huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-29903: cosign: Malicious artifects can cause machine-wide denial of service
Component: cosign
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 4.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H)
Public date: 2024-04-10T00:00:00+00:00

A flaw was found in the Cosign package where maliciously crafted software artifacts can trigger uncontrolled resource consumption by allocating too much memory and starving out the system. A successful attack may result in a denial of service of the machine running Cosign, impacting availability.

Statement: This vulnerability results only in a Denial-of-Service (DoS) against the Cosign service. Additionally, exploitation requires that the service is configured to accept artifacts from untrusted sources. Consequently, Red Hat's assessment indicates the security impact of this vulnerability is Moderate.

Affected upstream versions: < 2.2.4
Fixed upstream versions: v2.2.4
Upstream repository: https://github.com/sigstore/cosign
Upstream fix commit: 629f5f8fa672973503edde75f84dcd984637629e
CVE-2024-30203: emacs: Gnus treats inline MIME contents as trusted
Component: emacs
Severity: Moderate
CWE: CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2024-03-25T00:00:00+00:00

A flaw was found in Emacs. When Emacs is used as an email client, inline MIME attachments are considered to be trusted by default, allowing a crafted LaTeX document to exhaust the disk space or the inodes allocated for the partition where the /tmp directory is located. This issue possibly results in a denial of service.

Statement: This issue is very similar to CVE-2024-30204. See https://access.redhat.com/security/cve/CVE-2024-30204.

Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/emacs.git
Upstream fix commit: 937b9042ad7426acdcca33e3d931d8f495bdd804
CVE-2024-30204: emacs: LaTeX preview is enabled by default for e-mail attachments
Component: emacs
Severity: Moderate
CWE: CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2024-03-25T00:00:00+00:00

A flaw was found in Emacs. When Emacs is used as an email client, a preview of a crafted LaTeX document attached to an email can exhaust the disk space or the inodes allocated for the partition where the /tmp directory is located. This issue possibly results in a denial of service.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/emacs.git
Upstream fix commit: 6f9ea396f49cbe38c2173e0a72ba6af3e03b271c
CVE-2024-30205: emacs: Org mode considers contents of remote files to be trusted
Component: emacs
Severity: Moderate
CWE: CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-03-25T00:00:00+00:00

A flaw was found in Emacs. Org mode considers the content of remote files, such as files opened with TRAMP on remote systems, to be trusted, resulting in arbitrary code execution.

Statement: To exploit this flaw, an attacker needs to trick a user into opening a crafted Org mode file from a remote system. For this reason, this flaw has been rated with a Moderate security impact.

Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/emacs/org-mode.git
Upstream fix commit: 4255d5dcc0657915f90e4fba7e0a5514cced514d
CVE-2024-30251: aiohttp: DoS when trying to parse malformed POST requests
Component: aiohttp
Severity: Important
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-02T00:00:00+00:00

An infinite loop flaw was found in aiohttp when handling POST (multipart/form-data) requests. This flaw allows an attacker to send a specially crafted request, leading the server to enter an infinite loop and render it unable to process any further requests. This denial of service can be triggered by a single unauthenticated POST request.

AIOHTTP handles multipart strings through a process of segmenting them into chunks. The reading of each chunk is performed under the control of an asynchronous wait, ensuring that the operation completes before proceeding. A vulnerability was identified where a specially crafted request could trigger an infinite loop due to improper detection of the end-of-file (EOF) marker within the content.

The resolution involves the implementation of an enhanced checking mechanism. This mechanism correctly assigns the EOF marker to the chunk in question upon the successful completion of content reading, thereby preventing the infinite loop scenario.

Statement: Red Hat rates the security impact of this vulnerability as Important due to the worst case scenario resulting in a denial of service. It is simple to exploit and could significantly impact availability. In order to exploit the bug, the attacker has to send a specially crafted POST request causing the server to go into an infinite loop.

Red Hat Satellite has set a moderate impact of this issue as invalid requests which could trigger this bug such as no authentication or wrong path are unlikely possible or going to happen.

