huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-3674: keylime: Attestation failure when the quote's signature does not validate
Component: keylime
Severity: Low
CWE: CWE-1283 (Mutable Attestation or Measurement Reporting Data)
CVSS v3: 2.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
Public date: 2023-07-12T00:00:00+00:00

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.


Affected upstream versions: <= v7.3.0
Fixed upstream versions: 0:7.3.0-13.el9_3
Upstream repository: https://github.com/keylime/keylime
Upstream fix commit: 95ce3d86bd2c53009108ffda2dcf553312d733db
CVE-2023-37276: python-aiohttp: HTTP request smuggling via llhttp HTTP request parser
Component: python-aiohttp
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2023-07-19T00:00:00+00:00

A flaw was found in aio-libs aiohttp, where it is vulnerable to HTTP request smuggling, caused by a flaw in the aiohttp.web.Application. By sending a specially crafted HTTP(S) request, an attacker can poison the web cache, bypass web application firewall protection, and conduct Cross-site scripting (XSS) attacks.


Affected upstream versions: < 3.8.5
Fixed upstream versions: v3.8.5
Upstream repository: https://github.com/aio-libs/aiohttp
Upstream fix commit: 9337fb3f2ab2b5f38d7e98a194bde6f7e3d16c40
CVE-2023-37453: kernel: usb: out-of-bounds read in read_descriptors
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.6 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-06-20T00:00:00+00:00

An out-of-bounds read issue was found in the USB subsystem in the Linux kernel. This flaw allows a malicious user to crash the system, resulting in a denial of service condition.

Statement: Red Hat Enterprise Linux minor releases prior to 8.9.0 and 9.3.0 are not affected by this CVE as they did not include the upstream commit that introduced this flaw: https://github.com/torvalds/linux/commit/45bf39f8df7f.

Affected upstream versions: n/a
Fixed upstream versions: v6.6
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 1e4c574225cc5a0553115e5eb5787d1474db5b0f
CVE-2023-37460: plexus-archiver: Arbitrary File Creation in AbstractUnArchiver
Component: plexus-archiver
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-07-25T00:00:00+00:00

A flaw was found in the Plexus Archiver. While using AbstractUnArchiver for extracting, an archive might lead to arbitrary file creation and possible remote code execution (RCE). Extracting an archive with an entry in the destination directory as a symbolic link whose target does not exist will bypass the directory destination verification.

Statement: There are factors beyond the attacker's control. For example, the victim's server must have an incomplete SSH server configuration by not having the "~/.ssh/authorized_keys" existent and also having an SSH Server Port externally accessible. So, an attacker would need, even in other scenarios, to gather configuration settings and previous knowledge about the environment in order to have a successful attack. The impact is Important as code execution might happen, but it is not guaranteed.

Red Hat Fuse 7 contains plexus-archiver as a transitive dependency and does not make it vulnerable during runtime, hence the low impact.

Affected upstream versions: < 4.8.0
Fixed upstream versions: plexus-archiver-4.8.0
Upstream repository: https://github.com/codehaus-plexus/plexus-archiver
Upstream fix commit: 54759839fbdf85caf8442076f001d5fd64e0dcb2
CVE-2023-37464: cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE
Component: cjose
Severity: Important
CWE: CWE-327 (Use of a Broken or Risky Cryptographic Algorithm)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2023-07-14T00:00:00+00:00

A vulnerability was found in cjose. The cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the tag length from the actual Authentication Tag provided in the  JSON Web Encryption (JWE). A fixed length of 16 octets must be applied. This flaw allows an attacker to provide a truncated Authentication Tag and modify the JWE.


Affected upstream versions: < 0.6.2.2
Fixed upstream versions: v0.6.2.2
Upstream repository: https://github.com/OpenIDC/cjose
Upstream fix commit: 7325e9a5e71e2fc0e350487ecac7d84acdf0ed5e
CVE-2023-3776: kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-07-06T00:00:00+00:00

A use-after-free vulnerability was found in fw_set_parms in net/sched/cls_fw.c in network scheduler sub-component in the Linux Kernel. This issue occurs due to a missing sanity check during cleanup at the time of failure, leading to a misleading reference. This may allow a local attacker to gain local privilege escalation.


Affected upstream versions: 2.6 < 6.5
Fixed upstream versions: 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0323bce598eea038714f941ce2b22541c46d488f
CVE-2023-3777: kernel: use-after-free in netfilter: nf_tables
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-09-06T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's netfilter: nf_tables component, which can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound, and the chain's owner rule can release the objects in certain circumstances.

Statement: Exploiting this flaw will require CAP_NET_ADMIN access privilege in any user or network namespace.

And,

On non-containerized deployments of Red Hat Enterprise Linux, you can disable user namespaces by setting user.max_user_namespaces to 0:
~~~
echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf
sysctl -p /etc/sysctl.d/userns.conf
~~~
On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.

Affected upstream versions: 5.9 < 6.5
Fixed upstream versions: 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8
CVE-2023-37920: python-certifi: Removal of e-Tugra root certificate
Component: python-certifi
Severity: Low
CWE: CWE-345 (Insufficient Verification of Data Authenticity)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2023-07-25T00:00:00+00:00

A flaw was found in the python-certifi package. This issue occurs when the e-Tugra root certificate in Certifi is removed, resulting in an unspecified error that has an unknown impact and attack vector.

Statement: While eTurgra certificates being marked as untrusted by Mozilla is significant from a trust and security standpoint, this is still considered a low severity issue. The certificates were removed from Mozilla's root store in July 2023, indicating a proactive response to security concerns. Additionally, Red Hat does not run its own root store program, but depends on Mozilla for ssl certificates and Microsoft for signing certificates. 
These certs are included and marked as don't trust and will not be removed until Mozilla removes them. Browsers are most at risk, which already understand and parse 'don't trust after'. If python-fi is required not to trust these certs, they should parse the 'don't trust after' attribute.

Affected upstream versions: >= 2015.04.28, < 2023.07.22
Fixed upstream versions: 2023.07.22
Upstream repository: https://github.com/certifi/python-certifi
Upstream fix commit: 8fb96ed81f71e7097ed11bc4d9b19afd7ea5c909
CVE-2023-3812: kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-10-22T00:00:00+00:00

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.


Affected upstream versions: <= v6.0
Fixed upstream versions: 0:4.18.0-147.94.1.el8_1, 0:4.18.0-193.133.1.el8_2, 0:4.18.0-193.133.1.rt13.184.el8_2, 0:4.18.0-305.120.1.el8_4, 0:4.18.0-305.120.1.rt7.196.el8_4, 0:4.18.0-372.87.1.el8_6, 0:4.18.0-477.43.1.el8_8, 0:4.18.0-513.9.1.el8_9, 0:4.18.0-513.9.1.rt7.311.el8_9, 0:5.14.0-284.40.1.el9_2, 0:5.14.0-284.40.1.rt14.325.el9_2, 0:5.14.0-362.18.1.el9_3, 0:5.14.0-70.80.1.el9_0, 0:5.14.0-70.80.1.rt21.151.el9_0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 363a5328f4b0
CVE-2023-3817: OpenSSL: Excessive time spent checking DH q parameter value
Component: OpenSSL
Severity: Low
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2023-07-31T00:00:00+00:00

A vulnerability was found in OpenSSL. This security issue occurs because the applications that use the DH_check(), DH_check_ex(), or EVP_PKEY_param_check() functions to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source may lead to a denial of service.

Statement: This vulnerability in OpenSSL is considered low severity primarily because it requires specific conditions to be exploited and has limited impact. While excessive computation time during DH parameter checks could potentially lead to denial of service (DoS) attacks, the likelihood of successful exploitation is relatively low. Additionally, the vulnerability mainly affects applications that use certain OpenSSL functions for DH parameter validation, rather than the broader SSL/TLS implementation.

Affected upstream versions: 3.1.0 < 3.1.2, 3.0.0 < 3.0.10, 1.1.1 < 1.1.1v, 1.0.2 < 1.0.2zi
Fixed upstream versions: 1.0.2zi, 1.1.1v, 3.0.10, 3.1.2
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 6a1eb62c29db6cb5eec707f9338aee00f44e26f5
CVE-2023-38201: Keylime: challenge-response protocol bypass during agent registration
Component: Keylime
Severity: Moderate
CWE: CWE-639 (Authorization Bypass Through User-Controlled Key)
CVSS v3: 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2023-08-23T00:00:00+00:00

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.


Affected upstream versions: <= v7.4.0
Fixed upstream versions: 0:6.5.2-6.el9_2
Upstream repository: https://github.com/keylime/keylime
Upstream fix commit: 9e5ac9f25cd400b16d5969f531cee28290543f2a
CVE-2023-3823: php: XML loading external entity without being enabled
Component: php
Severity: Moderate
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2023-08-03T00:00:00+00:00

A flaw was found in PHP due to inadequate validation of user-supplied XML input. By leveraging specially crafted XML code, a remote attacker could obtain sensitive information by viewing the contents of arbitrary files on the system or initiating requests to external systems. This issue may allow unauthorized access to sensitive data and the potential for network scanning of internal and external infrastructure.

Statement: Every application/library/server that is parsing/interacting with XML documents is affected.

Affected upstream versions: 8.0.* < 8.0.30, 8.1.* < 8.1.22, 8.2.* < 8.2.8
Fixed upstream versions: 8.0.30, 8.1.22, 8.2.8
Upstream repository: https://github.com/php/php-src
Upstream fix commit: c283c3ab0ba45d21b2b8745c1f9c7cbfe771c975
CVE-2023-3824: php: phar Buffer mismanagement
Component: php
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2023-08-03T00:00:00+00:00

A flaw was found in PHP that can lead to a buffer overflow and a stack information leak due to improper bounds checking within the phar_dir_read() function. This issue may allow an attacker to initiate memory corruption by compelling the application to open a specially crafted .phar archive, allowing the attacker to corrupt memory or cause a denial of service condition.


Affected upstream versions: 8.0.* < 8.0.30, 8.1.* < 8.1.22, 8.2.* < 8.2.8
Fixed upstream versions: 8.0.30, 8.1.22, 8.2.8
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 80316123f3e9dcce8ac419bd9dd43546e2ccb5ef
CVE-2023-38403: iperf3: memory allocation hazard and crash
Component: iperf3
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-07-11T00:00:00+00:00

An integer overflow flaw was found in the way iperf3 dynamically allocates memory buffers for JSON-formatted messages. A remote attacker could send a specially crafted sequence of bytes on the iperf3 control channel with a specified JSON message length of 0xffffffff to trigger an integer overflow leading the receiving process to abort due to heap corruption. This flaw allows an attacker to use a malicious client to cause a denial of service of an iperf3 server or potentially use a malicious server to cause connecting clients to crash.

Statement: The most common usage of iperf3 is temporary and between trusted devices on private networks. Users may be impacted by this vulnerability if they are hosting publicly available iperf3 servers or are connecting to iperf3 servers they do not control or trust.

Affected upstream versions: n/a
Fixed upstream versions: 3.14
Upstream repository: https://github.com/esnet/iperf
Upstream fix commit: 0ef151550d96cc4460f98832df84b4a1e87c65e9
CVE-2023-38408: openssh: Remote code execution in ssh-agent PKCS#11 support
Component: openssh
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-07-19T00:00:00+00:00

A vulnerability was found in OpenSSH. The PKCS#11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system (the code in /usr/lib is not necessarily safe for loading into ssh-agent). This flaw allows an attacker with control of the forwarded agent-socket on the server and the ability to write to the filesystem of the client host to execute arbitrary code with the privileges of the user running the ssh-agent.

Statement: This issue is marked as Important as we successfully identified that it can do a Remote Code Execution atleast at some circumstances in Red Hat Enterprise Linux 6, 7, 8 and 9 and It can easily compromise the confidentiality, integrity or availability of resources.

Affected upstream versions: n/a
Upstream repository: https://github.com/openbsd/src
Upstream fix commit: f8f5a6b003981bb824329dc987d101977beda7ca
CVE-2023-38409: kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment
Component: kernel
Severity: Moderate
CWE: CWE-129 (Improper Validation of Array Index)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-04-12T00:00:00+00:00

A memory corruption flaw was found in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Framebuffer Console in the Linux kernel. This flaw allows a local attacker to crash the system, leading to a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: fffb0b52d5258554c645c966c6cbef7de50b851d
CVE-2023-38497: rust-cargo: cargo does not respect the umask when extracting dependencies
Component: rust-cargo
Severity: Important
CWE: CWE-276 (Incorrect Default Permissions)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2023-08-03T12:00:00+00:00

A flaw was found in the rust-cargo package. Cargo, as bundled with the Rust compiler, did not respect the umask when extracting dependency tarballs and caching the extraction for future builds. If a dependency contained files with 0777 permissions, another local user could edit the cache of the extracted source code, potentially executing arbitrary code with the privileges of the user running Cargo during the next build.


