CVE-2023-52433 netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetrbtree: skip sync GC for new elements in this transaction New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an alrea...

CVE-2023-52433: Improper Check for Dropped Privileges

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetrbtree: skip sync GC for new elements in this transaction New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an alrea...

Malicious code in execution-time-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cfb518a6f8c71bfcbaea6494b888189e261a9f7a6be487568339baeb334ad7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in execution-time-async

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-1009 Malicious code in execution-time-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cfb518a6f8c71bfcbaea6494b888189e261a9f7a6be487568339baeb334ad7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-21463

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the end buffer async write function, which handles the completion of block device writes. According to a syzbot report, this function may detect an abnormal...

CVE-2024-24558

The CVE-2024-24558 entry concerns the TanStack Query package, specifically the @tanstack/react-query-next-experimental component. The vulnerability is a cross‑site scripting (XSS) flaw that arises from improper handling of untrusted input during server‑side rendering, allowing an attacker to inje...

CVE-2024-23644

Trillium is a composable toolkit for building internet applications with async rust. In trillium-http prior to 0.3.12 and trillium-client prior to 0.5.4, insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have...

CVE-2024-23644

CVE-2024-23644 affects Trillium, specifically the crates trillium-http (versions prior to 0.3.12) and trillium-client (prior to 0.5.4). The issue is improper validation of outbound header values and names, where header values/names can be constructed infallibly and may contain illegal bytes. If a...

PT-2024-14599

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to possible deadlocks in the core system-wide PM code of the Linux kernel. In low-memory situations, the system-wide resume core code deadlocks because async schedul...

async-ssh2-tokio (>=0.2.0, <=0.8.4), dev-tunnels (0.1.0) +5 more potentially affected by CVE-2023-48795 via russh (>=0.34.0, <=0.39.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - tunnels 0.1.0 Source cves: CVE-2023-48795 Source advisory: OSV:GHSA-45X7-PX36-X8W8...

OESA-2023-1890 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A use-after-free flaw was found in setupasyncwork in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed work.CVE-2023-119...

OESA-2023-1889 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A use-after-free flaw was found in setupasyncwork in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed work.CVE-2023-119...

OPENSUSE-SU-2023:0391-1 Security update for libtorrent-rasterbar, qbittorrent

This update for libtorrent-rasterbar, qbittorrent fixes the following issues: Changes in libtorrent-rasterbar: - Update to version 2.0.9 fix issue with web seed connections when they close and re-open fallocate not supported is not a fatal error fix proxying of IPv6 connections via IPv4 proxy tre...

PT-2023-8774

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a repeated memory release in the v4l2 async unregister subdev function within the Linux kernel's video subsystem. This can lead to a kernel error due to a NULL...

PYSEC-2023-250

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request e.g. to insert a new header or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the...

CVE-2023-49081

CVE-2023-49081 affects aiohttp (HTTP header/HTTP version validation issues) with remediation across multiple vendors: Debian advisories show fixes for python-aiohttp (Debian 11 bullseye: 3.7.4-1+deb11u1; DSA-5828-1 fixes to 3.8.4-1+deb12u1), IBM Storage Fusion bulletin requires upgrading to 2.8.0...

CVE-2023-49082 aiohttp's ClientSession is vulnerable to CRLF injection via method

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request e.g. insert a new header or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if th...

CVE-2023-47641

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-LengthCL and Transfer-EncodingTE header...

Input validation

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTPNOEXTENSIONS is enabled or not using a prebuilt wheel. These bugs have...