huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2018-10856: podman: Containers run as non-root users do not drop capabilities
Component: podman
Severity: Moderate
CWE: CWE-250 (Execution with Unnecessary Privileges)
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-05-31T00:00:00+00:00

It has been discovered that podman does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.


Affected upstream versions: podman 0.6.1
Fixed upstream versions: v0.6.1
Upstream repository: https://github.com/projectatomic/libpod
Upstream fix commit: bae80a0b663925ec751ad2784ca32989403cdc24
CVE-2018-10861: ceph: ceph-mon does not perform authorization on OSD pool ops
Component: ceph
Severity: Moderate
CWE: CWE-285 (Improper Authorization)
CVSS v3: 4.6 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
Public date: 2018-07-09T12:00:00+00:00

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete and corrupt snapshot images


Affected upstream versions: all versions in branches master, mimic, luminous and jewel
Fixed upstream versions: v14.0.1
Upstream repository: https://github.com/ceph/ceph
Upstream fix commit: 975528f632f73fbffa3f1fee304e3bbe3296cffc
CVE-2018-10873: spice: Missing check in demarshal.py:write_validate_array_item() allows for buffer overflow and denial of service
Component: spice
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 8.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2018-08-16T00:00:00+00:00

A vulnerability was discovered in SPICE where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts.


Affected upstream versions: 0.14.1
Upstream repository: https://gitlab.freedesktop.org/spice/spice-common
Upstream fix commit: bb15d4815ab586b4c4a20f4a565970a44824c42c
CVE-2018-10876: kernel: use-after-free in jbd2_journal_commit_transaction funtion
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2018-04-16T00:00:00+00:00

A flaw was found in the Linux kernel's ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image.


Affected upstream versions: n/a
Fixed upstream versions: v4.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 8844618d8aa7a9973e7b527d038a2a589665002c
CVE-2018-10878: kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.8 (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2018-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image.


Affected upstream versions: n/a
Fixed upstream versions: v4.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 77260807d1170a8cf35dbb06e07461a655f67eee
CVE-2018-10879: kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 4.2 (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-06-08T00:00:00+00:00

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image.


Affected upstream versions: n/a
Fixed upstream versions: v4.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 5369a762c882c0b6e9599e4ebbb3a9ba9eee7e2d
CVE-2018-10880: kernel: stack-out-of-bounds write in ext4_update_inline_data function
Component: kernel
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-06-09T00:00:00+00:00

A flaw was found in the Linux kernel's ext4 filesystem code. A stack-out-of-bounds write in ext4_update_inline_data() is possible when mounting and writing to a crafted ext4 image. An attacker could use this to cause  a system crash and a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v4.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 8cdb5240ec5928b20490a2bb34cb87e9a5f40226
CVE-2018-10881: kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image
Component: kernel
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.2 (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-06-10T00:00:00+00:00

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.


Affected upstream versions: n/a
Fixed upstream versions: v4.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 6e8ab72a812396996035a37e5ca4b3b99b5d214b
CVE-2018-10882: kernel: stack-out-of-bounds write infs/jbd2/transaction.c
Component: kernel
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.8 (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2018-06-14T00:00:00+00:00

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in the fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image.


Affected upstream versions: n/a
Fixed upstream versions: v4.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: c37e9e013469521d9adb932d17a1795c139b36db
CVE-2018-10883: kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function
Component: kernel
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.8 (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2018-06-14T00:00:00+00:00

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image.


Affected upstream versions: n/a
Fixed upstream versions: v4.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: e09463f220ca9a1a1ecfda84fcda658f99a1f12a
CVE-2018-10897: yum-utils: reposync: improper path validation may lead to directory traversal
Component: yum-utils
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-07-11T00:00:00+00:00

A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files.

Statement: Red Hat Enterprise Virtualization includes reposync as a component from the base Enterprise Linux system. It is not used by virtualization or management components, and it is not generally useful to mirror untrusted repositories to either Hypervisor or Management Appliance. For Red Hat Enterprise Virtualization, this issue affects only unlikely configurations and thus is rated as Moderate.

Affected upstream versions: 1.1.31
Upstream repository: https://github.com/rpm-software-management/yum-utils
Upstream fix commit: 6a8de061f8fdc885e74ebe8c94625bf53643b71c
CVE-2018-10901: kernel: kvm: vmx: host GDT limit corruption
Component: kernel
Severity: Important
CWE: CWE-665 (Improper Initialization)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2010-08-02T00:00:00+00:00

A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3444d7da1839b851eefedd372978d8a982316c36
CVE-2018-10902: kernel: MIDI driver race condition leads to a double-free
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-08-21T03:28:00+00:00

It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for privilege escalation.

Statement: This flaw affects all current shipping releases of Red Hat Enterprise Linux. This flaw requires real or emulated midi hardware available in the system. Fixes will be delivered when available.

Affected upstream versions: <= v4.17
Fixed upstream versions: 3.16.58, 3.18.117, 4.14.100, 4.17.10, 4.18, 4.4.144, 4.9.115
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 39675f7a7c7e7702f7d5341f1e0d01db746543a0
CVE-2018-10903: python-cryptography: GCM tag forgery via truncated tag in finalize_with_tag API
Component: python-cryptography
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2018-07-18T00:00:00+00:00

A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.


Affected upstream versions: 2.3
Upstream repository: https://github.com/pyca/cryptography
Upstream fix commit: 688e0f673bfbf43fa898994326c6877f00ab19ef
CVE-2018-1091: kernel: guest kernel crash during core dump on POWER9 host
Component: kernel
Severity: Moderate
CWE: CWE-391 (Unchecked Error Condition)
CVSS v3: 4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-09-13T00:00:00+00:00

A flaw was found in the Linux kernel where a crash can be triggered from unprivileged userspace during core dump on a POWER system with a certain configuration. This is due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path leading to a denial of service.


Affected upstream versions: Linux kernel v4.13 and newer
Fixed upstream versions: v4.14
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: c1fa0768a8713b135848f78fd43ffc208d8ded70
CVE-2018-10916: lftp: particular remote file names may lead to current working directory erased
Component: lftp
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2018-05-16T00:00:00+00:00

It has been discovered that lftp does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker-controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.


Affected upstream versions: up to and including 4.8.3
Fixed upstream versions: v4.8.4
Upstream repository: https://github.com/lavv17/lftp
Upstream fix commit: a27e07d90a4608ceaf928b1babb27d4d803e1992
CVE-2018-1092: kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4 image
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.6 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-03-22T00:00:00+00:00

The Linux kernel is vulnerable to a NULL pointer dereference in the ext4/mballoc.c:ext4_process_freed_data() function. An attacker could trick a legitimate user or a privileged attacker could exploit this by mounting a crafted ext4 image to cause a kernel panic.


Affected upstream versions: Linux kernel through version 4.15
Fixed upstream versions: v4.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git
Upstream fix commit: 8e4b5eae5decd9dfe5a4ee369c22028f90ab4c44
CVE-2018-1094: kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.6 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-03-22T00:00:00+00:00

The Linux kernel is vulnerable to a NULL pointer dereference in the ext4/xattr.c:ext4_xattr_inode_hash() function. An attacker could trick a legitimate user or a privileged attacker could exploit this to cause a NULL pointer dereference with a crafted ext4 image.


Affected upstream versions: Linux kernel through version 4.15
Fixed upstream versions: v4.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git
Upstream fix commit: 18db4b4e6fc31eda838dd1c1296d67dbcb3dc957
CVE-2018-10940: kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c
Component: kernel
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Public date: 2018-04-18T00:00:00+00:00

A flaw was found in the Linux kernel, before 4.16.6 where the cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory.


Affected upstream versions: n/a
Fixed upstream versions: v4.17
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 9de4ee40547fd315d4a0ed1dd15a2fa3559ad707
CVE-2018-1095: kernel: out-of-bound access in fs/posix_acl.c:get_acl() causes crash with crafted ext4 image
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.2 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2018-03-22T00:00:00+00:00

The Linux kernel is vulnerable to an out-of-bound access bug in the fs/posix_acl.c:get_acl() function. An attacker could trick a legitimate user or a privileged attacker could exploit this to cause a system crash or other unspecified impact with a crafted ext4 image. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.


Affected upstream versions: Linux kernel through version 4.15
Fixed upstream versions: v4.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git
Upstream fix commit: ce3fd194fcc6fbdc00ce095a852f22df97baa401
CVE-2018-1115: postgresql: Too-permissive access control list on function pg_logfile_rotate()
Component: postgresql
Severity: Low
CWE: CWE-732 (Incorrect Permission Assignment for Critical Resource)
CVSS v3: 4.2 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L)
Public date: 2018-05-10T00:00:00+00:00

It was found that pg_catalog.pg_logfile_rotate(), from the adminpack extension, did not follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could use this flaw to force log rotation.

