00:00:00+00:00

A path traversal vulnerability was found in GitPython due to an input validation error when reading from the ".git" directory. This issue may allow a remote attacker to prepare a specially crafted ".git" file with directory traversal characters in file names and force the application to read these files from the local system, which can result in checking for the existence of a specific file on the system or allow a denial of service (DoS) attack.

Statement: This vulnerability cannot be used to read the contents of files but could be used to trigger a denial of service for the program.

Affected upstream versions: < 3.1.37
Fixed upstream versions: 3.1.35
Upstream repository: https://github.com/gitpython-developers/GitPython
Upstream fix commit: 74e55ee4544867e1bd976b7df5a45869ee397b0b
CVE-2023-41053: redis: Redis SORT_RO may bypass ACL configuration
Component: redis
Severity: Low
CWE: CWE-269 (Improper Privilege Management)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2023-09-06T00:00:00+00:00

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Affected upstream versions: >= 7.0.0, < 7.0.13, >= 7.1.0, < 7.2.1
Fixed upstream versions: 7.2.1
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 9e505e6cd842338424e05883521ca1fb7d0f47f6
CVE-2023-41419: python-gevent: privilege escalation via a crafted script to the WSGIServer component
Component: python-gevent
Severity: Important
CWE: CWE-269 (Improper Privilege Management)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2023-08-31T00:00:00+00:00

A flaw was found in python-event, which could allow a remote attacker to gain elevated privileges on the system, caused by a flaw in the WSGIServer component. By using a specially crafted script, an attacker can gain elevated privileges.


Affected upstream versions: n/a
Fixed upstream versions: 23.9.0
Upstream repository: https://github.com/gevent/gevent
Upstream fix commit: 2f53c851eaf926767fbac62385615efd4886221c
CVE-2023-4147: kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-07-23T10:30:00+00:00

A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.


Affected upstream versions: <= v6.4
Fixed upstream versions: 0:5.14.0-284.30.1.el9_2, 0:5.14.0-284.30.1.rt14.315.el9_2, 0:5.14.0-70.80.1.el9_0, 0:5.14.0-70.80.1.rt21.151.el9_0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0ebc1064e4874d5987722a2ddbc18f94aa53b211
CVE-2023-41909: frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c
Component: frr
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-09-05T00:00:00+00:00

A flaw was found in frr. Processing a malformed request with no attributes may cause a NULL pointer dereference, resulting in a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: frr-9.0
Upstream repository: https://github.com/FRRouting/frr
Upstream fix commit: cfd04dcb3e689754a72507d086ba3b9709fc5ed8
CVE-2023-41910: lldpd: CDP PDU Packet cdp.c out-of-bounds read
Component: lldpd
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-09-05T00:00:00+00:00

A flaw was found in lldpd due to an out-of-bounds read in cdp_decode at daemon/protocols/cdp.c. By sending a specially crafted CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a remote attacker could cause a denial of service.

Statement: The highest threat from this vulnerability is system availability.

Affected upstream versions: n/a
Fixed upstream versions: 1.0.17
Upstream repository: https://github.com/lldpd/lldpd
Upstream fix commit: a9aeabdf879c25c584852a0bb5523837632f099b
CVE-2023-4206: kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-07-29T00:00:00+00:00

There are 3 CVEs for the use-after-free flaw found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. 
A local user could use any of these flaws to crash the system or potentially escalate their privileges on the system.

Similar CVE-2023-4128 was rejected as a duplicate.


Affected upstream versions: 3.18 < 6.5
Fixed upstream versions: 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81
CVE-2023-4207: kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-07-29T00:00:00+00:00

There are 3 CVEs for the use-after-free flaw found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. 
A local user could use any of these flaws to crash the system or potentially escalate their privileges on the system.

Similar CVE-2023-4128 was rejected as a duplicate.


Affected upstream versions: 3.18 < 6.5
Fixed upstream versions: 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81
CVE-2023-4208: kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-07-29T00:00:00+00:00

There are 3 CVEs for the use-after-free flaw found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. 
A local user could use any of these flaws to crash the system or potentially escalate their privileges on the system.

Similar CVE-2023-4128 was rejected as a duplicate.


Affected upstream versions: 3.18 < 6.5
Fixed upstream versions: 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81
CVE-2023-42282: nodejs-ip: arbitrary code execution via the isPublic() function
Component: nodejs-ip
Severity: Important
CWE: CWE-918 (Server-Side Request Forgery (SSRF))
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-02-08T00:00:00+00:00

A vulnerability was found in the NPM IP Package. This flaw allows an attacker to perform arbitrary code execution and obtain sensitive information via the isPublic() function by inducing a Server-Side Request Forgery (SSRF) attack and obtaining access to normally inaccessible resources.

Statement: It appears that npm does not utilize the bundled code therefore Red Hat Enterprise Linux is not affected by this vulnerability.

While the vulnerability in the NPM IP Package presents a significant security concern, it's categorized as important rather than critical due to several factors. Firstly, the misclassification of the private IP address 0x7f.1 as public by the isPublic() function does not directly lead to remote code execution or unauthorized access to critical systems. Instead, it facilitates SSRF attacks, which typically require additional conditions to fully exploit, such as the ability to influence server-side requests and responses. Additionally, the impact of SSRF attacks can vary depending on the specific environment and configuration of the affected system. While SSRF attacks can potentially lead to data exposure, service disruption, or lateral movement within a network, their severity is often mitigated by factors such as network segmentation, access controls, and the availability of sensitive resources.

