grpc/api_fuzzer: Incorrect-function-pointer-type in grpc_core::AresDnsResolver::StartResolvingLocked

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5129478546653184 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash...

(RHSA-2019:0237) Moderate: etcd security, bug fix, and enhancement update

The etcd packages provide a highly available key-value store for shared configuration. The following packages have been upgraded to a later upstream version: etcd 3.3.11. BZ1664290 Security Fixes: etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS via gRPC-gateway CVE-2018-16886 For...

grpc/api_fuzzer: Incorrect-function-pointer-type in grpc_core::AresDnsResolver::StartResolvingLocked

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5635097540165632 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash...

grpc/api_fuzzer: Incorrect-function-pointer-type in grpc_core::AresDnsResolver::StartResolvingLocked

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5168950411788288 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash...

Weak Authentication

github.com/etcd-io/etcd is vulnerable to privilege escalation. The vulnerability exists as it uses Common Name CN in the etcd client server TLS certificate to authenticate user with any valid certificate to the gRPC-gateway...

etcd 3.2.x, 3.3.x Authentication Vulnerability

etcd is vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

Authentication flaw

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

UBUNTU-CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

CVE-2018-16886

CVE-2018-16886 affects etcd 3.2.x before 3.2.26 and 3.3.x before 3.3.11. The vulnerability is an improper authentication issue when RBAC is enabled and client-cert-auth is used; if an etcd TLS certificate CN matches a valid RBAC username, a remote attacker could authenticate as that user using an...

CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

grpc/api_fuzzer: Heap-use-after-free in grpc_core::channelz::CallCountingHelper::RecordCallFailed

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5717773926268928 Project: grpc Fuzzer: libFuzzerapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x60e0000012d0...

Happy graduation, Envoy!

Envoy, the new darling of the DevOps community, performs the role of a service and edge proxy. With advanced features such as timeouts, rate limiting, circuit breaking, load balancing, retries, stats, logging, and distributed tracing are required to handle network failures in a fault tolerant and...

PT-2018-2974 · Coreos +2 · Etcd +2

Name of the Vulnerable Software and Affected Versions: etcd versions 3.2.x through 3.2.25 etcd versions 3.3.x through 3.3.10 Description: The issue concerns an improper authentication problem when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS...

FreeBSD : Gitlab -- multiple vulnerabilities (065b3b72-c5ab-11e8-9ae2-001b217b3468)

Gitlab reports : SSRF GCP access token disclosure Persistent XSS on issue details Diff formatter DoS in Sidekiq jobs Confidential information disclosure in events API endpoint validatelocalhost function in urlblocker.rb could be bypassed Slack integration CSRF Oauth2 GRPC::Unknown logging token...

Gitlab -- multiple vulnerabilities

Gitlab reports: SSRF GCP access token disclosure Persistent XSS on issue details Diff formatter DoS in Sidekiq jobs Confidential information disclosure in events API endpoint validatelocalhost function in urlblocker.rb could be bypassed Slack integration CSRF Oauth2 GRPC::Unknown logging token...

Chrome OS 10820.0.0 dev-channel - app-VM via garcon TCP Command Socket

Chrome OS 10820.0.0 dev-channel - app-VM via garcon TCP Command Socket ======================= BUG DESCRIPTION ======================= There is a variety of RPC communication channels between the Chrome OS host system and the crosvm guest. This bug report focuses on communication on TCP port 8889...