PT-2024-33875

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability has been resolved in the Linux kernel related to the ppp async encode function. The issue occurs when pppoe sendmsg is called with a zero size, leading to ppp async encode bei...

activecube-rs (>=0.0.1, <=0.1.30), async-graphql-actix-web (>=7.0.0, <=7.0.3) +29 more potentially affected by CVE-2024-47614 via async-graphql (7.0.3)

async-graphql CARGO version 7.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on async-graphql and may be impacted: - activecube-rs =0.0.1, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =2.0.0, =0.1.0, =0.1.0, =0.4.0 - fcdb-api 0.1.0 - ferrox-datagrid 0.1.0 and mor...

GHSA-5GC2-7C65-8FQ8 async-graphql Directive Overload

Impact - Service Disruption: The server may become unresponsive or extremely slow, potentially leading to downtime. - Resource Exhaustion: Excessive use of server resources, such as CPU and memory, could negatively impact other services running on the same infrastructure. - User Experience...

CVE-2024-47614

async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fixed in 7.0.10...

CVE-2024-47614 async-graphql vulnerable to Directive Overload

async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fixed in 7.0.10...

CVE-2024-47614 async-graphql vulnerable to Directive Overload

async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fixed in 7.0.10...

CVE-2024-47614

The CVE-2024-47614 issue affects the Rust GraphQL server library async-graphql prior to version 7.0.10 . The vulnerability arises because it does not limit the number of directives for a field, which can lead to Service Disruption , Resource Exhaustion , and degraded User Experience . Affected so...

CVE-2024-47614 async-graphql vulnerable to Directive Overload

async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fixed in 7.0.10...

PT-2024-32674

Name of the Vulnerable Software and Affected Versions async-graphql versions prior to 7.0.10 Description The issue is related to the async-graphql library, a GraphQL server implemented in Rust, where it does not limit the number of directives for a field. This can lead to Service Disruption,...

CVE-2024-47614: Allocation of Resources Without Limits or Throttling

async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fixed in 7.0.10...

async-graphql 安全漏洞

async-graphql is a fully compliant high-performance graphql server library from the async-graphql open source. A security vulnerability exists in async-graphql versions prior to 7.0.10 that stems from the number of commands in an unrestricted field, which could lead to service disruption, resourc...

RHSA-2023:5931 Red Hat Security Advisory: Satellite 6.13.5 Async Security Update

Bulletin has no description...

Race Condition

Overview ophyd-async is an Asynchronous Bluesky hardware abstraction code, compatible with control systems like EPICS and Tango Affected versions of this package are vulnerable to Race Condition when setting one signal and monitoring another. This issue could lead to missed signal changes or...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components.This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...

RHSA-2023:0261 Red Hat Security Advisory: Satellite 6.12.1 Async Security Update

Bulletin has no description...

Security Bulletin: Vulnerability in Async Http Client affects IBM watsonx.data

Summary Async Http Client aka async-http-client could allow a remote attacker to bypass security restrictions, caused by the failure to parse the fragment identifier of the URL when handling '?' character. By using a specially-crafted URL with '?' character, an attacker could exploit this...

Security Bulletin: Vulnerability in Async Http Client affects IBM watsonx.data

Summary Async Http Client aka async-http-client could allow a remote attacker to bypass security restrictions, caused by the failure to parse the fragment identifier of the URL when handling '?' character. By using a specially-crafted URL with '?' character, an attacker could exploit this...

BIT-ENVOY-2024-45810 Envoy crashes for LocalReply in http async client

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling sendLocalReply under some circumstance, e.g., websocket upgrade, and requests mirroring. The http async client will crash during the sendLocalReply in http async client, one...

CVE-2024-45810

A flaw was found in Envoy. Envoy will crash when the http async client is handling sendLocalReply under some circumstances, such as websocket upgrade and requests mirroring. The http async client will crash during the sendLocalReply in http async client if the http async client is duplicating the...

CVE-2024-45809

A flaw was found in Envoy. JWT filter will lead to a crash in Envoy when clearing the route cache with remote JWKs in the following cases: 1. Remote JWKs are used, which requires async header processing 2. clearroutecache is enabled on the provider 3. Header operations are enabled in JWT filter,...