Red Hat Developer Hub contains a fix in 1.1-91 version.

Affected upstream versions: n/a
Fixed upstream versions: v1.1.9
Upstream repository: https://github.com/indutny/node-ip
Upstream fix commit: 6a3ada9b471b09d5f0f5be264911ab564bf67894
CVE-2023-4244: kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-08-28T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s nftables sub-component due to a race problem between the set GC and transaction in the Linux Kernel. This flaw allows a local attacker to crash the system due to a missing call to `nft_set_elem_mark_busy`, causing double deactivation of the element and possibly leading to a kernel information leak problem.

Statement: Exploiting this flaw will require CAP_NET_ADMIN access privilege in any user or network namespace.

And,

On non-containerized deployments of Red Hat Enterprise Linux, you can disable user namespaces by setting user.max_user_namespaces to 0:

$ echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf
$ sysctl -p /etc/sysctl.d/userns.conf

On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.

Affected upstream versions: 0.0 < 4.19.316, 4.20 < 5.4.262, 5.5 < 5.10.198, 5.11 < 5.15.134, 5.16 < 6.1.56, 6.2 < 6.4.11
Fixed upstream versions: 4.19.316, 5.10.198, 5.15.134, 5.4.262, 6.1.56, 6.4.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3e91b0ebd994635df2346353322ac51ce84ce6d8
CVE-2023-42465: sudo: Targeted Corruption of Register and Stack Variables
Component: sudo
Severity: Moderate
CWE: CWE-1319 (Improper Protection against Electromagnetic Fault Injection (EM-FI))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-09-05T00:00:00+00:00

A flaw was found in the sudo package. This issue could allow a local authenticated attacker to cause a bit to flip, which enables fault injection and may authenticate as the root user.

Statement: "Mayhem" is a potent attack technique that focuses on the core components of computing systems, specifically the CPU internals and stack variables. This method signifies a noteworthy advancement in cyber threats, demonstrating a successful ability to tamper with a computer's memory and compromise both stack and register variables. Capitalizing on the well-known Rowhammer effect, wherein swift access to a DRAM row induces bit flips in neighboring rows, this clever attack exploits these bit flips to disrupt stack variables and manipulate register values within a given process. The manipulation is accomplished by targeting register values stored in the process's stack, which, once flushed out to memory, become vulnerable to Rowhammer attacks. When reloaded, these corrupted values cause chaos, compromising the integrity of the entire process. It's important to note that this attack is confined to the local system, leading us to categorize it as a moderate threat.

Affected upstream versions: n/a
Fixed upstream versions: v1.9.15
Upstream repository: https://github.com/sudo-project/sudo
Upstream fix commit: 7873f8334c8d31031f8cfa83bd97ac6029309e4f
CVE-2023-42467: QEMU: am53c974: denial of service due to division by zero
Component: QEMU
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 2.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)
Public date: 2023-09-11T00:00:00+00:00

A denial of service vulnerability was found in the qemu package. A division by zero in the scsi_disk_reset function can cause QEMU and the guest to stop immediately.

Statement: Triggering this bug requires kernel or root privileges in the guest VM because it requires direct hardware access. Anyone who has these privileges could also just perform a regular shutdown of the VM, with only a very slightly different result.

Affected upstream versions: n/a
Fixed upstream versions: v8.2.0
Upstream repository: https://gitlab.com/qemu-project/qemu
Upstream fix commit: 7cfcc79b0ab800959716738aff9419f53fc68c9c
CVE-2023-43115: Ghostscript: GhostPDL can lead to remote code execution via crafted PostScript documents
Component: Ghostscript
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2023-09-18T00:00:00+00:00

A vulnerability was found in Artifex Ghostscript in gdevijs.c, allows a malicious remote attacker to perform remote code execution via crafted PostScript documents.


Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-10.03.0
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: e59216049cac290fb437a04c4f41ea46826cfba5
CVE-2023-43642: snappy-java: Missing upper bound check on chunk length in snappy-java can lead to Denial of Service (DoS) impact
Component: snappy-java
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-09-26T00:00:00+00:00

A flaw was found in SnappyInputStream in snappy-java, a data compression library in Java. This issue occurs when decompressing data with a too-large chunk size due to a missing upper bound check on chunk length. An unrecoverable fatal error can occur, resulting in a Denial of Service (DoS).


Affected upstream versions: < 1.1.10.4
Fixed upstream versions: v1.1.10.4
Upstream repository: https://github.com/xerial/snappy-java
Upstream fix commit: 9f8c3cf74223ed0a8a834134be9c917b9f10ceb5
CVE-2023-43646: get-func-name: ReDoS in chai module
Component: get-func-name
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-09-27T00:00:00+00:00

A vulnerability was found in the get-func-name package in the chai module. Affected versions of this package are vulnerable to Regular expression denial of service (ReDoS) attacks, affecting system availability.

Statement: - This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\t'.repeat(54773) + '\t/function/i'

-  The get-func-name package is a build-time dependency in Red Hat products, which reduces the chance of successful exploitation. Hence, the impact is set to Moderate.

Affected upstream versions: < 2.0.1
Fixed upstream versions: v2.0.1
Upstream repository: https://github.com/chaijs/get-func-name
Upstream fix commit: f934b228b5e2cb94d6c8576d3aac05493f667c69