PT-2021-28360

Name of the Vulnerable Software and Affected Versions: Ansible Tower version 3.7 Ansible Automation Platform version 1.2 Description: A flaw in Ansible discloses secret information in async files when the jobdir is changed to a world-readable directory. This allows a malicious user to read any...

PT-2021-20890 · Red Hat · Ansible Automation Platform +2

Name of the Vulnerable Software and Affected Versions: Ansible Tower version 3.7 Ansible Automation Platform version 1.2 Description: A flaw was found in Ansible related to the setting of the ANSIBLE ASYNC DIR variable to a subdirectory of a world-writable directory, leading to a race condition o...

x86: TSX Async Abort protections not restored after S3

ISSUE DESCRIPTION This issue relates to the TSX Async Abort speculative security vulnerability. Please see https://xenbits.xen.org/xsa/advisory-305.html for details. Mitigating TAA by disabling TSX the default and preferred option requires selecting a non-default setting in MSRTSXCTRL. This setti...

Denial Of Service (DoS)

@worker-tools/stripe-webhook is vulnerable to denial of service. The verifyHeader is not an async function in the webhook and causes an error to be thrown after the request has finished...

PT-2021-28770

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10 through v5.12.3 Description The issue is related to the async xor function, where the src offs is increased when dropping the destination page. The actual impact and attack plausibility have not yet been proven...

PT-2021-24871

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.37 Description: The issue is related to the async xor function, where the src offs is increased when dropping the destination page. The actual impact and attack plausibility have not yet been proven...

PT-2021-24776

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.12.4 Description The issue is related to the async xor function, where the src offs is increased when dropping the destination page. The actual impact and attack plausibility have not yet been proven...

PT-2021-28865

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.37 Description The issue is related to the async xor function, where the src offs is increased when dropping the destination page. The actual impact and attack plausibility have not yet been proven...

Fedora: Security Advisory for python-databases (FEDORA-2021-e7fabd81fb)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: python-databases-0.4.3-2.fc34

Databases gives you simple asyncio support for a range of databases. It allows you to make queries using the powerful SQLAlchemy Core expression language, and provides support for PostgreSQL, MySQL, and SQLite. Databases is suitable for integrating against any async Web framework, such as...

CVE-2021-3533

A flaw was found in Ansible if an ansible user sets ANSIBLEASYNCDIR to a subdirectory of a world writable directory . When this occurs, there is a race condition on the managed machine. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async...

Red Hat Ansible 信息泄露漏洞

Red Hat Ansible is a computer system configuration manager from Red Hat, an American company. The product can be used to distribute, manage, and organize computer systems. An information disclosure vulnerability exists in Red Hat Ansible. When a user changes the jobdir to a world-readable...

PT-2021-8013 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the async xor function in the Linux kernel, which can cause data corruption problems due to incorrect calculation of xor values when sharing one page if PAGE SI...

openSUSE: Security Advisory for open-iscsi (openSUSE-SU-2021:0089-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15 Security Update : open-iscsi (SUSE-SU-2021:1164-1)

This update for open-iscsi fixes the following issues : CVE-2020-17437: uIP Out-of-Bounds Write bsc1179908 CVE-2020-17438: uIP Out-of-Bounds Write bsc1179908 CVE-2020-13987: uIP Out-of-Bounds Read bsc1179908 CVE-2020-13988: uIP Integer Overflow bsc1179908 Enabled no-wait '-W' iscsiadm option for...

SUSE-SU-2021:1164-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: - CVE-2020-17437: uIP Out-of-Bounds Write bsc1179908 - CVE-2020-17438: uIP Out-of-Bounds Write bsc1179908 - CVE-2020-13987: uIP Out-of-Bounds Read bsc1179908 - CVE-2020-13988: uIP Integer Overflow bsc1179908 - Enabled no-wait '-W' iscsiadm...

Command Injection in async-git

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...

m2345a-atm (>=1.0.0, <=1.0.1), ndsh (>=1.5.1, <=1.5.5) +1 more potentially affected by CVE-2020-28490 via async-git (1.13.0)

async-git NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on async-git and may be impacted: - m2345a-atm =1.0.0, =1.5.1, =1.8.1, =1.9.1 Source cves: CVE-2020-28490 Source advisory: OSV:GHSA-6QPR-9MC5-7GCH...

GHSA-6QPR-9MC5-7GCH Command Injection in async-git

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters back-ticks. For example: git.reset'atouch HACKEDb'...

Information Disclosure

x-pack-core is vulnerable to an information disclosure. Sensitive request headers of other users in the cluster are exposed to a user with the ability to read the .tasks index due to a flawed implementation of async search API which allows users executing an async search to store the HTTP headers...