Design/Logic Flaw

An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits...

UBUNTU-CVE-2023-2030

An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits...

CVE-2023-2030

CVE-2023-2030 affects GitLab CE/EE versions from 12.2 up to 16.5.5 (and 16.6 up to 16.6.3, 16.7 up to 16.7.1). The issue allows an attacker to potentially modify the metadata of signed commits. The vulnerability’s CVSS3.1 base score is 5.3 (MEDIUM) with network attack vector, and no privileges re...

CVE-2023-2030 Improper Verification of Cryptographic Signature in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab that stems from the possibility that...

CVE-2023-2030

An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits...

GitLab 12.2 < 16.5.6 / 16.6 < 16.6.4 / 16.7 < 16.7.2 (CVE-2023-2030)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata...

Important: kernel-livepatch-6.1.56-82.125

Issue Overview: x86: KVM: SVM: always update the x2avic msr interception CVE-2023-5090 A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events perf component can be exploited to achieve local privilege escalation. If perfreadgroup is called while an event's...

Gitsign Security Vulnerabilities

Gitsign is a tool for Gitsign individual developers to sign Git commits key-free. A security vulnerability exists in Gitsign version 0.6.0 through versions prior to 0.8.0, which stems from the fact that the Rekor public key is obtained through the Rekor API, not through the local TUF client, and...

Important: kernel-livepatch-5.10.192-182.736

Issue Overview: A use-after-free vulnerability in the Linux kernel's net/sched: schhfsc HFSC qdisc traffic control component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve i.e. with the HFSCFSC flag set has a parent without a link-sharing curve, then...

Important: kernel-livepatch-4.14.322-244.539

Issue Overview: A use-after-free vulnerability in the Linux kernel's net/sched: clsfw component can be exploited to achieve local privilege escalation. When fwchange is called on an existing filter, the whole tcfresult struct is always copied into the new instance of the filter. This causes a...

A Use Case for Transactions: Outbox Pattern Strategies in Spring Cloud Stream Kafka Binder

Other parts in this blog series Part 1: Introduction to Transactions in Spring Cloud Stream Kafka Applications Part 2: Producer Initiated Transactions in Spring Cloud Stream Kafka Applications Part 3: Synchronizing with External Transaction Managers in Spring Cloud Stream Kafka Applications Part ...

Dependabot impersonators cause trouble on GitHub

GitHub is experiencing issues of the "breached account and malicious code" variety. ITPro reports that unnamed individuals have been compromising accounts and using them to install malware capable of password theft. Its a fairly elaborate scam which even includes imitation of GitHubs popular...

Important: kernel-livepatch-4.14.320-242.534

Issue Overview: A use-after-free vulnerability in the Linux kernel's net/sched: clsu32 component can be exploited to achieve local privilege escalation. If tcfchangeindev fails, u32setparms will immediately return an error after incrementing or decrementing the reference counter in tcfbindfilter...

CVE-2023-43633 Debug Functions Unlockable Without Triggering Measured Boot

On boot, the Pillar eve container checks for the existence and content of “/config/GlobalConfig/global.json”. If the file exists, it overrides the existing configuration on the device on boot. This allows an attacker to change the system’s configuration, which also includes some debug functions...

CVE-2023-39742

giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c...

Oracle Linux 8 : kernel (ELSA-2023-4517)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4517 advisory. - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM Tamas Koczka CVE-2022-42896 - net/sched: tcindex: update imperfect hash filters...

New Python URL Parsing Flaw Could Enable Command Execution Attacks

A high-severity security flaw has been disclosed in the Python URL parsing function that could be exploited to bypass domain or protocol filtering methods implemented with a blocklist, ultimately resulting in arbitrary file reads and command execution. "urlparse has a parsing problem when the...

CVE-2023-4128

A use-after-free flaw was found in net/sched/clsfw.c in classifiers clsfw, clsu32, and clsroute in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue. Bugs Notes...

Design/Logic Flaw

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -...