VARIoT IoT vulnerabilities database

sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. OpenSSH is prone to multiple denial-of-service vulnerabilities. An attacker can leverage these issues to crash the affected application, denying service to legitimate users. Versions prior to OpenSSH 7.4 are vulnerable. ========================================================================== Ubuntu Security Notice USN-3809-2 August 12, 2021 openssh regression ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS Summary: USN-3809-1 introduced a regression in OpenSSH. Software Description: - openssh: secure shell (SSH) for secure access to remote machines Details: USN-3809-1 fixed vulnerabilities in OpenSSH. The update for CVE-2018-15473 was incomplete and could introduce a regression in certain environments. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Robert Swiecki discovered that OpenSSH incorrectly handled certain messages. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10708) It was discovered that OpenSSH incorrectly handled certain requests. An attacker could possibly use this issue to access sensitive information. (CVE-2018-15473) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: openssh-server 1:7.6p1-4ubuntu0.5 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3809-2 https://ubuntu.com/security/notices/USN-3809-1 https://launchpad.net/bugs/1934501 Package Information: https://launchpad.net/ubuntu/+source/openssh/1:7.6p1-4ubuntu0.5

Buffer overflow on Dasan GPON ONT WiFi Router H640X 12.02-01121 2.77p1-1124 and 3.03p2-1146 devices allows remote attackers to execute arbitrary code via a long POST request to the login_action function in /cgi-bin/login_action.cgi (aka cgipage.cgi). Dasan GPON ONT WiFi Router H640X The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. DasanGPONONTWiFiRouter is a wireless router device from DASANNetworks, Korea. A buffer overflow vulnerability exists in DasanGPONONTWiFiRouterH640X12.02-0112, 2.77p1-1124, and 3.03p2-1146

Zhejiang Dahua Network Hard Disk Video Recorder DH-NVR2104HS-S1 is a network hard disk video recorder with integrated 4-way 10 / 100Mbps switch port and support 1080P HD real-time preview. Zhejiang Dahua Network Hard Disk Video Recorder DH-NVR2104HS-S1 has a logic design vulnerability. An attacker can use a vulnerability to construct a malicious url login web interface without client authentication, and construct a url suffix to perform a blast login.

Rui Wei RW-950S is a video camera. The Ruiwei RW-950S camera has an elevation of privilege vulnerability, allowing an attacker to use the vulnerability to elevate the guest user to super administrator rights.

A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist. Dnsmasq Contains an access control vulnerability.Information may be tampered with. Dnsmasq is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. ========================================================================== Ubuntu Security Notice USN-4924-1 April 22, 2021 dnsmasq vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Dnsmasq. Software Description: - dnsmasq: Small caching DNS proxy and DHCP/TFTP server Details: It was discovered that Dnsmasq incorrectly handled certain wildcard synthesized NSEC records. (CVE-2017-15107) It was discovered that Dnsmasq incorrectly handled certain large DNS packets. A remote attacker could possibly use this issue to cause Dnsmasq to crash, resulting in a denial of service. (CVE-2019-14513) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: dnsmasq 2.75-1ubuntu0.16.04.10 dnsmasq-base 2.75-1ubuntu0.16.04.10 dnsmasq-utils 2.75-1ubuntu0.16.04.10 After a standard system update you need to reboot your computer to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4924-1 CVE-2017-15107, CVE-2019-14513 Package Information: https://launchpad.net/ubuntu/+source/dnsmasq/2.75-1ubuntu0.16.04.10

Input validation error in Intel MinnowBoard 3 Firmware versions prior to 0.65 allow local attacker to cause denial of service via UEFI APIs. Intel MinnowBoard 3 Contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. IntelMinnowBoard3 is a computer motherboard from Intel Corporation of the United States. An input validation vulnerability exists in IntelMinnowBoard3

