huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2019-20811: kernel: net-sysfs: *_queue_add_kobject refcount issue
Component: kernel
Severity: Low
CWE: CWE-460 (Improper Cleanup on Thrown Exception)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Public date: 2019-03-19T00:00:00+00:00

A flaw was found in the way the rx_queue_add_kobject and netdev_queue_add_kobject functions in the Linux kernel handled refcounting of certain objects. This flaw allows a local user who can trigger the error code path to use this vulnerability to disturb the integrity of the system.

Statement: This issue is rated as having Low impact because of the preconditions needed to trigger the error code path (privileges).

Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: a3e23f719f5c4a38ffb3d30c8d7632a4ed8ccd9e
CVE-2019-20812: kernel: af_packet: TPACKET_V3: invalid timer timeout on error
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-12-09T00:00:00+00:00

A flaw was found in the way the af_packet functionality in the Linux kernel handled the retirement timer setting for TPACKET_v3 when getting settings from the underlying network device errors out. This flaw allows a local user who can open the af_packet domain socket and who can hit the error path, to use this vulnerability to starve the system.

Statement: This issue is rated as having Moderate impact because of the preconditions needed to trigger the error code path and privileges required (CAP_NET_RAW).

Affected upstream versions: n/a
Fixed upstream versions: v5.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b43d1f9f7067c6759b1051e8ecb84e82cef569fe
CVE-2019-20839: libvncserver: buffer overflow in ConnectClientToUnixSock()
Component: libvncserver
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-06-17T00:00:00+00:00

libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.

Statement: This is only an issue if the "ConnectClientToUnixSock()" function is used directly with an overly long socket name. It's more common that the "ConnectToRFBServer()" function is used, which would prevent exploiting this flaw as it performs additional checks. Additionally, the buffer overflow is caught by compiled-in buffer overflow checks, limiting the impact to a crash.

Affected upstream versions: n/a
Fixed upstream versions: LibVNCServer-0.9.13
Upstream repository: https://github.com/LibVNC/libvncserver
Upstream fix commit: 3fd03977c9b35800d73a865f167338cb4d05b0c1
CVE-2019-20892: net-snmp: double free in usm_free_usmStateReference function in snmplib/snmpusm.c via an SNMPv3 GetBulk request
Component: net-snmp
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2020-01-02T00:00:00+00:00

net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.


Affected upstream versions: n/a
Fixed upstream versions: v5.9
Upstream repository: https://github.com/net-snmp/net-snmp
Upstream fix commit: 5f881d3bf24599b90d67a45cae7a3eb099cd71c9
CVE-2019-20908: kernel: lockdown: bypass through ACPI write via efivar_ssdt
Component: kernel
Severity: Moderate
CWE: CWE-284 (Improper Access Control)
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-08-19T00:00:00+00:00

A flaw was found in how the ACPI table loading through the EFI variable (and the related efivar_ssdt boot option) was handled when the Linux kernel was locked down. This flaw allows a (root) privileged local user to circumvent the kernel lockdown restrictions. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Statement: This issue is rated as having Moderate impact because of the privileges required for exploitation.

Affected upstream versions: n/a
Fixed upstream versions: v5.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 1957a85b0032a81e6482ca4aab883643b8dae06e
CVE-2019-20916: python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py
Component: python-pip
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-04-16T00:00:00+00:00

A flaw was found in the pip package installer for Python when downloading or installing a remote package via a specified URL. Improper validation of the "Content-Disposition" HTTP response header makes a path traversal attack possible, leading to an arbitrary file overwrite. This flaw allows an attacker who controls a malicious server to execute arbitrary code on the system.

Statement: This issue has been rated as having Moderate impact because of the preconditions needed to trigger the flaw: it only affects Python Wheels and requires the user to pip-install a wheel from a malicious server. Installing software from untrusted servers is insecure by definition and strongly discouraged, as it may lead to system compromise regardless of this CVE.

This flaw did not affect the versions of `python-pip` in Python 3.8 as shipped with Red Hat Enterprise Linux 8 and Red Hat Software Collections 3, as they already included the fix for this CVE.

Affected upstream versions: n/a
Upstream repository: https://github.com/gzpan123/pip
Upstream fix commit: a4c735b14a62f9cb864533808ac63936704f2ace
CVE-2019-20922: nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS
Component: nodejs-handlebars
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-11-04T00:00:00+00:00

A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to a denial of service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This flaw allows attackers to exhaust system resources, leading to a denial of service.

Statement: Red Hat Quay includes Handlebars.js as a development dependency. It does not use Handlebars.js at runtime to process templates, so it has been given a low impact rating.

Red Hat Virtualization includes Handlebars.js in two components. In ovirt-engine-ui-extentions, the version used is newer and not affected by this flaw. In the ovirt-web-ui,Handlebars.js is included as a development dependency and is not used at runtime to process templates, so it has been given a low impact rating.

Red Hat OpenShift Container Platform (OCP) 4 delivers the kibana package, which includes Handlebars.js. From OCP 4.6, the kibana package is no longer shipped and will not be fixed. The openshift4/ose-logging-kibana6 container includes Handlebars.js directly as container first code. The vulnerable version of Handlebars.js is also included in openshift4/ose-grafana, but as the Grafana instance is in read-only mode, the configuration/dashboards cannot be modified.

Affected upstream versions: n/a
Fixed upstream versions: v4.4.5
Upstream repository: https://github.com/handlebars-lang/handlebars.js
Upstream fix commit: 8d5530ee2c3ea9f0aee3fde310b9f36887d00b8b
CVE-2019-20934: kernel: use-after-free in show_numa_stats function
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2020-07-16T00:00:00+00:00

A flaw was found in the Linux kernel’s implementation of displaying NUMA statistics, where displaying the scheduler statistics could trigger a use-after-free in show_numa_stats() and display the kernel memory to userspace. The highest threat from this vulnerability is to system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 16d51a590a8ce3befb1308e0e7ab77f3b661af33
CVE-2019-25013: glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding
Component: glibc
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-09-06T00:00:00+00:00

A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could cause glibc to read beyond the end of a buffer, resulting in a segmentation fault. The highest threat from this vulnerability is to system availability.

Statement: This flaw has been rated as having moderate impact for glibc packages shipped with Red Hat Enterprise Linux because, the maximum impact of this vulnerability is a crash, and it relies on processing untrusted input in an uncommon encoding (EUC-KR).  When this encoding is not used, the vulnerability can not be triggered.

Affected upstream versions: n/a
Fixed upstream versions: glibc-2.33
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: ee7a3144c9922808181009b7b3e50e852fb4999b
CVE-2019-25051: aspell: Heap-buffer-overflow in acommon::ObjStack::dup_top
Component: aspell
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-07-20T00:00:00+00:00

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).


Affected upstream versions: n/a
Fixed upstream versions: rel-0.60.8.1
Upstream repository: https://github.com/gnuaspell/aspell
Upstream fix commit: 0718b375425aad8e54e1150313b862e4c6fd324a
CVE-2019-25160: kernel: out-of-bounds memory accesses in netlabel
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-02-26T00:00:00+00:00

A vulnerability was found in the Linux kernel. An out-of-bounds (OOB) memory access flaw exists in the netlabel driver module. This may lead to a crash.

Statement: Red Hat has protection mechanisms in place against buffer overflows, such as FORTIFY_SOURCE, Position Independent Executables or Stack Smashing Protection.

Affected upstream versions: 2.6.19
Fixed upstream versions: 0, 3.16.66, 3.18.137, 4.14.106, 4.19.28, 4.20.15, 4.4.177, 4.9.163, 5.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 97bc3683c24999ee621d847c9348c75d2fe86272
CVE-2019-25162: kernel: use after free in i2c
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-02-26T00:00:00+00:00

An out-of-bounds (OOB) memory access flaw was found in the i2c driver module in the Linux kernel.


Affected upstream versions: 4.3
Fixed upstream versions: 0, 4.14.291, 4.19.256, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 5.4.211, 6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e6412ba3b6508bdf9c074d310bf4144afa6aec1a
CVE-2019-25211: github.com/gin-contrib/cors: Gin mishandles a wildcard in the origin string in github.com/gin-contrib/cors
Component: github.com/gin-contrib/cors
Severity: Moderate
CWE: CWE-346 (Origin Validation Error)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2024-07-02T00:00:00+00:00

A flaw was found in the gin-gonic CORS middleware. Affected versions of this package are vulnerable to an Origin Validation Error due to the mishandling of wildcard characters at the end of an origin string. This flaw could allow an attacker to bypass intended CORS restrictions by crafting origin strings that exploit this wildcard handling.


Affected upstream versions: n/a
Fixed upstream versions: v1.6.0
Upstream repository: https://github.com/gin-contrib/cors
Upstream fix commit: 27b723a473efd80d5a498fa9f5933c80204c850d
CVE-2019-3804: cockpit: Crash when parsing invalid base64 headers
Component: cockpit
Severity: Moderate
CWE: CWE-909 (Missing Initialization of Resource)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-12-13T00:00:00+00:00

It was found that cockpit used glib's base64 decode functionality incorrectly resulting in a denial of service attack.  An unauthenticated attacker could send a specially crafted request with an invalid base64-encoded cookie which could cause the web service to crash.

Statement: Red Hat Enterprise Linux (RHEL) ships binary packages built from the cockpit source RPM, which was affected by this flaw and subsequently updated to address the issue.

All OpenShift Container Platform (OCP) versions to date ship with an image that contains a cockpit-kubernetes RPM, built separately from the same cockpit SRPM.  The cockpit-kubernetes RPM is not affected by this vulnerability as it does not contain the affected code, thus OCP is also marked "not affected".  Updates for all other cockpit RPMs should be applied from the appropriate RHEL channels.

Affected upstream versions: 184
Fixed upstream versions: 184
Upstream repository: https://github.com/cockpit-project/cockpit
Upstream fix commit: c51f6177576d7e12
CVE-2019-3817: libcomps: use after free when merging two objmrtrees
Component: libcomps
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-01-21T00:00:00+00:00

A use-after-free flaw has been discovered in libcomps in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.


Affected upstream versions: 0.1.10
Fixed upstream versions: libcomps-0.1.10
Upstream repository: https://github.com/rpm-software-management/libcomps
Upstream fix commit: e3a5d056633677959ad924a51758876d415e7046
CVE-2019-3826: prometheus: Stored DOM cross-site scripting (XSS) attack via crafted URL
Component: prometheus
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2019-01-31T00:00:00+00:00

A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.


Affected upstream versions: 2.7.1
Fixed upstream versions: v0.35.0
Upstream repository: https://github.com/prometheus/prometheus
Upstream fix commit: 62e591f9
CVE-2019-3839: ghostscript: missing attack vector protections for CVE-2019-6116
Component: ghostscript
Severity: Important
CWE: CWE-648 (Incorrect Use of Privileged APIs)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2019-05-02T00:00:00+00:00

It was found that some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: 9.28
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 4ec9ca74bed49f2a82acb4bf430eae0d8b3b75c9
CVE-2019-3877: mod_auth_mellon: open redirect in logout url when using URLs with backslashes
Component: mod_auth_mellon
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2019-03-22T00:00:00+00:00

A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.


Affected upstream versions: v0.14.2
Fixed upstream versions: v0.14.2
Upstream repository: https://github.com/Uninett/mod_auth_mellon
Upstream fix commit: 62041428a32de402e0be6ba45fe12df6a83bedb8
CVE-2019-3895: openstack-tripleo-common: Allows running new amphorae based on arbitrary images
Component: openstack-tripleo-common
Severity: Moderate
CWE: CWE-284 (Improper Access Control)
CVSS v3: 5.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
Public date: 2019-05-27T00:00:00+00:00

An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.


Affected upstream versions: n/a
Fixed upstream versions: 11.0.0
Upstream repository: https://github.com/openstack/tripleo-common
Upstream fix commit: e7c5eab712e0f70ecbc6d225d4766e0fe0f3f884
CVE-2019-5489: Kernel: page cache side channel attacks
Component: Kernel
Severity: Important
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 7.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N)
Public date: 2019-01-06T00:00:00+00:00

A new software page cache side channel attack scenario was discovered in operating systems that implement the very common 'page cache' caching mechanism. A malicious user/process could use 'in memory' page-cache knowledge to infer access timings to shared memory and gain knowledge which can be used to reduce effectiveness of cryptographic strength by monitoring algorithmic behavior, infer access patterns of memory to determine code paths taken, and exfiltrate data to a blinded attacker through page-granularity access times as a side-channel.


Affected upstream versions: n/a
Fixed upstream versions: v5.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 574823bfab82d9d8fa47f422778043fbb4b4f50e
CVE-2019-5736: runc: Execution of malicious containers allows for container escape and access to host filesystem
Component: runc
Severity: Important
CWE: CWE-672 (Operation on a Resource after Expiration or Release)
CVSS v3: 7.7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Public date: 2019-02-11T13:22:00+00:00

A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system.

Statement: The 'docker' package shipped in Red Hat Enterprise Linux 7 Extras bundles 'runc' since 'docker' starting from version 1.12. Both the 'docker' and 'runc' packages are affected by this issue.

The 'docker-latest' package is deprecated as of Red Hat Enterprise Linux 7.5. Customers using this package should update to the latest 'docker' package shipped in Red Hat Enterprise Linux 7 Extras.

OpenShift Container Platform (OCP) versions 3.9 and later use 'docker' version 1.13 in the default configuration but can be configured to use CRI-O as an alternative, which depends on the 'runc' package. OCP versions 3.9 and later should use the updated 'docker' and 'runc' packages shipped in Red Hat Enterprise Linux 7 Extras.

OCP versions 3.4 through 3.7 originally used 'docker' version 1.12 from the Red Hat Enterprise Linux 7 Extras channel. An updated version of 'docker' 1.12 has been delivered to the RPM channels for OCP versions 3.4 through 3.7.

OCP version 3.9 previously shipped a version of 'runc' in it's RPM repository. OCP 3.9 clusters using CRI-O should update 'runc' from the Red Hat Enterprise Linux 7 Extras channel.

Red Hat Enterprise Linux Atomic Host 7 is not affected by this vulnerability as the target runc binaries are stored on a read-only filesystem and cannot be overwritten.

Affected upstream versions: n/a
Fixed upstream versions: v1.0.0
Upstream repository: https://github.com/opencontainers/runc
Upstream fix commit: 6635b4f0c6af3810594d2770f662f34ddc15b40d
CVE-2019-5815: chromium-browser: Heap buffer overflow in Blink
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2019-04-23T00:00:00+00:00

Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.


Affected upstream versions: unspecified < 74.0.3729.108
Fixed upstream versions: 74.0.3729.108
Upstream repository: https://gitlab.gnome.org/GNOME/libxslt
Upstream fix commit: 08b62c25871b38d5d573515ca8a065b4b8f64f6b
CVE-2019-6133: polkit: Temporary auth hijacking via PID reuse and non-atomic fork
Component: polkit
Severity: Important
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-01-09T00:00:00+00:00

A vulnerability was found in polkit. When authentication is performed by a non-root user to perform an administrative task, the authentication is temporarily cached in such a way that a local attacker could impersonate the authorized process, thus gaining access to elevated privileges.


Affected upstream versions: n/a
Fixed upstream versions: 0.116
Upstream repository: https://gitlab.freedesktop.org/polkit/polkit
Upstream fix commit: c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81
CVE-2019-6446: numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution
Component: numpy
Severity: Moderate
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-01-16T00:00:00+00:00

An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.

Statement: Red Hat Enterprise Virtualization Management Appliance includes the vulnerable version of numpy, however it is not used and this vulnerability is not exposed.

Red Hat OpenStack Platform includes a vulnerable version of numpy, however it is not used in a vulnerable manner.

Affected upstream versions: n/a
Fixed upstream versions: v1.16.3
Upstream repository: https://github.com/numpy/numpy
Upstream fix commit: 89b688732b37616c9d26623f81aaee1703c30ffb
CVE-2019-6706: lua: use-after-free in lua_upvaluejoin in lapi.c resulting in denial of service
Component: lua
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-01-10T00:00:00+00:00

Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.


Affected upstream versions: n/a
Fixed upstream versions: v5.3.6
Upstream repository: https://github.com/lua/lua
Upstream fix commit: 89aee84cbc9224f638f3b7951b306d2ee8ecb71e