SUSE-SU-2021:0127-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: - Updated to upstream version 2.1.3 as 2.1.3-suse, for bsc1179908, including: uip: check for TCP urgent pointer past end of frame uip: check for u8 overflow when processing TCP options uip: check for header length underflow during checksum...

PT-2021-14860 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions 7.7.0 through 7.10.1 Description: The issue is an information disclosure flaw in the async search API. When an async search is executed, HTTP headers are improperly stored. An Elasticsearch user with read access to the...

CVE-2021-22132: Insufficiently Protected Credentials

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in...

Fedora: Security Advisory for rubygem-em-http-request (FEDORA-2020-8ccd750904)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for rubygem-em-http-request (FEDORA-2020-117f1b67fb)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 33 Update: rubygem-em-http-request-1.1.7-1.fc33

EventMachine based, async HTTP Request client...

[SECURITY] Fedora 32 Update: rubygem-em-http-request-1.1.7-1.fc32

EventMachine based, async HTTP Request client...

Rust Competition Condition Problem Vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. Rust arr crate through 2020-08-25 A security vulnerability can be exploited to allow an attacker to smuggle asynchronous send types across thread boundaries, leading to data contention...

CVE-2020-26281

async-h1 is an asynchronous HTTP/1.1 parser for Rust crates.io. There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the bo...

Cross site request forgery (csrf)

async-h1 is an asynchronous HTTP/1.1 parser for Rust crates.io. There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the bo...

CVE-2020-26281

CVE-2020-26281 affects the async-h1 crate (Rust) before version 2.3.0 when used behind a reverse proxy. The vulnerability arises when the server does not consume a request body beyond a buffer, allowing a smuggled request to be read from the body and potentially forge or manipulate forwarded head...

CVE-2020-26281

async-h1 is an asynchronous HTTP/1.1 parser for Rust crates.io. There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the bo...

CVE-2020-26281 request smuggling in async-h1

async-h1 is an asynchronous HTTP/1.1 parser for Rust crates.io. There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the bo...

CVE-2020-26281: Inconsistent Interpretation of HTTP Requests

async-h1 is an asynchronous HTTP/1.1 parser for Rust crates.io. There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the bo...

Async-h1 request smuggling possible with long unread bodies

This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at...

PT-2020-16401

Name of the Vulnerable Software and Affected Versions async-h1 versions prior to 2.3.0 Description The issue is a request smuggling vulnerability that affects webservers using async-h1 behind a reverse proxy, including Tide applications. If a server does not read the body of a request that is...

PT-2020-17573

Name of the Vulnerable Software and Affected Versions async-h1 versions prior to 2.3.0 Description An issue was discovered in the async-h1 crate that allows request smuggling to occur when used behind a reverse proxy. This affects any webserver that uses async-h1 behind a reverse proxy, including...

async-metronome (0.2.0), bach (>=0.0.1, <=0.0.2) +8 more potentially affected by CVE-2020-35926 via nanorand (0.4.4)

nanorand CARGO version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on nanorand and may be impacted: - async-metronome 0.2.0 - bach =0.0.1, =0.1.0, =0.1.0, =0.4.7, =0.1.0, =0.1.1 Source cves: CVE-2020-35926 Source advisory: OSV:RUSTSEC-2020-0089...

PT-2020-17624

Name of the Vulnerable Software and Affected Versions async-coap crate versions through 2020-12-08 Description An issue was discovered in the async-coap crate where Send and Sync are implemented for ArcGuard without trait bounds on RC. This allows users to send RC: !Send to other threads and also...

de.skuzzle.inject:guice-async-extension (>=1.0.0, <=1.2.0) potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (5.0.0)

com.cronutils:cron-utils MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - de.skuzzle.inject:guice-async-extension =1.0.0, =1.2.0 Source cves: CVE-2020-26238 Source advisory:...