Affected upstream versions: < 0.72.2
Fixed upstream versions: home-0.5.9
Upstream repository: https://github.com/rust-lang/cargo
Upstream fix commit: d78bbf4bde3c6b95caca7512f537c6f9721426ff
CVE-2023-38559: ghostscript: Out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle could result in DoS
Component: ghostscript
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2023-07-17T00:00:00+00:00

A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs.


Affected upstream versions: <= ghostpdl-10.01.1-gse-10174
Fixed upstream versions: 0:9.27-11.el8, 0:9.54.0-13.el9
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: d81b82c70bc1
CVE-2023-39350: freerdp: Incorrect offset calculation leading to DOS
Component: freerdp
Severity: Moderate
CWE: CWE-191 (Integer Underflow (Wrap or Wraparound))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-08-31T00:00:00+00:00

A flaw was found in FreeRDP. When an insufficient blockLen value is provided and proper length validation is not performed, an Integer Underflow can occur, leading to a Denial of Service (DOS).


Affected upstream versions: < 2.11.0, >= 3.0.0-beta1, < 3.0.0-beta3
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: e204fc8be5a372626b13f66daf2abafe71dbc2dc
CVE-2023-39354: freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-08-31T00:00:00+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes` without  checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Affected upstream versions: < 2.11.0, >= 3.0.0-beta1, < 3.0.0-beta3
Fixed upstream versions: 3.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: cd1da25a87358eb3b5512fd259310e95b19a05ec
CVE-2023-39418: postgresql: MERGE fails to enforce UPDATE or SELECT row security policies
Component: postgresql
Severity: Low
CWE: CWE-1220 (Insufficient Granularity of Access Control)
CVSS v3: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
Public date: 2023-08-10T00:00:00+00:00

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

Statement: This vulnerability introduced with the use of MERGE Command in PostgreSQL 15 and only affects the databases that have used CREATE POLICY to define a row
security policy.

Affected upstream versions: <= PG95-1_01
Fixed upstream versions: 8080020231113134015.63b34585, 8090020231114113548.a75119d5, 9020020231115020618.rhel9, 9030020231120082734.rhel9
Upstream repository: https://git.postgresql.org/gitweb/postgresql.git
Upstream fix commit: cb2ae5741f2458a474ed3c31458d242e678ff229
CVE-2023-39975: krb5: double-free in KDC TGS processing
Component: krb5
Severity: Important
CWE: CWE-415 (Double Free)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-08-16T00:00:00+00:00

A vulnerability was found in MIT krb5, where an authenticated attacker can cause a KDC to free the same pointer twice if it can induce a failure in authorization data handling.

Statement: This vulnerability is rated as an Important because a double-free vulnerability was found in krb5 KDC within the TGS processing logic. The flaw is triggered when an authenticated attacker sends a TGS renew or validate request that induces a failure in authorization data handling. This action causes the same memory pointer to be freed twice, leading to a crash, successful exploitation could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS).

Affected upstream versions: n/a
Fixed upstream versions: krb5-1.22-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: 88a1701b423c13991a8064feeb26952d3641d840
CVE-2023-39976: libqb: Buffer overflow in log_blackbox.c
Component: libqb
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-08-08T00:00:00+00:00

log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.


Affected upstream versions: n/a
Fixed upstream versions: v2.0.8
Upstream repository: https://github.com/ClusterLabs/libqb
Upstream fix commit: 1bbaa929b77113532785c408dd1b41cd0521ffc8
CVE-2023-40025: argo-cd: Argo CD web terminal session doesn't expire
Component: argo-cd
Severity: Moderate
CWE: CWE-613 (Insufficient Session Expiration)
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)
Public date: 2023-08-24T00:00:00+00:00

A flaw was found in Argo CD. Affected versions of Argo CD have a bug where open web terminal sessions do not expire. This bug allows users to send WebSocket messages even if the token has expired. The most straightforward scenario occurs when a user opens the terminal view and leaves it open for an extended period. This flaw allows users to view sensitive information even after logging out.


Affected upstream versions: >= 2.6.0, < 2.6.14, >= 2.7.0, < 2.7.12, = 2.8.0
Fixed upstream versions: v2.9.0
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: e047efa8f9518c54d00d2e4493b64bc4dba98478