110 matches found
azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity
A flaw was found in Microsoft's Azure Identity Libraries and the Microsoft Authentication Library MSAL. The flaw arises from a race condition—a scenario where the timing of events leads to unexpected behavior—during concurrent operations on shared resources. This can result in privilege escalatio...
OPENSUSE-SU-2024:14362-1 python310-azure-identity-1.18.0-1.1 on GA media
These are all security issues fixed in the python310-azure-identity-1.18.0-1.1 package on the GA media of openSUSE Tumbleweed...
openSUSE Security Advisory (SUSE-SU-2024:3345-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE SLES15 / openSUSE 15 Security Update : python-azure-identity (SUSE-SU-2024:3345-1)
The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:3345-1 advisory. - CVE-2024-35255: Fixed an Azure identity libraries elevation of privilege vulnerability. bsc1230100 Tenable has extracted the...
Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2024-708)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-708 advisory. Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 The OpenTelemetry Collector offers a vendor-agnostic implementation on how to...
Important: amazon-cloudwatch-agent
Issue Overview: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows...
Security Bulletin: A vulnerability in Azure Identity Library for .NET affects IBM Robotic Process Automation and may result in a locally authenticated attacker obtaining sensitive information (CVE-2024-29992)
Summary A vulnerability in Azure Identity Library for .NET affects IBM Robotic Process Automation and may result in a locally authenticated attacker obtaining sensitive information. Azure Identity Library for .NET is used by IBM Robotic Process Automation as part of identity management. This...
Security Bulletin: IBM App Connect Enterprise is vulnerable to a local authenticated attack and denial of service due to Microsoft Azure Identity Libraries and Microsoft Authentication Library and gRPC on Node.js (CVE-2024-35255, CVE-2024-37168)
Summary IBM App Connect Enterprise is vulnerable to a local authenticated attack and denial of service due to Microsoft Azure Identity Libraries and Microsoft Authentication Library and gRPC on Node.js. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details...
CVE-2024-35255
A flaw was found in Microsoft's Azure Identity Libraries and the Microsoft Authentication Library MSAL. The flaw arises from a race condition—a scenario where the timing of events leads to unexpected behavior—during concurrent operations on shared resources. This can result in privilege escalatio...
GO-2024-2941 ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik
ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik...
The vulnerability of the DefaultAzureCredential and ManagedIdentityCredential components of the Azure Identity Libraries and Microsoft Authentication Library allows a perpetrator to escalate their privileges.
The vulnerability of the DefaultAzureCredential and ManagedIdentityCredential components in the Azure Identity Libraries and Microsoft Authentication Library authentication libraries is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow attacke...
GHSA-RVJ4-Q8Q5-8GRF ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability
Impact There is a vulnerability in Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability. References - CVE-2024-35255 Patches - https://github.com/traefik/traefik/releases/tag/v2.11.5 - https://github.com/traefik/traefik/releases/tag/v3.0.3 Workarounds...
Azure Identity SDK < 4.2.1
The version of Azure Identity installed on the remote host is prior to 4.2.1. It is, therefore, affected by a vulnerability: - Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 Note that Nessus has not tested for this issue but has...
GHSA-M5VV-6R4H-3VJ9 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...
@artusx/init (>=1.2.0-beta.1, <=1.2.1), @artusx/rush-utils (>=0.0.1, <=0.0.11) +20 more potentially affected by CVE-2024-35255 via @azure/identity (>=4.0.0, <=4.2.0)
@azure/identity NPM version =4.0.0, =1.2.0-beta.1, =0.0.1, =1.0.0-alpha.20231026.4, =1.0.1-alpha.20231026.4, =2.0.1, =1.19.0-beta.0, =5.112.0, =5.112.0, =0.9.11, =1.0.0, =1.0.1 and more Source cves: CVE-2024-35255 Source advisory: OSV:GHSA-M5VV-6R4H-3VJ9...
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Overview Affected versions of this package are vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' in the authentication process. An attacker can elevate privileges by exploiting race conditions during the token validation steps. This is only...
AZL-42649 CVE-2024-35255 affecting package telegraf for versions less than 1.31.0-9
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...