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. jQuery is an open source, cross-browser JavaScript library developed by American John Resig programmers. The library simplifies the operation between HTML and JavaScript, and has the characteristics of modularization and plug-in extension. A cross-site scripting vulnerability exists in jQuery versions prior to 3.0.0. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update Advisory ID: RHSA-2020:4847-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:4847 Issue date: 2020-11-03 CVE Names: CVE-2015-9251 CVE-2016-10735 CVE-2018-14040 CVE-2018-14042 CVE-2019-8331 CVE-2019-10146 CVE-2019-10179 CVE-2019-10221 CVE-2019-11358 CVE-2020-1721 CVE-2020-11022 CVE-2020-11023 CVE-2020-15720 ==================================================================== 1. Summary: An update for the pki-core:10.6 and pki-deps:10.6 modules is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Security Fix(es): * jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251) * bootstrap: XSS in the data-target attribute (CVE-2016-10735) * bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040) * bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042) * bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331) * jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358) * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022) * jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023) * pki: Dogtag's python client does not validate certificates (CVE-2020-15720) * pki-core: Reflected XSS in 'path length' constraint field in CA's Agent page (CVE-2019-10146) * pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab (CVE-2019-10179) * pki-core: Reflected XSS in getcookies?url= endpoint in CA (CVE-2019-10221) * pki-core: KRA vulnerable to reflected XSS via the getPk12 page (CVE-2020-1721) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1376706 - restore SerialNumber tag in caManualRenewal xml 1399546 - CVE-2015-9251 jquery: Cross-site scripting via cross-domain ajax requests 1406505 - KRA ECC installation failed with shared tomcat 1601614 - CVE-2018-14040 bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute 1601617 - CVE-2018-14042 bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip 1666907 - CC: Enable AIA OCSP cert checking for entire cert chain 1668097 - CVE-2016-10735 bootstrap: XSS in the data-target attribute 1686454 - CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute 1695901 - CVE-2019-10179 pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab 1701972 - CVE-2019-11358 jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection 1706521 - CA - SubjectAltNameExtInput does not display text fields to the enrollment page 1710171 - CVE-2019-10146 pki-core: Reflected XSS in 'path length' constraint field in CA's Agent page 1721684 - Rebase pki-servlet-engine to 9.0.30 1724433 - caTransportCert.cfg contains MD2/MD5withRSA as signingAlgsAllowed. 1732565 - CVE-2019-10221 pki-core: Reflected XSS in getcookies?url= endpoint in CA 1732981 - When nuxwdog is enabled pkidaemon status shows instances as stopped. 1777579 - CVE-2020-1721 pki-core: KRA vulnerable to reflected XSS via the getPk12 page 1805541 - [RFE] CA Certificate Transparency with Embedded Signed Certificate Time stamp 1817247 - Upgrade to 10.8.3 breaks PKI Tomcat Server 1821851 - [RFE] Provide SSLEngine via JSSProvider for use with PKI 1822246 - JSS - NativeProxy never calls releaseNativeResources - Memory Leak 1824939 - JSS: add RSA PSS support - RHEL 8.3 1824948 - add RSA PSS support - RHEL 8.3 1825998 - CertificatePoliciesExtDefault MAX_NUM_POLICIES hardcoded limit 1828406 - CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method 1842734 - CVE-2019-10179 pki-core: pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab [rhel-8] 1842736 - CVE-2019-10146 pki-core: Reflected Cross-Site Scripting in 'path length' constraint field in CA's Agent page [rhel-8] 1843537 - Able to Perform PKI CLI operations like cert request and approval without nssdb password 1845447 - pkispawn fails in FIPS mode: AJP connector has secretRequired="true" but no secret 1850004 - CVE-2020-11023 jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution 1854043 - /usr/bin/PrettyPrintCert is failing with a ClassNotFoundException 1854959 - ca-profile-add with Netscape extensions nsCertSSLClient and nsCertEmail in the profile gets stuck in processing 1855273 - CVE-2020-15720 pki: Dogtag's python client does not validate certificates 1855319 - Not able to launch pkiconsole 1856368 - kra-key-generate request is failing 1857933 - CA Installation is failing with ncipher v12.30 HSM 1861911 - pki cli ca-cert-request-approve hangs over crmf request from client-cert-request 1869893 - Common certificates are missing in CS.cfg on shared PKI instance 1871064 - replica install failing during pki-ca component configuration 1873235 - pki ca-user-cert-add with secure port failed with 'SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT' 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src.rpm apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.src.rpm apache-commons-net-3.6-3.module+el8.3.0+6805+72837426.src.rpm bea-stax-1.2.0-16.module+el8.1.0+3366+6dfb954c.src.rpm glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c.src.rpm glassfish-jaxb-2.2.11-11.module+el8.1.0+3366+6dfb954c.src.rpm glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c.src.rpm jackson-annotations-2.10.0-1.module+el8.2.0+5059+3eb3af25.src.rpm jackson-core-2.10.0-1.module+el8.2.0+5059+3eb3af25.src.rpm jackson-databind-2.10.0-1.module+el8.2.0+5059+3eb3af25.src.rpm jackson-jaxrs-providers-2.9.9-1.module+el8.1.0+3832+9784644d.src.rpm jackson-module-jaxb-annotations-2.7.6-4.module+el8.1.0+3366+6dfb954c.src.rpm jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c.src.rpm javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c.src.rpm jss-4.7.3-1.module+el8.3.0+8058+d5cd4219.src.rpm ldapjdk-4.22.0-1.module+el8.3.0+6784+6e1e4c62.src.rpm pki-core-10.9.4-1.module+el8.3.0+8058+d5cd4219.src.rpm pki-servlet-engine-9.0.30-1.module+el8.3.0+6730+8f9c6254.src.rpm python-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c.src.rpm relaxngDatatype-2011.1-7.module+el8.1.0+3366+6dfb954c.src.rpm resteasy-3.0.26-3.module+el8.2.0+5723+4574fbff.src.rpm slf4j-1.7.25-4.module+el8.1.0+3366+6dfb954c.src.rpm stax-ex-1.7.7-8.module+el8.2.0+5723+4574fbff.src.rpm tomcatjss-7.5.0-1.module+el8.3.0+7355+c59bcbd9.src.rpm velocity-1.7-24.module+el8.1.0+3366+6dfb954c.src.rpm xalan-j2-2.7.1-38.module+el8.1.0+3366+6dfb954c.src.rpm xerces-j2-2.11.0-34.module+el8.1.0+3366+6dfb954c.src.rpm xml-commons-apis-1.4.01-25.module+el8.1.0+3366+6dfb954c.src.rpm xml-commons-resolver-1.2-26.module+el8.1.0+3366+6dfb954c.src.rpm xmlstreambuffer-1.5.4-8.module+el8.2.0+5723+4574fbff.src.rpm xsom-0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src.rpm aarch64: jss-4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64.rpm jss-debuginfo-4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64.rpm jss-debugsource-4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64.rpm jss-javadoc-4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64.rpm pki-core-debuginfo-10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64.rpm pki-core-debugsource-10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64.rpm pki-symkey-10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64.rpm pki-symkey-debuginfo-10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64.rpm pki-tools-10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64.rpm pki-tools-debuginfo-10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64.rpm python-nss-debugsource-1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64.rpm python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64.rpm python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64.rpm python3-nss-debuginfo-1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64.rpm noarch: apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch.rpm apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch.rpm apache-commons-net-3.6-3.module+el8.3.0+6805+72837426.noarch.rpm bea-stax-api-1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch.rpm glassfish-fastinfoset-1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch.rpm glassfish-jaxb-api-2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch.rpm glassfish-jaxb-core-2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch.rpm glassfish-jaxb-runtime-2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch.rpm glassfish-jaxb-txw2-2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch.rpm jackson-annotations-2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch.rpm jackson-core-2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch.rpm jackson-databind-2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch.rpm jackson-jaxrs-json-provider-2.9.9-1.module+el8.1.0+3832+9784644d.noarch.rpm jackson-jaxrs-providers-2.9.9-1.module+el8.1.0+3832+9784644d.noarch.rpm jackson-module-jaxb-annotations-2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch.rpm jakarta-commons-httpclient-3.1-28.module+el8.1.0+3366+6dfb954c.noarch.rpm javassist-3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch.rpm javassist-javadoc-3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch.rpm ldapjdk-4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch.rpm ldapjdk-javadoc-4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch.rpm pki-base-10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch.rpm pki-base-java-10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch.rpm pki-ca-10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch.rpm pki-kra-10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch.rpm pki-server-10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch.rpm pki-servlet-4.0-api-9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch.rpm pki-servlet-engine-9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch.rpm python3-pki-10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch.rpm relaxngDatatype-2011.1-7.module+el8.1.0+3366+6dfb954c.noarch.rpm resteasy-3.0.26-3.module+el8.2.0+5723+4574fbff.noarch.rpm slf4j-1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch.rpm slf4j-jdk14-1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch.rpm stax-ex-1.7.7-8.module+el8.2.0+5723+4574fbff.noarch.rpm tomcatjss-7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch.rpm velocity-1.7-24.module+el8.1.0+3366+6dfb954c.noarch.rpm xalan-j2-2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch.rpm xerces-j2-2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch.rpm xml-commons-apis-1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch.rpm xml-commons-resolver-1.2-26.module+el8.1.0+3366+6dfb954c.noarch.rpm xmlstreambuffer-1.5.4-8.module+el8.2.0+5723+4574fbff.noarch.rpm xsom-0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch.rpm ppc64le: jss-4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le.rpm jss-debuginfo-4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le.rpm jss-debugsource-4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le.rpm jss-javadoc-4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le.rpm pki-core-debuginfo-10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le.rpm pki-core-debugsource-10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le.rpm pki-symkey-10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le.rpm pki-symkey-debuginfo-10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le.rpm pki-tools-10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le.rpm pki-tools-debuginfo-10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le.rpm python-nss-debugsource-1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le.rpm python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le.rpm python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le.rpm python3-nss-debuginfo-1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le.rpm s390x: jss-4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x.rpm jss-debuginfo-4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x.rpm jss-debugsource-4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x.rpm jss-javadoc-4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x.rpm pki-core-debuginfo-10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x.rpm pki-core-debugsource-10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x.rpm pki-symkey-10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x.rpm pki-symkey-debuginfo-10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x.rpm pki-tools-10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x.rpm pki-tools-debuginfo-10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x.rpm python-nss-debugsource-1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x.rpm python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x.rpm python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x.rpm python3-nss-debuginfo-1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x.rpm x86_64: jss-4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64.rpm jss-debuginfo-4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64.rpm jss-debugsource-4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64.rpm jss-javadoc-4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64.rpm pki-core-debuginfo-10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64.rpm pki-core-debugsource-10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64.rpm pki-symkey-10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64.rpm pki-symkey-debuginfo-10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64.rpm pki-tools-10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64.rpm pki-tools-debuginfo-10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64.rpm python-nss-debugsource-1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64.rpm python-nss-doc-1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64.rpm python3-nss-1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64.rpm python3-nss-debuginfo-1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-9251 https://access.redhat.com/security/cve/CVE-2016-10735 https://access.redhat.com/security/cve/CVE-2018-14040 https://access.redhat.com/security/cve/CVE-2018-14042 https://access.redhat.com/security/cve/CVE-2019-8331 https://access.redhat.com/security/cve/CVE-2019-10146 https://access.redhat.com/security/cve/CVE-2019-10179 https://access.redhat.com/security/cve/CVE-2019-10221 https://access.redhat.com/security/cve/CVE-2019-11358 https://access.redhat.com/security/cve/CVE-2020-1721 https://access.redhat.com/security/cve/CVE-2020-11022 https://access.redhat.com/security/cve/CVE-2020-11023 https://access.redhat.com/security/cve/CVE-2020-15720 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX6I3GNzjgjWX9erEAQiK8w//dJasljC8LcJheQtDfUXL+EG52rGjpyxU B5iSYariTDhQOFRt22udOjbdBaISRD77ozLdz0LusA1NBtR3hQ49ryIWyMUxLNsi 46FLY44YxMY7uofZJExUJoEkN39CYwXqIOaaGnZ8mkn4QVdoKG+UBvBL3gKcE3uk h+PWQaasCHL96ZuLz5OB1ya0StcgVcnIDOJleP0f4TGI8w5LKSj1bdJz2fD1H+JP iBa3QVedFanQpWVqCAjaw2lH+fQUB4F936XltKsqCKD9uaX1A2m+xAMZ8wuHcCUl Nudj4LwT06xGd36tyQVh+0ZolB7aKmErYNicv25VNz1c/QlmXCiBJi3Y62/a7La0 t8bGYPE01RTI1YvLs8c+Bw0SH+NcGPGtLw9Vd8w9hFYed7JUP6Iv9v/lSfbiUXDD R5gcEJPQtN2pRsqZaCmQCY2i9aNwjmyZ3wggmXJ4DtEy5adTmAmTL/Alf8kx1rfC UjfeBWVQ01QMIcwNCZM9ly6au06fioPjHhusCFPqPWnGCoT6mysF//ZOhLemUQci ecbYX+JbbUnbyWQPVIBhV/Zj4D6SqNtY5rciorwTedC8n2zX/8ORTCn1PZz8Oc1S ebaoJI0TA2DuiUtPkKz1REcD8rnSCxPIhCYWfb4nIXKGjBINW8ueyG27VPprkSOh +Ybici9RaUE=VLtX -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. JIRA issues fixed (https://issues.jboss.org/): JBEAP-23864 - (7.4.z) Upgrade xmlsec from 2.1.7.redhat-00001 to 2.2.3.redhat-00001 JBEAP-23865 - [GSS](7.4.z) Upgrade Apache CXF from 3.3.13.redhat-00001 to 3.4.10.redhat-00001 JBEAP-23866 - (7.4.z) Upgrade wss4j from 2.2.7.redhat-00001 to 2.3.3.redhat-00001 JBEAP-23928 - Tracker bug for the EAP 7.4.9 release for RHEL-9 JBEAP-24055 - (7.4.z) Upgrade HAL from 3.3.15.Final-redhat-00001 to 3.3.16.Final-redhat-00001 JBEAP-24081 - (7.4.z) Upgrade Elytron from 1.15.14.Final-redhat-00001 to 1.15.15.Final-redhat-00001 JBEAP-24095 - (7.4.z) Upgrade elytron-web from 1.9.2.Final-redhat-00001 to 1.9.3.Final-redhat-00001 JBEAP-24100 - [GSS](7.4.z) Upgrade Undertow from 2.2.20.SP1-redhat-00001 to 2.2.22.SP3-redhat-00001 JBEAP-24127 - (7.4.z) UNDERTOW-2123 - Update AsyncContextImpl.dispatch to use proper value JBEAP-24128 - (7.4.z) Upgrade Hibernate Search from 5.10.7.Final-redhat-00001 to 5.10.13.Final-redhat-00001 JBEAP-24132 - [GSS](7.4.z) Upgrade Ironjacamar from 1.5.3.SP2-redhat-00001 to 1.5.10.Final-redhat-00001 JBEAP-24147 - (7.4.z) Upgrade jboss-ejb-client from 4.0.45.Final-redhat-00001 to 4.0.49.Final-redhat-00001 JBEAP-24167 - (7.4.z) Upgrade WildFly Core from 15.0.19.Final-redhat-00001 to 15.0.21.Final-redhat-00002 JBEAP-24191 - [GSS](7.4.z) Upgrade remoting from 5.0.26.SP1-redhat-00001 to 5.0.27.Final-redhat-00001 JBEAP-24195 - [GSS](7.4.z) Upgrade JSF API from 3.0.0.SP06-redhat-00001 to 3.0.0.SP07-redhat-00001 JBEAP-24207 - (7.4.z) Upgrade Soteria from 1.0.1.redhat-00002 to 1.0.1.redhat-00003 JBEAP-24248 - (7.4.z) ELY-2492 - Upgrade sshd-common in Elytron from 2.7.0 to 2.9.2 JBEAP-24426 - (7.4.z) Upgrade Elytron from 1.15.15.Final-redhat-00001 to 1.15.16.Final-redhat-00001 JBEAP-24427 - (7.4.z) Upgrade WildFly Core from 15.0.21.Final-redhat-00002 to 15.0.22.Final-redhat-00001 7. Description: Red Hat Fuse provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat A-MQ is a standards compliant messaging system that is tailored for use in mission critical applications. It includes bug fixes, which are documented in the patch notes accompanying the package on the download page. See the download link given in the references section below. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Installation instructions are located in the download section of the customer portal. The References section of this erratum contains a download link (you must log in to download the update). The purpose of this text-only errata is to inform you about the security issues fixed in this release. Security Fix(es): * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512) * HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513) * HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514) * HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515) * HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516) * HTTP/2: request for large response leads to denial of service (CVE-2019-9517) * HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518) * infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods (CVE-2019-10174) * spring-security-core: mishandling of user passwords