huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-3524: kernel: memory leak in ipv6_renew_options()
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-12T00:00:00+00:00

A memory leak flaw was found in the Linux kernel’s IPv6 functionality in how a user triggers the setsockopt of the IPV6_ADDRFORM and IPV6_DSTOPTS type. This flaw allows a user to crash the system if the setsockopt function is being called simultaneously with the IPV6_ADDRFORM type and other processes with the IPV6_DSTOPTS type. This issue is unlikely to happen unless a local process triggers IPV6_ADDRFORM.


Affected upstream versions: n/a
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3c52c6bb831f6335c176a0fc7214e26f43adbd11
CVE-2022-3545: kernel: nfp: use-after-free in area_cache_get()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-08-11T06:30:00+00:00

A vulnerability was found in area_cache_get in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c in the Netronome Flow Processor (NFP) driver in the Linux kernel. This flaw allows a manipulation that may lead to a use-after-free issue.


Affected upstream versions: n/a
Fixed upstream versions: v6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git
Upstream fix commit: 02e1a114fdb71e59ee6770294166c30d437bf86a
CVE-2022-3550: xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c
Component: xorg-x11-server
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-10-17T00:00:00+00:00

A flaw was found in the xorg-x11-server package. A buffer overflow can occur in the _GetCountedString function in xkb/xkb.c due to improper input validation, allowing for possible escalation of privileges, execution of arbitrary code, or a denial of service.

Statement: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore Red Hat Enterprise Linux 8 and 9 have been rated with a moderate severity.

Affected upstream versions: n/a
Fixed upstream versions: xwayland-23.0.99.901
Upstream repository: https://cgit.freedesktop.org/xorg/xserver
Upstream fix commit: 11beef0b7f1ed290348e45618e5fa0d2bffcb72e
CVE-2022-3551: xorg-x11-server: memory leak in ProcXkbGetKbdByName() in xkb/xkb.c
Component: xorg-x11-server
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-17T00:00:00+00:00

A flaw was found in the xorg-x11-server package. The ProcXkbGetKbdByName function in xkb/xkb.c does not release allocated data when an error is encountered, allowing for a memory leak.


Affected upstream versions: n/a
Fixed upstream versions: xwayland-23.0.99.901
Upstream repository: https://cgit.freedesktop.org/xorg/xserver
Upstream fix commit: 18f91b950e22c2a342a4fbc55e9ddf7534a707d2
CVE-2022-3564: kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-10-04T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s L2CAP bluetooth functionality in how a user triggers a race condition by two malicious flows in the L2CAP bluetooth packets. This flaw allows a local or bluetooth connection user to crash the system or potentially escalate privileges.

Statement: This issue is rated between Moderate and Important (similar to the CVE-2022-45934) because of no known attack, and the attack would be complex. Anyway, consider this CVE-2022-3564 as Important because the use-after-free can potentially lead to privilege escalation or a potential remote system crash (and currently, a read after-free that in most cases would not lead to a remote system crash).

Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
Upstream fix commit: 89f9f3cb86b1c63badaf392a83dd661d56cc50b1
CVE-2022-3565: kernel: use-after-free in l1oip timer handlers
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-09-30T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s ISDN over IP tunnel functionality in how a local user triggers the release_card() function called from l1oip_cleanup(). This flaw allows a local user to crash or potentially escalate their privileges on the system.


Affected upstream versions: n/a
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
Upstream fix commit: 2568a7e0832ee30b0a351016d03062ab4e0e0a3f
CVE-2022-3566: kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 4.6 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2022-10-06T06:30:00+00:00

A vulnerability was found in the tcp subsystem in the Linux Kernel, due to a data race around icsk->icsk_af_ops. This issue could allow an attacker to leak internal kernel information.


Affected upstream versions: n/a
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f49cd2f4d6170d27a2c61f1fecb03d8a70c91f57
CVE-2022-3567: kernel: data races around sk->sk_prot
Component: kernel
Severity: Moderate
CWE: CWE-421 (Race Condition During Access to Alternate Channel)
CVSS v3: 5.9 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2022-10-06T00:00:00+00:00

A data race problem was found in sk->sk_prot in the network subsystem in ipv6 in the Linux kernel. This issue occurs while some functions access critical data, leading to a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 364f997b5cfe1db0d63a390fe7c801fa2b3115f6
CVE-2022-3570: libtiff: heap Buffer overflows in tiffcrop.c
Component: libtiff
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-02-24T00:00:00+00:00

A heap-based buffer overflow flaw was found in Libtiff's tiffcrop utility. This issue occurs during the conversion of a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes an out-of-bound access resulting an application crash, eventually leading to a denial of service.


Affected upstream versions: >=3.9.0, <=4.4.0
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: bd94a9b383d8755a27b5a1bc27660b8ad10b094c
CVE-2022-3594: kernel: Rate limit overflow messages in r8152 in intr_callback
Component: kernel
Severity: Moderate
CWE: CWE-779 (Logging of Excessive Data)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2022-10-02T06:30:00+00:00

A vulnerability was found in intr_callback in drivers/net/usb/r8152.c in the BPF component in the Linux Kernel. The manipulation leads to logging excessive data, where an attack can be launched remotely.


Affected upstream versions: n/a
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
Upstream fix commit: 93e2be344a7db169b7119de21ac1bf253b8c6907
CVE-2022-3597: libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix
Component: libtiff
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-03-21T00:00:00+00:00

An out-of-bounds write flaw was found in the _TIFFmemcpy function in libtiff/tif_unix.c in the libtiff package. By persuading a victim to open a specially-crafted TIFF image file, a remote attacker could cause a denial of service condition.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.0
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 236b7191f04c60d09ee836ae13b50f812c841047
CVE-2022-35977: redis: Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands may result with false OOM panic
Component: redis
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-01-17T00:00:00+00:00

A flaw was found in Redis, an in-memory database that persists on disk. This flaw allows authenticated users to issue specially crafted `SETRANGE` and `SORT(_RO)` commands to trigger an integer overflow, resulting in Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic.


Affected upstream versions: >= 7.0, < 7.0.8, >= 6.2, < 6.2.9, < 6.0.17
Fixed upstream versions: 7.2.0
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 1ec82e6e97e1db06a72ca505f9fbf6b981f31ef7
CVE-2022-3598: libtiff: out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-06-13T00:00:00+00:00

An out-of-bounds write flaw was found in the extractContigSamplesShifted24bits function in tools/tiffcrop.c in the libtiff package. By persuading a victim to open a specially-crafted TIFF image file, a remote attacker could cause a denial of service condition.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.0
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: cfbb883bf6ea7bedcb04177cc4e52d304522fdff
CVE-2022-3599: libtiff: out-of-bounds read in writeSingleSection in tools/tiffcrop.c
Component: libtiff
Severity: Moderate
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-02-25T00:00:00+00:00

An out-of-bounds read flaw was found in the writeSingleSection function in tools/tiffcrop.c in the libtiff package. By persuading a victim to open a specially-crafted TIFF image file, a remote attacker could cause a denial of service condition.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.0
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: e813112545942107551433d61afd16ac094ff246
CVE-2022-3602: OpenSSL: X.509 Email Address Buffer Overflow
Component: OpenSSL
Severity: Important
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-11-01T00:00:00+00:00

A stack-based buffer overflow was found in the way OpenSSL processes X.509 certificates with a specially crafted email address field. This issue could cause a server or a client application compiled with OpenSSL to crash when trying to process the malicious certificate.

Statement: As per upstream, the most common situation where this can be triggered is when a server requests client authentication after a malicious client connects. A client connecting to a malicious server is also believed to be vulnerable in the same manner. Only OpenSSL versions 3.0.0 to 3.0.6 are vulnerable to this attack.
The OpenSSL binaries in Red Hat Enterprise Linux 9 are compiled with Stack Smashing Protection. Also during the build process, the compiler rearranges the variables in a way that the buffer overflow is only able to overwrite the stack canaries, limiting the maximum impact of this flaw to denial of service. Remote code execution may not be possible in such cases.

Red Hat OpenStack Platform 17 does not ship OpenSSL and is not directly affected by the flaw. However, container images which product ship are of RHEL 9 which were affected. RHOSP have fixed this by respining container images through the following errata: https://access.redhat.com/errata/RHBA-2022:7429

Affected upstream versions: Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6)
Fixed upstream versions: 3.0-POST-CLANG-FORMAT-WEBKIT
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: fe3b639dc19b325846f4f6801f2f4604f56e3de3
CVE-2022-36021: redis: Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow
Component: redis
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-28T00:00:00+00:00

A vulnerability was found in Redis. This flaw allows an authenticated to use string matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial of service attack on Redis, causing it to hang and consume 100% of CPU time.


Affected upstream versions: < 6.0.18, >= 6.2.0, < 6.2.11, >= 7.0.0, < 7.0.9
Fixed upstream versions: 7.2.0
Upstream repository: https://github.com/redis/redis
Upstream fix commit: dcbfcb916ca1a269b3feef86ee86835294758f84
CVE-2022-36056: app-containers/cosign: false positive verification
Component: app-containers/cosign
Severity: Low
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2022-09-14T00:00:00+00:00

A vulnerability was found in cosign, where it incorrectly verified an artifact when the embedded rekorBundle does not reference the given signature. This flaw allows an attacker to exploit integrity and confidentiality.


Affected upstream versions: < 1.12.0
Fixed upstream versions: v1.12.0
Upstream repository: https://github.com/sigstore/cosign
Upstream fix commit: 80b79ed8b4d28ccbce3d279fd273606b5cddcc25
CVE-2022-36087: python-oauthlib: DoS when attacker provides malicious IPV6 URI
Component: python-oauthlib
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-09-09T00:00:00+00:00

A flaw was found in python-oauthlib. This flaw allows an attacker providing a malicious redirect URI to cause a denial of service to OAuthLib's web application.


Affected upstream versions: >= 3.1.1, < 3.2.1
Fixed upstream versions: v3.2.2
Upstream repository: https://github.com/oauthlib/oauthlib
Upstream fix commit: 2e40b412c844ecc4673c3fa3f72181f228bdbacd
CVE-2022-3619: kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 4.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2022-10-20T00:00:00+00:00

A memory leak flaw was found in the Linux kernel’s L2CAP bluetooth functionality. This issue occurs when a user generates malicious packets, triggering the l2cap_recv_acldata function. This flaw allows a local or bluetooth connection user to potentially crash the system.


Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
Upstream fix commit: 97097c85c088e11651146da32a4e1cdb9dfa6193
CVE-2022-3623: kernel: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry
Component: kernel
Severity: Moderate
CWE: CWE-123 (Write-what-where Condition)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2022-09-01T06:30:00+00:00

A vulnerability was found in follow_page_pte in mm/gup.c in the Linux Kernel. This issue occurs due to a race problem which can poison the page table entry and cause a denial-of-service.


Affected upstream versions: n/a
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
Upstream fix commit: fac35ba763ed07ba93154c95ffc0c4a55023707f
CVE-2022-3625: kernel: use-after-free after failed devlink reload in devlink_param_get
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-08-09T08:30:00+00:00

A flaw was found in the Netlink device interface implementation in the Linux kernel that improperly handled certain error conditions, leading to a use-after-free issue with some network device drivers. A local attacker with admin access to the network device could use this to cause a denial of service (system crash) or execute arbitrary code.


Affected upstream versions: n/a
Fixed upstream versions: v6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git
Upstream fix commit: 6b4db2e528f650c7fb712961aac36455468d5902
CVE-2022-3626: libtiff: out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c
Component: libtiff
Severity: Moderate
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-05-22T00:00:00+00:00

An out-of-bounds write flaw was found in the _TIFFmemset function in libtiff/tif_unix.c in the libtiff package. By persuading a victim to open a specially-crafted TIFF image file, a remote attacker could cause a denial of service condition.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.0
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 236b7191f04c60d09ee836ae13b50f812c841047
CVE-2022-3627: libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c
Component: libtiff
Severity: Moderate
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-03-21T00:00:00+00:00

An out-of-bounds write flaw was found in the _TIFFmemcpy function in libtiff/tif_unix.c in the libtiff package. By persuading a victim to open a specially-crafted TIFF image file, a remote attacker could cause a denial of service condition.


Affected upstream versions: <=4.4.0
Fixed upstream versions: v4.5.0
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 236b7191f04c60d09ee836ae13b50f812c841047
CVE-2022-3628: kernel: USB-accessible buffer overflow in brcmfmac
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-10-22T09:00:00+00:00

A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges.


Affected upstream versions: Linux kernel 6.1-rc5
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
Upstream fix commit: 6788ba8aed4e28e90f72d68a9d794e34eac17295
CVE-2022-3640: kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2022-10-17T12:00:00+00:00

A vulnerability was found in the Linux Kernel in the l2cap_conn_del in net/bluetooth/l2cap_core.c function in the Bluetooth component. This issue leads to a use-after-free problem.


Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
Upstream fix commit: 42cf46dea905a80f6de218e837ba4d4cc33d6979
CVE-2022-36879: kernel: xfrm_expand_policies() in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-06-02T00:00:00+00:00

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). An error while resolving policies in xfrm_bundle_lookup causes the refcount to drop twice, leading to a possible crash and a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v5.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: f85daf0e725358be78dfd208dea5fd665d8cb901
CVE-2022-36946: kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c
Component: kernel
Severity: Moderate
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-07-26T09:00:00+00:00

A memory corruption flaw was found in the Linux kernel’s Netfilter subsystem in the way a local user uses the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash the system or a remote user to crash the system when the libnetfilter_queue is used by a local user.


Affected upstream versions: n/a
Fixed upstream versions: v5.19
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164
CVE-2022-37032: frr: out-of-bounds read in the BGP daemon may lead to information disclosure or denial of service
Component: frr
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2022-09-20T00:00:00+00:00

A vulnerability was found in FRRouting. This issue occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c. An out-of-bounds read in the BGP daemon may lead to a segmentation fault and a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: frr-8.4
Upstream repository: https://github.com/FRRouting/frr
Upstream fix commit: ff6db1027f8f36df657ff2e5ea167773752537ed
CVE-2022-37434: zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field
Component: zlib
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2022-08-05T00:00:00+00:00

A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large gzip header extra field. This flaw is only applicable in the call inflateGetHeader.

Statement: While some Red Hat Products bundle the affected zlib source code, in many cases it is not possible for an attacker to trigger the vulnerable function.

Affected upstream versions: <= v1.2.12
Fixed upstream versions: v1.2.13
Upstream repository: https://github.com/madler/zlib
Upstream fix commit: eff308af425b67093bab25f80f1ae950166bece1
CVE-2022-3786: OpenSSL: X.509 Email Address Variable Length Buffer Overflow
Component: OpenSSL
Severity: Important
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-11-01T00:00:00+00:00

A stack-based buffer overflow was found in the way OpenSSL processes X.509 certificates with a specially crafted email address field. This issue could cause a server or a client application compiled with OpenSSL to crash or possibly execute remote code when trying to process the malicious certificate.

Statement: As per upstream, the most common situation where this can be triggered is when a server requests client authentication after a malicious client connects. A client connecting to a malicious server is also believed to be vulnerable in the same manner. Only OpenSSL versions 3.0.0 to 3.0.6 are vulnerable to this attack.

Affected upstream versions: 3.0.0 < 3.0.7
Fixed upstream versions: 3.0.7
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: c42165b5706e42f67ef8ef4c351a9a4c5d21639a