Security update for mumble (moderate)

openSUSE Security Update: Security update for mumble Announcement ID: openSUSE-SU-2020:1439-1 Rating: moderate References: 1174041 Affected Products: openSUSE Backports SLE-15-SP1 An update that contains security fixes can now be installed. Description: This update for mumble fixes the following...

Denial of Service in grpc-ts-health-check

Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status...

GHSA-M86M-5M44-PC93 Denial of Service in grpc-ts-health-check

Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status...

@cowlick/analyzer (>=0.10.0, <=0.11.0), @cowlick/kag-compiler (>=0.10.0, <=0.11.0) +1 more potentially affected by CVE-2020-8244 via bl (3.0.0)

bl NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on bl and may be impacted: - @cowlick/analyzer =0.10.0, =0.10.0, =1.0.0, =1.0.3 Source cves: CVE-2020-8244 Source advisory: OSV:GHSA-PP7H-53GX-MX7R...

3architecture (>=1.0.0, <=1.7.0), @1amageek/tradable (0.9.0) +1596 more potentially affected by CVE-2020-7768 via grpc (>=1.0.0, <=1.24.3)

grpc NPM version =1.0.0, =1.0.0, =1.0.24, =0.0.2, =1.1.6, =0.0.1, =0.1.0, =1.2.1, =0.0.0-7, =1.0.0, =1.1.0 - @ampretia/composer-opus 0.2.0 - @andregarvin/cuneiform 0.0.1 and more Source cves: CVE-2020-7768 Source advisory: SNYK:JS-GRPC-598671...

Prototype Pollution

Overview grpc is a gRPC Library for Node Affected versions of this package are vulnerable to Prototype Pollution via loadPackageDefinition. POC: const loadPackageDefinition = require'grpc'; loadPackageDefinition'proto.polluted': true; console.logpolluted; Details Prototype Pollution is a...

@arkecosystem/core-new-relic (>=2.6.0-next.4, <=2.7.26), @beyounglabs/alfred (>=0.0.3, <=3.0.16) +62 more potentially affected by CVE-2020-7768 via @grpc/grpc-js (>=1.0.0, <=1.1.7)

@grpc/grpc-js NPM version =1.0.0, =2.6.0-next.4, =0.0.3, =0.1.4, =1.12.0, =0.7.1, =0.7.4, =0.7.2, =4.4.3-dev.21, =1.6.0-rc, =0.1.14-alpha-71502f6.0, =0.1.1-alpha.0, =0.0.2, =0.1.9, =2.9.0-alpha.0, =3.3.0 - @irvingjs/vip-go 3.0.0-alpha.16 and more Source cves: CVE-2020-7768 Source advisory:...

Prototype Pollution

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Prototype Pollution via loadPackageDefinition. POC: const loadPackageDefinition = require'grpc'; loadPackageDefinition'proto.polluted': true; console.logpolluted; Details Prototype Pollution is a...

openSUSE Security Update : mumble (openSUSE-2020-1016)

This update for mumble fixes the following issues : mumble was updated 1.3.2 : - client: Fixed overlay not starting Update to upstream version 1.3.1 - Security - Fixed: Potential exploit in the OCB2 encryption 4227 boo1174041 - ICE - Fixed: Added missing UserKDFIterations field to UserInfo =...

Security update for mumble (moderate)

openSUSE Security Update: Security update for mumble Announcement ID: openSUSE-SU-2020:1016-1 Rating: moderate References: 1174041 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 An update that contains security fixes can now be installed. Description: This update for mumble fixes the...

Saferwall - A Hackable Malware Sandbox For The 21St Century

Saferwall is an open source malware analysis platform. It aims for the following goals: Provide a collaborative platform to share samples among malware researchers. Acts as a system expert, to help researchers generates an automated malware analysis report. Hunting platform to find new malwares...

Important Photon OS Security Update - PHSA-2020-0305

Updates of 'pcre', 'linux', 'linux-esx' packages of Photon OS have been released...

grpc:client_fuzzer: Heap-use-after-free in gpr_unref

Detailed Report: https://oss-fuzz.com/testcase?key=5680426091020288 Project: grpc Fuzzing Engine: libFuzzer Fuzz Target: clientfuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address: 0x610000000040 Crash State: gprunref grpcerrordounref...

Protecting gRPC applications and APIs

Wallarm has always stood out from its competitors when it comes to supporting modern stacks. For a long time Wallarm has been the only product to provide comprehensive protection for WebSockets-based web applications. Once again, Wallarm is glad to be the pioneer and add support for the gRPC...

grpc:json_fuzzer: Heap-buffer-overflow in internal_add_error

Detailed Report: https://oss-fuzz.com/testcase?key=5702719740575744 Project: grpc Fuzzing Engine: libFuzzer Fuzz Target: jsonfuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x60e000006e40 Crash State: internaladderror grpcerrorcreate...

grpc:ssl_server_fuzzer: Heap-buffer-overflow in grpc_core::HandshakerArgs::HandshakerArgs

Detailed Report: https://oss-fuzz.com/testcase?key=6217576676065280 Project: grpc Fuzzing Engine: afl Fuzz Target: sslserverfuzzer Job Type: aflasangrpc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Address: 0x615000000268 Crash State: grpccore::HandshakerArgs::HandshakerArgs...

CVE-2018-16886

Etcd, versions 3.2.0 through 3.2.25 and 3.3.0 through 3.3.10, are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server's TLS certificate contains a Common Name CN which matches a valid RBAC username, a...

openSUSE: Security Advisory for haproxy (openSUSE-SU-2019:2555-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Advisory 0043

Security Advisory 0043 PDF Date: November 6th, 2019 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | November 6th, 2019 | Initial Release The CVE-IDs tracking this issue: CVE-2019-9512, CVE-2019-9514, and CVE-2019-9515 CVSSv3 Base Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description...

grpc:api_fuzzer: Heap-use-after-free in gpr_unref

Detailed Report: https://oss-fuzz.com/testcase?key=5651679584452608 Project: grpc Fuzzing Engine: libFuzzer Fuzz Target: apifuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address: 0x610000000240 Crash State: gprunref grpcerrordounref...