allows logging in with a password of NULL (CVE-2019-11272) * jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution (CVE-2019-12384) * jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379) * xmlrpc: Deserialization of server-side exception from faultCause in XMLRPC error response (CVE-2019-17570) * js-jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251) * logback: Serialization vulnerability in SocketServer and ServerSocketReceiver (CVE-2017-5929) * js-jquery: XSS in responses from cross-origin ajax requests (CVE-2017-16012) * apache-commons-compress: ZipArchiveInputStream.read() fails to identify correct EOF allowing for DoS via crafted zip (CVE-2018-11771) * spring-data-api: potential information disclosure through maliciously crafted example value in ExampleMatcher (CVE-2019-3802) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) * shiro: Cookie padding oracle vulnerability with default configuration (CVE-2019-12422) * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message. 1725807 - CVE-2019-12384 jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution 1728993 - CVE-2019-11272 spring-security-core: mishandling of user passwords allows logging in with a password of NULL 1730316 - CVE-2019-3802 spring-data-api: potential information disclosure through maliciously crafted example value in ExampleMatcher 1735645 - CVE-2019-9512 HTTP/2: flood using PING frames results in unbounded memory growth 1735741 - CVE-2019-9513 HTTP/2: flood using PRIORITY frames results in excessive resource consumption 1735744 - CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth 1735745 - CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory growth 1735749 - CVE-2019-9518 HTTP/2: flood using empty frames results in excessive resource consumption 1737517 - CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution 1741864 - CVE-2019-9516 HTTP/2: 0-length headers lead to denial of service 1741868 - CVE-2019-9517 HTTP/2: request for large response leads to denial of service 1752962 - CVE-2019-14439 jackson-databind: Polymorphic typing issue related to logback/JNDI 1774726 - CVE-2019-12422 shiro: Cookie padding oracle vulnerability with default configuration 1775193 - CVE-2019-17570 xmlrpc: Deserialization of server-side exception from faultCause in XMLRPC error response 5. OctoberCMS is a CMS similar to WordPress, but with much less “fluff”. SECURELI.com's team identified the latest version of OctoberCMS relying on Bootstrap 3.3.7, jQuery 1.11.1, and jQuery 3.3.1. All of these dependencies are vulnerable. -------------------------------------------------- /october/themes/demo/assets/vendor/bootstrap.js bootstrap 3.3.7 has known vulnerabilities severity: high issue: 28236 summary: XSS in data-template, data-content and data-title properties of tooltip/popover CVE-2019-8331 https://github.com/twbs/bootstrap/issues/28236 severity: medium issue: 20184 summary: XSS in data-target property of scrollspy CVE-2018-14041 https://github.com/twbs/bootstrap/issues/20184 severity: medium issue: 20184 summary: XSS in collapse data-parent attribute CVE-2018-14040 https://github.com/twbs/bootstrap/issues/20184 severity: medium issue: 20184 summary: XSS in data-container property of tooltip CVE-2018-14042 https://github.com/twbs/bootstrap/issues/20184 -------------------------------------------------- /october/themes/demo/assets/vendor/jquery.js jquery 1.11.1 has known vulnerabilities severity: medium issue: 2432 summary: 3rd party CORS request may execute CVE-2015-9251 https://github.com/jquery/jquery/issues/2432 http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/ https://nvd.nist.gov/vuln/detail/CVE-2015-9251 http://research.insecurelabs.org/jquery/test/ severity: medium CVE-2015-9251 issue: 11974 summary: parseHTML() executes scripts in event handlers https://bugs.jquery.com/ticket/11974 https://nvd.nist.gov/vuln/detail/CVE-2015-9251 http://research.insecurelabs.org/jquery/test/ severity: low CVE-2019-11358 summary: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ https://nvd.nist.gov/vuln/detail/CVE-2019-11358 https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b -------------------------------------------------- /october/modules/backend/assets/js/vendor/jquery-and-migrate.min.js jquery 3.3.1 has known vulnerabilities severity: low CVE-2019-11358 summary: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ https://nvd.nist.gov/vuln/detail/CVE-2019-11358 https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b All of these vulnerabilities were identified using RetireJS (https://retirejs.github.io/retire.js/), which identifies open source dependency vulnerabilities. Research provided by SECURELI.com

