PT-2022-35193 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.77 Description: The issue is related to a possible use-after-free in the async command interface of net/mlx5. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

IBM Cognos Analytics Multiple Vulnerabilities (6828527)

The version of IBM Cognos Analytics installed on the remote host is affected by multiple vulnerabilities, including the following: - OpenSSL is vulnerable to a buffer overflow, caused by improper bounds checking by the EVPPKEYdecrypt function within implementation of the SM2 decryption. By sendin...

CVE-2021-43138

A vulnerability was found in the async package. This flaw allows a malicious user to obtain privileges via the mapValues method...

elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in...

Malicious code in test-async (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77032b3c9cc48f55b79507650d7c7a520543997883ee5c2cb3e655a5ee8f3304 Security researchers at Check Point Research discovered a malicious package called test-async. PyPI has since removed test-async...

MAL-2022-7428 Malicious code in test-async (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77032b3c9cc48f55b79507650d7c7a520543997883ee5c2cb3e655a5ee8f3304 Security researchers at Check Point Research discovered a malicious package called test-async. PyPI has since removed test-async...

Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities

Summary RamdaCVE-2021-42581 is vulnerable to remote attackers to execute arbitrary code on the system, caused by a prototype pollution in functions. An attacker could exploit this vulnerability to execute arbitrary code on the system. Node-forgeCVE-2022-24773, 217313, CVE-2022-24771, CVE-2020-772...

Security Bulletin: Multiple vulnerabilities affect IBM Db2 On Openshift, IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data

Summary IBM has released the below fix for IBM Db2® On Openshift, IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. Vulnerability Details CVEID:CVE-2022-33987 DESCRIPTION: Node.js got module could allow a...

Security Bulletin: IBM Robotic Process Automation is vulnerable to arbitrary code execution due to async (CVE-2021-43138)

Summary async is used by IBM Robotic Process Automation as part of control center UI functionality. CVE-2021-43138 Vulnerability Details CVEID:CVE-2021-43138 DESCRIPTION: Async could allow a remote attacker to execute arbitrary code on the system, caused by prototype pollution in the mapValues...

CVE-2022-31162

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...

Information disclosure

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...

CVE-2022-31162

CVE-2022-31162 affects Slack Morphism (Rust) prior to 0.41.0. The root issue was overly verbose debug formatting that could cause Slack OAuth client information to leak into application logs. Exploitation guidance is not provided in the documents; however, various sources confirm an information d...

Security Bulletin: Vulnerability in async opensource package affects IBM VM Recovery Manager HA & DR GUI

Summary There is vulnerability in async opensource package which affects IBM VM Recovery Manager HA and DR GUI. No impacts to VM Recovery Manager HA and DR cli. Vulnerability Details CVEID:CVE-2021-43138 DESCRIPTION: Async could allow a remote attacker to execute arbitrary code on the system,...

H3C Magic R200 Buffer Error Vulnerability

H3C Magic R200 is a wireless router device. H3C Magic R200 AJAX/ajaxget processing ajaxmsg parameter has a buffer overflow vulnerability, which can be exploited by remote attackers to submit special requests that can crash the service or execute arbitrary code in application context...

elasticsearch: executing async search improperly stores HTTP headers leading to information disclosure

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in...

aio-binance-library (>=2.0.1, <=2.0.6), aiohttp-boilerplate (0.2.6) +31 more potentially affected by CVE-2022-31116 via ujson (>=5.0.0, <=5.3.0)

ujson PYPI version =5.0.0, =2.0.1, =1.0.0, =0.9.0, =0.2.0, =0.2.1 - django-tbot-messages 0.2.2 - dsframework 0.1.98 - emerquant-dev 0.0.9 - fb-sapp 0.5.3 - gs-dbs-client 0.2.5.post44 - irisrelay 1.2.9 and more Source cves: CVE-2022-31116 Source advisory: OSV:GHSA-WPQR-JCPX-745R...

aio-binance-library (>=2.0.1, <=2.0.6), aiohttp-boilerplate (0.2.6) +31 more potentially affected by CVE-2022-31116 via ujson (>=5.0.0, <=5.3.0)

ujson PYPI version =5.0.0, =2.0.1, =1.0.0, =0.9.0, =0.2.0, =0.2.1 - django-tbot-messages 0.2.2 - dsframework 0.1.98 - emerquant-dev 0.0.9 - fb-sapp 0.5.3 - gs-dbs-client 0.2.5.post44 - irisrelay 1.2.9 and more Source cves: CVE-2022-31116 Source advisory: GHSA-WPQR-JCPX-745R...

Security Bulletin: IBM Integration Bus and IBM App Connect Enterprise are vulnerable to arbitrary code execution due to async ( CVE-2021-43138) and nconf (CVE-2022-21803)

Summary IBM Integration Bus and IBM App Connect Enterprise are vulnerable to arbitrary code execution, due to the async CVE-2021-43138 and nconf CVE-2022-21803 modules for Node.js. A mitigation has been provided for IBM Integration Bus. The latest fix packs for IBM App Connect Enterprise includes...

Malicious Package

Overview test-async-config is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

MAL-2022-1150 Malicious code in async-problem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2aacc68e48c5a12a15906bd6fc0fef4bb3fc0c2205e74310d659a167a754f473 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...