Statement: This issue does not appear to affect the versions of postgresql as shipped with Red Hat Satellite version 5, CloudForms version 4, Red Hat Single Sign-On 7, and Fuse Service Works 6.

Affected upstream versions: postegresql 10.4, postegresql 9.6.9
Fixed upstream versions: REL_11_0
Upstream repository: https://git.postgresql.org/gitweb/postgresql.git
Upstream fix commit: 7b34740
CVE-2018-1116: polkit: Improper authorization in polkit_backend_interactive_authority_check_authorization function in polkitd
Component: polkit
Severity: Low
CWE: CWE-285 (Improper Authorization)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Public date: 2018-07-10T00:00:00+00:00

It was found that Polkit's CheckAuthorization and RegisterAuthenticationAgent D-Bus calls did not validate the client provided UID. A specially crafted program could use this flaw to submit arbitrary UIDs, triggering various denial of service or minor disclosures, such as which authentication is cached in the victim's session.


Affected upstream versions: polkit 0.116
Upstream repository: https://cgit.freedesktop.org/polkit
Upstream fix commit: bc7ffad5364
CVE-2018-1120: kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service
Component: kernel
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 2.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-05-17T17:00:00+00:00

By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).


Affected upstream versions: kernel 4.17
Fixed upstream versions: v4.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 7f7ccc2ccc2e70c6054685f5e3522efa81556830
CVE-2018-11218: redis: Heap corruption in lua_cmsgpack.c
Component: redis
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 6.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-06-13T00:00:00+00:00

Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.


Affected upstream versions: n/a
Upstream repository: https://github.com/antirez/redis
Upstream fix commit: 5ccb6f7a791bf3490357b00a898885759d98bab0
CVE-2018-11219: redis: Integer overflow in lua_struct.c:b_unpack()
Component: redis
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-06-13T00:00:00+00:00

An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.


Affected upstream versions: n/a
Upstream repository: https://github.com/antirez/redis
Upstream fix commit: 1eb08bcd4634ae42ec45e8284923ac048beaa4c3
CVE-2018-11236: glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer overflow
Component: glibc
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-02-04T00:00:00+00:00

stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.

Statement: Red Hat Product Security has rated this issue as having moderate security impact and a future update may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: glibc-2.28
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 5460617d1567657621107d895ee2dd83bc1f88f2
CVE-2018-1128: ceph: cephx protocol is vulnerable to replay attack
Component: ceph
Severity: Moderate
CWE: CWE-294 (Authentication Bypass by Capture-replay)
CVSS v3: 5.9 (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L)
Public date: 2018-07-09T12:00:00+00:00

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to the ceph cluster network who is also able to sniff packets on the network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service.

Statement: Red Hat OpenStack Platform ships the flawed package, however RHOSP deployments use the ceph package directly from the Ceph channel.  A RHOSP ceph update will therefore not be provided at this time, but please ensure that the underlying Red Hat Ceph Storage is updated.

Affected upstream versions: All versions in branches master, mimic, luminous and jewel
Fixed upstream versions: v12.2.6
Upstream repository: https://github.com/ceph/ceph
Upstream fix commit: 5ead97120e07054d80623dada90a5cc764c28468
CVE-2018-1129: ceph: cephx uses weak signatures
Component: ceph
Severity: Moderate
CWE: CWE-284 (Improper Access Control)
CVSS v3: 5.9 (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L)
Public date: 2018-07-09T12:00:00+00:00

A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network, who is able to alter the message payload, was able to bypass signature checks done by cephx protocol.


Affected upstream versions: all versions in branches master, mimic, luminous and jewel
Fixed upstream versions: v14.0.1
Upstream repository: https://github.com/ceph/ceph
Upstream fix commit: 8f396cf35a3826044b089141667a196454c0a587
CVE-2018-1130: kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-03-07T00:00:00+00:00

A null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in the Linux kernel allows a local user to cause a denial of service by a number of certain crafted system calls.


Affected upstream versions: kernel 4.16-rc7
Fixed upstream versions: v4.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 67f93df79aeefc3add4e4b31a752600f834236e2
CVE-2018-11362: wireshark: Out-of-bounds read in packet-ldss.c
Component: wireshark
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-04-24T00:00:00+00:00

A heap-based buffer overflow was found in the wireshark module responsible for analyzing the LDSS protocol. An attacker could create a malicious LDSS message to cause a remote denial of service, crashing the application.


Affected upstream versions: n/a
Fixed upstream versions: v2.2.15
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: f177008b04a530640de835ca878892e58b826d58