Affected upstream versions: < 3.9.4
Fixed upstream versions: v3.9.5
Upstream repository: https://github.com/aio-libs/aiohttp
Upstream fix commit: 7eecdff163ccf029fbb1ddc9de4169d4aaeb6597
CVE-2024-30260: nodejs-undici: proxy-authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
Component: nodejs-undici
Severity: Low
CWE: CWE-285 (Improper Authorization)
CVSS v3: 3.9 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L)
Public date: 2024-04-04T00:00:00+00:00

A flaw was found in the nodejs-undici package. Proxy-Authorization headers are not cleared on cross-origin redirects, which can allow for the exposure of sensitive data or allow an attacker to capture the persistent proxy-authentication header.


Affected upstream versions: < 5.28.4, >= 6.0.0, < 6.11.1
Fixed upstream versions: v5.28.4
Upstream repository: https://github.com/nodejs/undici
Upstream fix commit: 64e3402da4e032e68de46acb52800c9a06aaea3f
CVE-2024-30261: nodejs-undici: fetch() with integrity option is too lax when algorithm is specified but hash value is in incorrect
Component: nodejs-undici
Severity: Low
CWE: CWE-284 (Improper Access Control)
CVSS v3: 2.6 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N)
Public date: 2024-04-04T00:00:00+00:00

A flaw was found in the nodejs-undici package. This issue may allow an attacker to alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered with.


Affected upstream versions: >= 6.0.0, < 6.11.1, < 5.28.4
Fixed upstream versions: v5.28.4
Upstream repository: https://github.com/nodejs/undici
Upstream fix commit: 2b39440bd9ded841c93dd72138f3b1763ae26055
CVE-2024-31076: kernel: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L)
Public date: 2024-06-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline

The absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of
interrupt affinity reconfiguration via procfs. Instead, the change is
deferred until the next instance of the interrupt being triggered on the
original CPU.

When the interrupt next triggers on the original CPU, the new affinity is
enforced within __irq_move_irq(). A vector is allocated from the new CPU,
but the old vector on the original CPU remains and is not immediately
reclaimed. Instead, apicd->move_in_progress is flagged, and the reclaiming
process is delayed until the next trigger of the interrupt on the new CPU.

Upon the subsequent triggering of the interrupt on the new CPU,
irq_complete_move() adds a task to the old CPU's vector_cleanup list if it
remains online. Subsequently, the timer on the old CPU iterates over its
vector_cleanup list, reclaiming old vectors.

However, a rare scenario arises if the old CPU is outgoing before the
interrupt triggers again on the new CPU.

In that case irq_force_complete_move() is not invoked on the outgoing CPU
to reclaim the old apicd->prev_vector because the interrupt isn't currently
affine to the outgoing CPU, and irq_needs_fixup() returns false. Even
though __vector_schedule_cleanup() is later called on the new CPU, it
doesn't reclaim apicd->prev_vector; instead, it simply resets both
apicd->move_in_progress and apicd->prev_vector to 0.

As a result, the vector remains unreclaimed in vector_matrix, leading to a
CPU vector leak.

To address this issue, move the invocation of irq_force_complete_move()
before the irq_needs_fixup() call to reclaim apicd->prev_vector, if the
interrupt is currently or used to be affine to the outgoing CPU.

Additionally, reclaim the vector in __vector_schedule_cleanup() as well,
following a warning message, although theoretically it should never see
apicd->move_in_progress with apicd->prev_cpu pointing to an offline CPU.


Affected upstream versions: 4.13
Fixed upstream versions: 0, 4.19.316, 5.10.219, 5.15.161, 5.4.278, 6.1.93, 6.10, 6.6.33, 6.9.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a40209d355afe4ed6d533507838c9e5cd70a76d8
CVE-2024-31227: redis: Denial-of-service due to malformed ACL selectors in Redis
Component: redis
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-07T19:51:04.520000+00:00

A flaw was found in Redis. This flaw allows an authenticated attacker with sufficient privileges to create a malformed ACL selector that triggers a server panic and subsequent denial of service when accessed.


Affected upstream versions: >= 7.0.0, < 7.2.6, >= 7.3.0, < 7.4.1
Fixed upstream versions: 7.2.6
Upstream repository: https://github.com/redis/redis
Upstream fix commit: b351d5a3210e61cc3b22ba38a723d6da8f3c298a
CVE-2024-31228: redis: Denial-of-service due to unbounded pattern matching in Redis
Component: redis
Severity: Moderate
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-07T19:51:06.784000+00:00

A flaw was found in Redis. This flaw allows authenticated users to trigger a denial of service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST`, and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crashes.


Affected upstream versions: >= 2.2.5, < 6.2.16, >= 7.0.0, < 7.2.6, >= 7.3.0, < 7.4.1
Fixed upstream versions: 6.2.16
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 9317bf64659b33166a943ec03d5d9b954e86afb0
CVE-2024-31449: redis: Lua library commands may lead to stack overflow and RCE in Redis
Component: redis
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-10-07T19:51:08.775000+00:00

A flaw was found in Redis. This flaw allows an authenticated user to use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may lead to remote code execution. The problem exists in all versions of Redis with Lua scripting.


Affected upstream versions: >= 2.6, < 6.2.16, >= 7.0.0, < 7.2.6, >= 7.3.0, < 7.4.1
Fixed upstream versions: 6.2.16
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 1f7c148be2cbacf7d50aa461c58b871e87cc5ed9
CVE-2024-31463: ironic-image: Unauthenticated local access to Ironic API
Component: ironic-image
Severity: Low
CWE: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N)
Public date: 2024-04-17T00:00:00+00:00

A vulnerability was found in Ironic-image. This issue occurs when setting IRONIC_REVERSE_PROXY_SETUP to 'true', which may allow unauthenticated local access to the Ironic API private port without authentication.

Statement: Red Hat rates this as a low impact vulnerability as expected this should be high complexity and requirements for an attacker to obtain benefits and privileges in an environment.

Affected upstream versions: < 24.1.1
Fixed upstream versions: v24.1.1
Upstream repository: https://github.com/metal3-io/ironic-image
Upstream fix commit: 48e40bd30d49aefabac6fc80204a8650b13d10b4
CVE-2024-31989: argocd: Use of Risky or Missing Cryptographic Algorithms in Redis Cache
Component: argocd
Severity: Important
CWE: CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation)
CVSS v3: 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Public date: 2024-05-15T00:00:00+00:00

A flaw was found in the ArgoCD Redis database server. This flaw allows an attacker with access to the Redis server to gain read/write access to the data in Redis. The attacker can also modify the "mfst" (manifest) key to cause ArgoCD to execute any deployment, potentially leveraging ArgoCD's high privileges to take over the cluster.


Affected upstream versions: < 2.8.19, >= 2.9.0-rc1, < 2.9.15, >= 2.10.0-rc1, < 2.10.10, >= 2.11.0-rc1, < 2.11.1, <= 1.8.7
Fixed upstream versions: v2.10.10
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 2de0ceade243039c120c28374016c04ff9590d1d
CVE-2024-31990: argo-cd: API server does not enforce project sourceNamespaces
Component: argo-cd
Severity: Moderate
CWE: CWE-863 (Incorrect Authorization)
CVSS v3: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2024-04-15T00:00:00+00:00

A flaw was found in Argo CD. The API server does not enforce project sourceNamespaces, which can allow an attacker to use the UI to edit resources which should only be mutable via gitops.


Affected upstream versions: >= 2.10.0, < 2.10.7, >= 2.9.0, < 2.9.12, >= 2.4.0, < 2.8.16
Fixed upstream versions: v2.10.7
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: c514105af739eebedb9dbe89d8a6dd8dfc30bb2c
CVE-2024-32002: git: Recursive clones RCE
Component: git
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Public date: 2024-05-14T00:00:00+00:00

A vulnerability was found in Git. This vulnerability allows the malicious manipulation of repositories containing submodules, exploiting a bug that enables the writing of files into the .git/ directory instead of the submodule's intended worktree. This manipulation facilitates the execution of arbitrary code during the cloning process, bypassing user inspection and control.

Statement: While the described bug in Git presents a significant security concern, it falls short of being categorized as Critical due to several factors. The exploit requires a specific set of conditions, such as repositories with submodules and the presence of symbolic link support. Additionally, successful exploitation relies on users cloning repositories from untrusted sources, limiting its scope compared to critical vulnerabilities that may be remotely exploitable or affect a broader range of use cases. However, the potential impact of remote code execution during cloning operations underscores the importance of promptly applying patches and exercising caution when interacting with Git repositories, emphasizing its significant severity within the realm of software security.

Affected upstream versions: = 2.45.0, = 2.44.0, >= 2.43.0, < 2.43.4, >= 2.42.0, < 2.42.2, = 2.41.0, >= 2.40.0, < 2.40.2, < 2.39.4
Fixed upstream versions: v2.39.4
Upstream repository: https://github.com/git/git
Upstream fix commit: 97065761333fd62db1912d81b489db938d8c991d
CVE-2024-32004: git: RCE while cloning local repos
Component: git
Severity: Important
CWE: CWE-114 (Process Control)
CVSS v3: 8.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Public date: 2024-05-14T00:00:00+00:00

A vulnerability was found in Git. This vulnerability can be exploited by an unauthenticated attacker who places a specialized repository on the target's local system. If the victim clones this repository, the attacker can execute arbitrary code.

Statement: This vulnerability, while significant, does not reach Critical severity due to its reliance on local repository manipulation. While it allows attackers to execute arbitrary code during cloning operations, its impact is constrained by the necessity for access to the target's local environment. Critical severity typically involves vulnerabilities that can be exploited remotely or without user interaction. Nonetheless, this issue remains Important as it can lead to unauthorized code execution, potentially compromising the integrity and security of affected systems.


Fuse 7 Karaf uses JGit to manage patches. It's heavily protected by file permissions and RBAC. Unless an attacker have write permissions to Fuse internal git repositories, this vulnerability is not exploitable.

Affected upstream versions: = 2.45.0, = 2.44.0, >= 2.43.0, < 2.43.4, >= 2.42.0, < 2.42.2, = 2.41.0, >= 2.40.0, < 2.40.2, < 2.39.4
Fixed upstream versions: v2.39.4
Upstream repository: https://github.com/git/git
Upstream fix commit: f4aa8c8bb11dae6e769cd930565173808cbb69c8
CVE-2024-32020: git: insecure hardlinks
Component: git
Severity: Low
CWE: CWE-62 (UNIX Hard Link)
CVSS v3: 3.9 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L)
Public date: 2024-05-14T00:00:00+00:00

A vulnerability was found in Git. This flaw allows an unauthenticated attacker to place a specialized repository on their target's local system. For performance reasons, Git uses hardlinks when cloning a repository located on the same disk. However, if the repo being cloned is owned by a different user, this can introduce a security risk. At any time in the future, the original repo owner could rewrite the hardlinked files in the cloned user's repo.

Statement: This vulnerability presents a Low severity issue due to its contextual constraints and limited impact potential. Primarily affecting local Git repository clones where source and target repositories reside on the same disk, the risk arises only when the source repository is owned by a different, potentially untrusted user. This scenario necessitates specific conditions for exploitation, such as shared access to the disk among multiple users. Moreover, the impact is localized to the affected repositories and does not extend to the broader system or network. While the integrity of the target repository may be compromised if the untrusted user modifies linked files, the scope of influence is contained within the repository structure.

Affected upstream versions: = 2.45.0, = 2.44.0, >= 2.43.0, < 2.43.4, >= 2.42.0, < 2.42.2, = 2.41.0, >= 2.40.0, < 2.40.2, < 2.39.4
Fixed upstream versions: v2.39.4
Upstream repository: https://github.com/git/git
Upstream fix commit: 1204e1a824c34071019fe106348eaa6d88f9528d
CVE-2024-32462: flatpak: sandbox escape via RequestBackground portal
Component: flatpak
Severity: Important
CWE: CWE-88 (Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'))
CVSS v3: 8.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)
Public date: 2024-04-18T00:00:00+00:00

A flaw was found in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. Normally, the "--command" argument of "flatpak run" expects being given a command to run in the specified Flatpak app, along with optional arguments. However, it is possible to pass bwrap arguments to "--command=" instead, such as "--bind". It is possible to pass an arbitrary "commandline" to the portal interface "org.freedesktop.portal.Background.RequestBackground" within the Flatpak app. This is normally safe because it can only specify a command that exists inside the sandbox. When a crafted "commandline" is converted into a "--command" and arguments, the app could achieve the same effect of passing arguments directly to bwrap to achieve sandbox escape.

Statement: This vulnerability poses an important security risk due to its potential for sandbox escape within Flatpak environments. Exploiting this vulnerability allows a malicious Flatpak application to execute arbitrary code outside of its designated sandbox, effectively bypassing the security measures intended to restrict its system access. By manipulating the --command argument and the org.freedesktop.portal.Background.RequestBackground portal interface, an attacker can craft commands that are misinterpreted as bwrap options, leading to unauthorized execution of commands with elevated privileges. This could result in unauthorized data access, system compromise, and potentially enable further exploitation of the host system.

Affected upstream versions: < 1.10.9, >= 1.12.0, < 1.12.9, >= 1.14.0, < 1.14.6, >= 1.15.0, < 1.15.8
Fixed upstream versions: 1.10.9
Upstream repository: https://github.com/flatpak/flatpak
Upstream fix commit: 72016e3fce8fcbeab707daf4f1a02b931fcc004d
CVE-2024-32465: git: additional local RCE
Component: git
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.3 (CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Public date: 2024-05-14T00:00:00+00:00

A flaw was found in Git in a full copy of a Git repository. A prerequisite for this vulnerability is for an unauthenticated attacker to place a specialized repository on their target's local system. If the victim were to clone this repository, it could result in arbitrary code execution.

Statement: The vulnerability identified in Git as CVE-2024-32004, while significant, is categorized as Moderate rather than Important due to several factors. Primarily, the exploit requires meeting specific conditions, such as interacting with repositories from untrusted sources and potentially executing malicious code embedded within them. Additionally, the vulnerability does not inherently grant unauthorized access to system resources or compromise the integrity of Git installations. Although the potential impact of the exploit is substantial, its severity is tempered by the fact that it necessitates user interaction with repositories obtained from untrusted origins.

Affected upstream versions: = 2.45.0, = 2.44.0, >= 2.43.0, < 2.43.4, >= 2.42.0, < 2.42.2, = 2.41.0, >= 2.40.0, < 2.40.2, < 2.39.4
Fixed upstream versions: v2.39.4
Upstream repository: https://github.com/git/git
Upstream fix commit: 7b70e9efb18c2cc3f219af399bd384c5801ba1d7
CVE-2024-32475: envoy: abnormal termination when using auto_sni with authority header longer than 255 characters
Component: envoy
Severity: Important
CWE: CWE-1284 (Improper Validation of Specified Quantity in Input)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-18T00:00:00+00:00

A flaw was found in Envoy, a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with "auto_sni" enabled, a request containing a "host/:authority" header longer than 255 characters triggers an abnormal termination of the Envoy process, leading to a denial of service.


Affected upstream versions: >= 1.30.0, < 11.30.1, >= 1.29.0, < 1.29.4, >= 1.28.0, < 1.28.3, >= 1.13.0, < 1.27.5
Fixed upstream versions: v1.31.0
Upstream repository: https://github.com/envoyproxy/envoy
Upstream fix commit: b47fc6648d7c2dfe0093a601d44cb704b7bad382