A vulnerability in one of the diagnostic test CLI commands on Cisco Industrial Ethernet 4010 Series Switches running Cisco IOS Software could allow an authenticated, local attacker to impact the stability of the device. This could result in arbitrary code execution or a denial of service (DoS) condition. The attacker has to have valid user credentials at privilege level 15. The vulnerability is due to a diagnostic test CLI command that allows the attacker to write to the device memory. An attacker could exploit this vulnerability by authenticating to the targeted device and issuing a specific diagnostic test command at the CLI. An exploit could allow the attacker to overwrite system memory locations, which could have a negative impact on the stability of the device. Cisco Bug IDs: CSCvf71150. Vendors have confirmed this vulnerability Bug ID CSCvf71150 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state

A vulnerability in the Policy and Charging Rules Function (PCRF) of the Cisco Policy Suite (CPS) could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The attacker would also have to have access to the internal VLAN where CPS is deployed. The vulnerability is due to incorrect permissions of certain system files and not sufficiently protecting sensitive data that is at rest. An attacker could exploit the vulnerability by using certain tools available on the internal network interface to request and view system files. An exploit could allow the attacker to find out sensitive information about the application. Cisco Bug IDs: CSCvf77666. Vendors have confirmed this vulnerability Bug ID CSCvf77666 It is released as.Information may be obtained. This may aid in further attacks. This solution provides functions such as user-based business rules, real-time management of applications and network resources. Policy and Charging Rules Function (PCRF) is one of the policy and rule setting functional components

IP-COM enterprise router is a high-performance router and deep Internet behavior management equipment of Shenzhen Heweishun Network Technology Co., Ltd. Shenzhen Heweishun Network Technology Co., Ltd. IP-COM enterprise router has an unauthorized access vulnerability. Attackers can use this vulnerability to obtain sensitive information such as wifi passwords, management background account passwords, and broadband dial-up accounts.

Intelligent HD network dome camera is a surveillance device of Changzhou Shuoxin Electronic Technology Co., Ltd. Changzhou Shuoxin Electronic Technology Co., Ltd.'s intelligent HD network dome camera has an arbitrary file download vulnerability. An attacker could use this vulnerability to download arbitrary files using the "../" jump directory.

Shenzhen Jixiang Tengda Technology Co., Ltd. is a high-tech enterprise integrating independent research and development, production and sales of network equipment. Shenzhen Jixiang Tengda Technology Co., Ltd. enterprise router has an unauthorized access vulnerability. An attacker could use this vulnerability to gain unauthorized access to the system and obtain sensitive information such as wifi password, management background account password, and broadband dial-up account.

MikroTikRouterOS is a routing operating system, and through this software, the standard PC computer becomes a professional router. It is continuously updated and developed in the development and application of software. The software has undergone many updates and improvements to enhance its functions. And perfect. A remote code execution vulnerability exists in MikroTikRouterOS. An attacker can exploit the vulnerability to remotely obtain the shell of the RouterOS system.

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer. Guacamole Contains a race condition vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state

Untrusted search path in Intel Graphics Driver 15.40.x.x, 15.45.x.x, and 21.20.x.x allows unprivileged user to elevate privileges via local access. Intel Graphics drivers contain an unreliable search path vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Intel Graphics Driver is an integrated graphics driver developed by Intel Corporation

Cross-site scripting (XSS) vulnerability in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8.2.0 could allow remote attackers to execute arbitrary code or access sensitive browser-based information. Brocade Fabric OS (FOS) Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. BrocadeFibreChannelSANproducts are Brocade switches and BrocadeFabricOS (FOS) is an embedded system running on them. Cross-site scripting vulnerabilities exist in BrocadeFibreChannelSAN products prior to BrocadeFOS7.4.2b, pre-8.1.2, and pre-8.0. Web-based management interfaces. This may help the attacker steal cookie-based authentication credentials and launch other attacks. Broadcom Brocade Fabric OS versions prior 7.4.2b, 8.1.2 and 8.2.0 are vulnerable

A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting and injecting code into a user request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information. This vulnerability affects the following Cisco Small Business 300 and 500 Series Managed Switches: Cisco Small Business 300 Series Managed Switches, Cisco Small Business 500 Series Stackable Managed Switches, Cisco 350 Series Managed Switches, Cisco 350X Series Stackable Managed Switches, Cisco 550X Series Stackable Managed Switches, Cisco ESW2 Series Advanced Switches. Cisco Bug IDs: CSCvg24637. Vendors have confirmed this vulnerability Bug ID CSCvg24637 It is released as.Information may be obtained and information may be altered. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. are American Cisco ( Cisco ) The company's switch equipment

A vulnerability in the application server of the Cisco Unified Customer Voice Portal (CVP) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to malformed SIP INVITE traffic received on the CVP during communications with the Cisco Virtualized Voice Browser (VVB). An attacker could exploit this vulnerability by sending malformed SIP INVITE traffic to the targeted appliance. An exploit could allow the attacker to impact the availability of services and data on the device, causing a DoS condition. This vulnerability affects Cisco Unified CVP running any software release prior to 11.6(1). Cisco Bug IDs: CSCve85840. Vendors have confirmed this vulnerability Bug ID CSCve85840 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. An attacker can exploit this issue to cause denial-of-service conditions. Application server is one of the application servers

A vulnerability in management interface access control list (ACL) configuration of Cisco NX-OS System Software could allow an unauthenticated, remote attacker to bypass configured ACLs on the management interface. This could allow traffic to be forwarded to the NX-OS CPU for processing, leading to high CPU utilization and a denial of service (DoS) condition. The vulnerability is due to a bad code fix in the 7.3.2 code train that could allow traffic to the management interface to be misclassified and not match the proper configured ACLs. An attacker could exploit this vulnerability by sending crafted traffic to the management interface. An exploit could allow the attacker to bypass the configured management interface ACLs and impact the CPU of the targeted device, resulting in a DoS condition. This vulnerability affects the following Cisco products running Cisco NX-OS System Software: Multilayer Director Switches, Nexus 2000 Series Switches, Nexus 3000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode. Cisco Bug IDs: CSCvf31132. Cisco NX-OS Contains a resource management vulnerability. Vendors have confirmed this vulnerability Bug ID CSCvf31132 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. Cisco MultilayerDirectorSwitches and so on are Cisco's switch products. Cisco NX-OS System Software is a set of software that runs on the switch. Cisco NX-OS System Software is prone to a denial-of-service vulnerability Attackers can exploit this issue to cause the application to consume excessive CPU resources, denying service to legitimate users

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a Document Object Model (DOM) cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf73922. Vendors have confirmed this vulnerability Bug ID CSCvf73922 It is released as.Information may be obtained and information may be altered. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies