huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-3212: kernel: gfs2: NULL pointer dereference in gfs2_evict_inode()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-04-28T00:00:00+00:00

A NULL pointer dereference flaw was found in the gfs2 file system in the Linux kernel. This issue occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. This flaw allows a privileged local user to cause a kernel panic.

Statement: Because exploitation of this flaw requires that an attacker is able to mount volumes they have prepared themselves or to corrupt existing system volumes, Red Hat assesses the impact of this vulnerability as Low.

Affected upstream versions: Fixed in kernel 6.4-rc2
Fixed upstream versions: v6.4
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 504a10d9e46bc37b23d0a1ae2f28973c8516e636
CVE-2023-32233: kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-05-02T04:30:00+00:00

A use-after-free vulnerability was found in the Netfilter subsystem of the Linux kernel when processing batch requests to update nf_tables configuration. This vulnerability can be abused to perform arbitrary reads and writes in kernel memory. A local user (with CAP_NET_ADMIN capability) could use this flaw to crash the system or potentially escalate their privileges on the system.

Statement: Only local users with `CAP_NET_ADMIN` capability (or root) can trigger this issue. 
On Red Hat Enterprise Linux, local unprivileged users can exploit unprivileged user namespaces (CONFIG_USER_NS) to grant themselves this capability.

The OpenShift Container Platform (OCP) control planes or master machines are based on Red Hat Enterprise Linux CoreOS (RHCOS) that consists primarily of RHEL components, hence is also affected by this kernel vulnerability. Like it is mentioned earlier, the successful exploit needs necessary privileges (CAP_NET_ADMIN) and direct, local access . Local user in RHCOS is already a root with full permissions, hence existence of this vulnerability does not bring any value from the potential attacker perspective. From the OpenShift containers perspective, this vulnerability cannot be exploited as in OpenShift the cluster processes on the node are namespaced, which means that switching in the running OpenShift container the namespace will not bring necessary capabilities.
This means that for OpenShift, the impact of this vulnerability is Low.
Similar to CVE-2023-32233 vulnerability has been explained in the following blog post as an example of "Container escape vulnerability":
https://www.redhat.com/en/blog/containers-vulnerability-risk-assessment

Affected upstream versions: n/a
Fixed upstream versions: v6.4
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: c1592a89942e9678f7d9c8030efa777c0d57edab
CVE-2023-3268: kernel: out-of-bounds access in relay_file_read
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2023-04-19T06:30:00+00:00

An out-of-bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw allows a local attacker to crash the system or leak kernel internal information.


Affected upstream versions: Kernel version prior to 6.4-rc1
Fixed upstream versions: v6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 43ec16f1450f4936025a9bdf1a273affdb9732c1
CVE-2023-32681: python-requests: Unintended leak of Proxy-Authorization header
Component: python-requests
Severity: Moderate
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N)
Public date: 2023-05-23T00:00:00+00:00

A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy-Authorization headers to destination servers, specifically during redirects to an HTTPS origin. This is a product of how rebuild_proxies is used to recompute and reattach the Proxy-Authorization header to requests when redirected. This behavior only affects proxied requests when credentials are supplied in the URL user information component (for example, https://username:password@proxy:8080).


Affected upstream versions: >= 2.3.0, < 2.31.0
Fixed upstream versions: v2.31.0
Upstream repository: https://github.com/psf/requests
Upstream fix commit: 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5
CVE-2023-33201: bouncycastle: potential  blind LDAP injection attack using a self-signed certificate
Component: bouncycastle
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2023-06-16T00:00:00+00:00

A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain unauthorized information via blind LDAP Injection, exploring the environment and enumerating data. The exploit depends on the structure of the target LDAP directory as well as what kind of errors are exposed to the user.


Affected upstream versions: n/a
Fixed upstream versions: r1rv74
Upstream repository: https://github.com/bcgit/bc-java
Upstream fix commit: e8c409a8389c815ea3fda5e8b94c92fdfe583bcc
CVE-2023-33203: kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove()
Component: kernel
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 6.4 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-03-20T00:00:00+00:00

A race condition vulnerability was found in the Linux kernel's Qualcomm EMAC Gigabit Ethernet Controller when the user physically removes the device before cleanup in the emac_remove function. This flaw can eventually result in a use-after-free issue, possibly leading to a system crash or other undefined behaviors.

Statement: Red Hat Enterprise Linux 6 and 7 are not affected by this flaw as they did not include support for the EMAC Gigabit Ethernet Controller.

Affected upstream versions: n/a
Fixed upstream versions: v6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 6b6bc5b8bd2d4ca9e1efa9ae0f98a0b0687ace75
CVE-2023-3358: kernel: NULL pointer dereference due to missing kalloc() return value check in shtp_cl_get_dma_send_buf()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-11-22T10:00:00+00:00

A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.

Statement: Rated Low severity; No known scenario of attack and fail would happen when out of memory.

Affected upstream versions: kernel 6.1-rc8
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b3d40c3ec3dc4ad78017de6c3a38979f57aaaab8
CVE-2023-3390: kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-06-08T00:00:00+00:00

A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system.

Statement: Only local users with `CAP_NET_ADMIN` capability or root can trigger this issue. 
On Red Hat Enterprise Linux, local unprivileged users can exploit unprivileged user namespaces (CONFIG_USER_NS) to grant themselves this capability.

The OpenShift Container Platform (OCP) control planes or master machines are based on Red Hat Enterprise Linux CoreOS (RHCOS) that consists primarily of RHEL components, therefore, it is also affected by this kernel vulnerability. A successful exploit needs necessary privileges (CAP_NET_ADMIN) and direct, local access. A local user in RHCOS is already a root with full permissions, hence existence of this vulnerability does not bring any value from the potential attacker perspective. From the OpenShift containers perspective, this vulnerability cannot be exploited as in OpenShift the cluster processes on the node are namespaced, which means that switching the namespace in the running OpenShift container will not bring necessary capabilities.
This means that for OpenShift, the impact of this vulnerability is Low.

Similar to the CVE-2023-32233 vulnerability, this has been explained in the following blog post as an example of a "Container escape vulnerability":
https://www.redhat.com/en/blog/containers-vulnerability-risk-assessment

Affected upstream versions: 3.16 < 4.14.322, 4.15 < 4.19.291, 4.20 < 5.4.251, 5.5 < 5.10.188, 5.11 < 5.15.118, 5.16 < 6.1.35, 6.2 < 6.3.9
Fixed upstream versions: 4.14.322, 4.19.291, 5.10.188, 5.15.118, 5.4.251, 6.1.35, 6.3.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 1240eb93f0616b21c675416516ff3d74798fdc97
CVE-2023-34104: fast-xml-parser: Regex Injection via Doctype Entities
Component: fast-xml-parser
Severity: Moderate
CWE: CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-06-06T00:00:00+00:00

A flaw was found in the fast-XML-parser. The affected versions of fast-XML-parser are vulnerable to a denial of service caused by a regular expression denial of service (ReDoS) flaw in the Doctype Entities. By sending a specially crafted regex input, a remote attacker can cause a denial of service condition.


Affected upstream versions: >= 4.1.3, < 4.2.4
Fixed upstream versions: v4.2.3
Upstream repository: https://github.com/NaturalIntelligence/fast-xml-parser
Upstream fix commit: 39b0e050bb909e8499478657f84a3076e39ce76c
CVE-2023-34241: cups: use-after-free in cupsdAcceptClient() in scheduler/client.c
Component: cups
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2023-06-22T11:00:00+00:00

A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data immediately before the connection closed, resulting in a use-after-free in cupsdAcceptClient() in scheduler/client.c


Affected upstream versions: >= 2.0.0, < 2.4.6
Upstream repository: https://github.com/OpenPrinting/cups
Upstream fix commit: 9809947a959e18409dcf562a3466ef246cb90cb2
CVE-2023-34453: snappy-java: Integer overflow in shuffle leads to DoS
Component: snappy-java
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-06-15T00:00:00+00:00

A flaw was found in Snappy-java's shuffle function, which does not check input sizes before beginning operations. This issue could allow an attacker to send malicious input to trigger an overflow error that crashes the program, resulting in a denial of service.


Affected upstream versions: < 1.1.10.1
Fixed upstream versions: v1.1.10.1
Upstream repository: https://github.com/xerial/snappy-java
Upstream fix commit: 820e2e074c58748b41dbd547f4edba9e108ad905
CVE-2023-34454: snappy-java: Integer overflow in compress leads to DoS
Component: snappy-java
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-06-15T00:00:00+00:00

A flaw was found in Snappy-java's shuffle function, which does not check input sizes before beginning operations. This issue could allow an attacker to send malicious input to trigger an overflow error that crashes the program, resulting in a denial of service.


Affected upstream versions: < 1.1.10.1
Fixed upstream versions: v1.1.10.1
Upstream repository: https://github.com/xerial/snappy-java
Upstream fix commit: d0042551e4a3509a725038eb9b2ad1f683674d94
CVE-2023-34455: snappy-java: Unchecked chunk length leads to DoS
Component: snappy-java
Severity: Moderate
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-06-16T00:00:00+00:00

A flaw was found in Snappy-java's fileSnappyInputStream hasNextChunk function, which does not sufficiently evaluate input bytes before beginning operations. This issue could allow an attacker to send malicious input to trigger an out of memory error that crashes the program, resulting in a denial of service.


Affected upstream versions: < 1.1.10.1
Fixed upstream versions: v1.1.10.1
Upstream repository: https://github.com/xerial/snappy-java
Upstream fix commit: 3bf67857fcf70d9eea56eed4af7c925671e8eaea
CVE-2023-3446: openssl: Excessive time spent checking DH keys and parameters
Component: openssl
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2023-07-19T00:00:00+00:00

A vulnerability was found in OpenSSL. This security flaw occurs because the applications that use the DH_check(), DH_check_ex(), or EVP_PKEY_param_check() functions to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source may lead to a denial of service.

Statement: The CVE-2023-3446 vulnerability in OpenSSL has been classified as having a low impact due to several factors. Firstly, while the potential for a Denial of Service (DoS) attack exists, it requires specific conditions to be met, notably the use of DH_check(), DH_check_ex(), or EVP_PKEY_param_check() functions with DH keys or parameters obtained from untrusted sources. Secondly, the issue primarily affects the efficiency of key and parameter checks, rather than directly compromising the security or integrity of cryptographic operations. Given these considerations and the absence of widespread exploitation or significant consequences beyond performance degradation, the overall impact of this vulnerability is deemed low rather than moderate.

Affected upstream versions: 3.1.0 < 3.1.2, 3.0.0 < 3.0.10, 1.1.1 < 1.1.1v, 1.0.2 < 1.0.2zi
Fixed upstream versions: 1.0.2zi, 1.1.1v, 3.0.10, 3.1.2
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: fc9867c1e03c22ebf56943be205202e576aabf23
CVE-2023-34462: netty: SniHandler 16MB allocation leads to OOM
Component: netty
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-06-23T00:00:00+00:00

A flaw was found in Netty's SniHandler while navigating TLS handshake which may permit a large heap allocation if the handler did not have a timeout configured. This issue may allow an attacker to send a client hello packet which would cause the server to buffer large amounts of data per connection, potentially causing an out of memory error, resulting in Denial of Service.


Affected upstream versions: < 4.1.94.Final
Fixed upstream versions: netty-4.1.94.Final
Upstream repository: https://github.com/netty/netty
Upstream fix commit: 535da17e45201ae4278c0479e6162bb4127d4c32
CVE-2023-35823: kernel: saa7134: race condition leading to use-after-free in saa7134_finidev()
Component: kernel
Severity: Moderate
CWE: CWE-663 (Use of a Non-reentrant Function in a Concurrent Context)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-06-19T00:00:00+00:00

A race condition was found in the Linux kernel's saa7134 device driver. This occurs when removing the module before cleanup in the saa7134_finidev function which can result in a use-after-free issue, possibly leading to a system crash or other undefined behaviors.

Statement: Because this flaw only affects systems with specific hardware installed, and because exploitation requires an attacker to be able to manipulate the driver or the physical hardware with precise timing, Red Hat assesses the impact of this vulnerability as Moderate.

Affected upstream versions: n/a
Fixed upstream versions: v6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 30cf57da176cca80f11df0d9b7f71581fe601389
CVE-2023-35824: kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c()
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-06-19T00:00:00+00:00

A race condition was found in the Linux kernel's dm1105 device driver when removing the module before cleanup in the dm1105_remove function. This can result in a use-after-free issue, possibly leading to a system crash or other undefined behaviors.

Statement: Because this flaw only affects systems with specific hardware installed, and because exploitation requires an attacker to be able to manipulate the driver with precise timing, Red Hat assesses the impact of this vulnerability as Moderate.

Affected upstream versions: n/a
Fixed upstream versions: v6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 5abda7a16698d4d1f47af1168d8fa2c640116b4a
CVE-2023-3592: mosquitto: memory leak leads to unresponsive broker
Component: mosquitto
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-09-01T00:00:00+00:00

A memory leak vulnerability was found in Eclipse Mosquitto. This issue is triggered by malicious initial packets or certain client actions and may allow a remote attacker to the deplete system resources causing memory exhaustion, leading to a disruption in services and a denial of service condition.


Affected upstream versions: <= v2.0.15
Fixed upstream versions: 2.0.16
Upstream repository: https://github.com/eclipse/mosquitto
Upstream fix commit: 6113eac95a9df634fbc858be542c4a0456bfe7b9
CVE-2023-36054: krb5: Denial of service through freeing uninitialized pointer
Component: krb5
Severity: Moderate
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-08-07T00:00:00+00:00

A vulnerability was found in the _xdr_kadm5_principal_ent_rec() function in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (krb5). This issue occurs due to lack of validation in the relationship between n_key_data and the key_data array count, leading to the freeing of uninitialized pointers. This may allow a remote authenticated attacker to send a specially crafted request that causes the kadmind process to crash, resulting in a denial of service (DoS).

Statement: Remote code execution is unlikely. An attacker with control of a kadmin server can only cause a kadmin client to crash by freeing uninitialized pointers.

Affected upstream versions: n/a
Fixed upstream versions: krb5-1.22-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: ef08b09c9459551aabbe7924fb176f1583053cdd
CVE-2023-3609: kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails
Component: kernel
Severity: Important
CWE: CWE-415 (Double Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-07-21T00:00:00+00:00

A double-free flaw was found in u32_set_parms in net/sched/cls_u32.c in the Network Scheduler component in the Linux kernel. This flaw allows a local attacker to use a failure event to mishandle the reference counter, leading to a local privilege escalation threat.


Affected upstream versions: 4.14 < 6.4
Fixed upstream versions: 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 04c55383fa5689357bcdd2c8036725a55ed632bc
CVE-2023-3610: kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-07-21T00:00:00+00:00

A use-after-free vulnerability was found in the netfilter: nf_tables component in the Linux kernel due to a missing error handling in the abort path of NFT_MSG_NEWRULE. This flaw allows a local attacker with CAP_NET_ADMIN access capability to cause a local privilege escalation problem.


Affected upstream versions: 5.9 < 6.4
Fixed upstream versions: 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 4bedf9eee016286c835e3d8fa981ddece5338795
CVE-2023-3611: kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue overhead
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-07-21T00:00:00+00:00

An out-of-bounds memory write flaw was found in qfq_change_agg in net/sched/sch_qfq.c in the Traffic Control (QoS) subsystem in the Linux kernel. This flaw allows a local user to crash or potentially escalate their privileges on the system.


Affected upstream versions: 3.8 < 6.5
Fixed upstream versions: 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3e337087c3b5805fe0b8a46ba622a962880b5d64
CVE-2023-3635: okio: GzipSource class improper exception handling
Component: okio
Severity: Important
CWE: CWE-248 (Uncaught Exception)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-07-12T00:00:00+00:00

A flaw was found in SquareUp Okio. A class GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This issue may allow a malicious user to start processing a malformed file, which can result in a Denial of Service (DoS).

Statement: Red Hat JBoss Enterprise Application Platform XP does contain Okio package but is not using GzipSource.java, which is the affected class.
Red Hat support for Spring Boot is considered low impact as it's used by Dekorate during compilation process and not included in the resulting Jar.

Affected upstream versions: 0.5.0 < 1.0.0, 1.0.0 < 1.17.6, 2.0.0 < 3.0.0, 3.0.0 < 3.4.0
Fixed upstream versions: parent-3.4.0
Upstream repository: https://github.com/square/okio
Upstream fix commit: 81bce1a30af244550b0324597720e4799281da7b
CVE-2023-36664: ghostscript: vulnerable to OS command injection due to mishandles permission validation for pipe devices
Component: ghostscript
Severity: Important
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-06-27T00:00:00+00:00

A vulnerability was found in Ghostscript. This flaw occurs due to a mishandled permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).

Statement: Versions of Ghostscript shipped with Red Hat Enterprise Linux 7 and 8 are not affected as it will forbid file execution with ".invalidfileaccess" if -dSAFER is used.

Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-10.02.0
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 505eab7782b429017eb434b2b95120855f2b0e3c