Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

SummaryThe Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. SeverityModerat...

adlfs (>=0.1.2, <=0.2.0), airflow-ditto (0.0.1.2) +34 more potentially affected by CVE-2022-30187 via azure-storage-blob (2.1.0)

azure-storage-blob PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - adlfs =0.1.2, =0.0.1, =0.6.0, =1.0.1, =0.1.11, =1.1.5, =0.0.38, =0.1.15, =0.0.3, =0.0.1, =1.9.4, =4.7.0, =0.7.0, =0.7.9 and...

blobxfer (1.3.1), kfserving (0.2.1.0) potentially affected by CVE-2022-30187 via azure-storage-blob (1.3.0)

azure-storage-blob PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - blobxfer 1.3.1 - kfserving 0.2.1.0 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

aztk (>=0.9.0, <=0.10.3), azure-cli (>=2.0.2, <=2.0.67) +8 more potentially affected by CVE-2022-30187 via azure-storage-blob (1.3.1)

azure-storage-blob PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - aztk =0.9.0, =2.0.2, =2.1.7, =0.4.4, =1.4.0, =1.0.0.post1, =2.0.66, =2.2.9, =0.4.9, =0.4.12 Source cves: CVE-2022-30187 Sour...

altf1be-helpers (2.1.4), amplo (>=0.9.0, <=0.10.1) +127 more potentially affected by CVE-2022-30187 via azure-storage-blob (>=12.0.0b3, <=12.13.0b1)

azure-storage-blob PYPI version =12.0.0b3, =0.9.0, =2020.5.20rc1, =1.0.0b1, =4.0.6, =0.1.0b1, =0.2.5, =1.0.0b1, =0.21.2111.177147b1, =12.0.0b1, =12.0.0b5, =0.2.7, =0.5.0 and more Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

afs2-datasource (>=3.6.0, <=3.8.2), azblobexplorer (>=1.1.1, <=1.1.4) +4 more potentially affected by CVE-2022-30187 via azure-storage-blob (2.0.1)

azure-storage-blob PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - afs2-datasource =3.6.0, =1.1.1, =1.8.0, =0.0.1, =0.5.2.1, =0.5.4.3 - xtlib 0.0.996 Source cves: CVE-2022-30187 Source...

baybars (>=0.0.1, <=0.0.5), blobxfer (>=1.0.0rc1, <=1.0.0rc3) potentially affected by CVE-2022-30187 via azure-storage-blob (0.37.0)

azure-storage-blob PYPI version 0.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - baybars =0.0.1, =1.0.0rc1, =1.0.0rc3 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

blobxfer (1.1.1) potentially affected by CVE-2022-30187 via azure-storage-blob (1.0.0)

azure-storage-blob PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - blobxfer 1.1.1 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, opentelemetry-collector, glab, tkn, nfpm, neuvector-sigstore-interface, gptscript, wolfictl, rootlesskit, apko, pulumi-kubernetes-operator, flux-image-automation-controller, ksops, melange, ko, chisel, k3s, policy-controller, loki,...

SUSE SLES15 Security Update : azure-storage-azcopy (SUSE-SU-2026:2466-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2466-1 advisory. This update for azure-storage-azcopy fixes the following issues Update to 10.32.4: - CVE-2025-47907: database/sql: incorrect result...

Security update for azure-storage-azcopy

This update for azure-storage-azcopy fixes the following issues Update to 10.32.4: CVE-2025-47907: database/sql: incorrect results returned from Rows.Scan bsc1247720. CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header...

SUSE-SU-2026:2466-1 Security update for azure-storage-azcopy

This update for azure-storage-azcopy fixes the following issues Update to 10.32.4: - CVE-2025-47907: database/sql: incorrect results returned from Rows.Scan bsc1247720. - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.24 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.18.24 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.18.24 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7107: Backport to 4.18.z CLONE - ODF Console is breaking DFBUGS-7064: RHODF 4.18.24 release DFBUGS-7046:...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.30 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.16.30 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.16.30 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7345: RHODF 4.16.30 release DFBUGS-7105: Backport to 4.16.z CLONE - ODF Console is breaking DFBUGS-6743:...

org.jenkins-ci.main:jenkins-war (1.645), org.jenkins-ci.main:test (1.645) +5 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.645)

org.jenkins-ci.main:jenkins-core MAVEN version 1.645 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.645 - org.jenkins-ci.main:test 1.645 -...

org.jenkins-ci.main:jenkins-war (1.645), org.jenkins-ci.main:test (1.645) +5 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.645)

org.jenkins-ci.main:jenkins-core MAVEN version 1.645 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.645 - org.jenkins-ci.main:test 1.645 -...

com.aerse:gcless (11.2), com.hazelcast:hazelcast-wm (>=3.4, <=3.8.3) +99 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.2.1.release)

org.springframework.security:spring-security-web MAVEN version 3.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.aerse:gcless 11.2 - com.hazelcast:hazelcast-wm =3.4...

azure-storage-azcopy-10.32.4-1.1 on GA media (moderate)

azure-storage-azcopy-10.32.4-1.1 on GA media Announcement ID: openSUSE-SU-2026:10873-1 Rating: moderate Cross-References: CVE-2026-39821 CVSS scores: CVE-2026-39821 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2026-39821 SUSE : 9.1...

OPENSUSE-SU-2026:10873-1 azure-storage-azcopy-10.32.4-1.1 on GA media

These are all security issues fixed in the azure-storage-azcopy-10.32.4-1.1 package on the GA media of openSUSE Tumbleweed...

azure-storage-azcopy-10.32.2-3.1 on GA media (moderate)

azure-storage-azcopy-10.32.2-3.1 on GA media Announcement ID: openSUSE-SU-2026:10849-1 Rating: moderate Cross-References: CVE-2026-33814 CVSS scores: CVE-2026-33814 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerabili...