Security Bulletin: IBM MQ is affected by a denial-of-service vulnerability

Summary IBM MQ has addressed an error within the IBM MQ clustering logic, in which a specially crafted message could cause a denial-of-service. Vulnerability Details CVEID: CVE-2023-45177 DESCRIPTION: IBM MQ is vulnerable to a denial-of-service attack due to an error within the IBM MQ clustering...

Apache ActiveMQ Remote Code Execution Vulnerability (CNVD-2023-80853)

Apache ActiveMQ is the United States Apache Apache Foundation of a set of open source messaging middleware , which supports Java messaging services , clustering , Spring Framework and so on. Apache ActiveMQ remote code execution vulnerability , when an unauthenticated attacker can use the...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-005)

The version of tomcat installed on the remote host is prior to 8.5.79-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-005 advisory. A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux,...

CLSA-2023-1689010064 Fix CVE(s): CVE-2022-29885

SECURITY UPDATE: EncryptInterceptor only provides partial protection on untrusted network - debian/patches/CVE-2022-29885.patch: Update the documentation to state that the EncryptInterceptor does not provide sufficient protection to run Tomcat clustering over an untrusted network. - CVE-2022-2988...

CLSA-2023-1689009963 Fix CVE(s): CVE-2022-29885

SECURITY UPDATE: EncryptInterceptor only provides partial protection on untrusted network - debian/patches/CVE-2022-29885.patch: Update the documentation to state that the EncryptInterceptor does not provide sufficient protection to run Tomcat clustering over an untrusted network. - CVE-2022-2988...

Design/Logic Flaw

Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or inadvertently create a shard containing / characters from VTAdmin such that from that point on, anyone who tries to create a new shard fr...

CVE-2023-29195

Vitess VTAdmin shard creation bug: before 16.0.2, VTAdmin could produce a shard name containing a "/" that caused subsequent shard creation attempts to fail and keyspace views to break. The issue is fixed in version 16.0.2 (go module v0.16.2). Workarounds include: use vtctldclient to create shard...

CVE-2023-29194

Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces...

CVE-2023-29194

Vitess CVE-2023-29194 describes a logic flaw that allows creation of a keyspace containing a slash (/), which can cause VTAdmin (and in some references vtctldclient GetKeyspaces) to error when listing or viewing keyspaces. The underlying issue affects how keyspaces with a slash are handled and ma...

CVE-2023-29194 vitess allows users to create keyspaces that can deny access to already existing keyspaces

Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces...

March 14, 2023—KB5023705 (OS Build 20348.1607)

None None...

HPE Serviceguard 缓冲区错误漏洞

HPE Serviceguard is a high availability and disaster recovery clustering solution from HPE. A security vulnerability exists in HPE Serviceguard that stems from a pre-authorized memory corruption...

K34074377: BIG-IQ HA vulnerability CVE-2021-22997

Security Advisory Description BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. CVE-2021-22997 Impact BIG-IQ The vulnerability could result in a confidential...

CVE-2022-34825

Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrit...

Fedora: Security Advisory for booth (FEDORA-2022-e0a87993b8)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: booth-1.0-251.4.bfb2f92.git.fc35

Booth manages tickets which authorize cluster sites located in geographically dispersed locations to run resources. It facilitates support of geographically distributed clustering in Pacemaker...

Security Bulletin: IBM i Clustering is affected by CVE-2019-4381

Summary IBM i Clustering is vulnerable to this security vulnerability. IBM i has addressed this vulnerability. This security bulletin has been updated, on June 21, 2019, as an additional IBM i PTF is available for IBM i 7.4. Vulnerability Details CVEID: CVE-2019-4381 DESCRIPTION: IBM i Clustering...

org.wildfly.arquillian:wildfly-arquillian-container-bootable (=5.0.0.Alpha1), org.wildfly.arquillian:wildfly-arquillian-container-embedded (=5.0.0.Alpha1) +71 more potentially affected by CVE-2021-3642 via org.wildfly.security:wildfly-elytron (>=1.16.0.CR1 <=1.16.0.Final)

org.wildfly.security:wildfly-elytron MAVEN version =1.16.0.CR1, =1.16.0.Final is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.security:wildfly-elytron and may be impacted: - org.wildfly.arquillian:wildfly-arquillian-container-bootable...

Apache Tomcat Clustering DoS Vulnerability (May 2022)

Apache Tomcat is prone to a denial of service DoS vulnerability when running with enabled Tomcat clustering over an untrusted network. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

DEBIAN-CVE-2022-29885

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide...