Security Bulletin: App Connect Enterprise Certified Container is vulnerable to code injection and Denial of Service attacks

Summary App Connect Enterprise Certified Container Integration Servers and Designers are vulnerable to code injection and Denial of Service attacks due to CVE-2020-7766 and CVE-2020-7768 Vulnerability Details CVEID: CVE-2020-7768 DESCRIPTION: Node.js grpc module is vulnerable to a denial of...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2020-15266 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2020-15266 Source...

CVE-2020-7768

A flaw was found in nodejs-grpc, where the package @grpc/grpc-js is vulnerable to Prototype Pollution via the loadPackageDefinition. The highest threat from this vulnerability is to system availability...

CVE-2020-7768

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

CVE-2020-7768

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

Design/Logic Flaw

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

CVE-2020-7768

CVE-2020-7768 affects gRPC in Node.js: the package grpc prior to 1.24.4 and @grpc/grpc-js prior to 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition. Impact details in sources describe a pollution path that could alter object prototypes, enabling unauthorized modification of o...

CVE-2020-7768

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

CVE-2020-7768 Prototype Pollution

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

@1amageek/tradable (>=0.8.0, <=0.9.0), @3wks/gae-node-nestjs (>=1.3.4, <=6.0.0-rc.0) +705 more potentially affected by CVE-2020-7768 via @grpc/grpc-js (>=0.1.0, <=1.1.7)

@grpc/grpc-js NPM version =0.1.0, =0.8.0, =1.3.4, =1.0.0, =0.0.1, =1.0.0-master.1, =1.0.1, =0.0.3, =0.0.1, =0.0.2, =2.0.16, =2.6.0-next.4, =2.1.0-alpha.0, =3.0.0 and more Source cves: CVE-2020-7768 Source advisory: MEND:CVE-2020-7768...

3architecture (>=1.0.0, <=1.7.0), @1amageek/tradable (0.9.0) +1687 more potentially affected by CVE-2020-7768 via grpc (>=0.11.1, <=1.24.3)

grpc NPM version =0.11.1, =1.0.0, =1.0.24, =0.0.2, =1.1.6, =0.0.1, =0.1.0, =1.2.1, =0.0.0-7, =1.0.0, =1.1.0 - @ampretia/composer-opus 0.2.0 - @andregarvin/cuneiform 0.0.1 and more Source cves: CVE-2020-7768 Source advisory: MEND:CVE-2020-7768...

CVE-2020-7768

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

PT-2020-19780 · Grpc · Grpc +1

Name of the Vulnerable Software and Affected Versions: grpc versions prior to 1.24.4 @grpc/grpc-js versions prior to 1.1.8 Description: The issue concerns Prototype Pollution via loadPackageDefinition. This affects the grpc and @grpc/grpc-js packages. Recommendations: For grpc versions prior to...

CVE-2020-7768: Improperly Controlled Modification of Object Prototype Attributes

The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...

grpc-gateway:fuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5700081334091776 Project: grpc-gateway Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzerasangrpc-gateway Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000027f62e71 Crash State: NULL Sanitizer: address ASAN Recommended...

cellunet (>=0.1.0, <=0.2.2), color2vec (1.0.0) +12 more potentially affected by CVE-2020-15201 via tensorflow (1.8.0)

tensorflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cellunet =0.1.0, =0.0.5.1, =0.1.0, =0.1.1.1, =1.1.0, =0.9.0a7, =0.1.0, =0.11.0, =0.4.1, =0.5.2, =0.5.5 Source cves: CVE-2020-15201 Source...

Security update for mumble (moderate)

openSUSE Security Update: Security update for mumble Announcement ID: openSUSE-SU-2020:1439-2 Rating: moderate References: 1174041 Affected Products: openSUSE Backports SLE-15-SP2 An update that contains security fixes can now be installed. Description: This update for mumble fixes the following...

Security update for mumble (moderate)

openSUSE Security Update: Security update for mumble Announcement ID: openSUSE-SU-2020:1439-1 Rating: moderate References: 1174041 Affected Products: openSUSE Backports SLE-15-SP1 An update that contains security fixes can now be installed. Description: This update for mumble fixes the following...

Denial of Service in grpc-ts-health-check

Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status...

GHSA-M86M-5M44-PC93 Denial of Service in grpc-ts-health-check

Versions of grpc-ts-health-check prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status...