SUSE-SU-2023:2136-1 Security update for prometheus-ha_cluster_exporter

This update of prometheus-haclusterexporter fixes the following issues: - rebuild the package with the go 19.9 secure release bsc1200441...

PT-2023-36157 · Unknown · Prometheus-Ha Cluster Exporter

Name of the Vulnerable Software and Affected Versions: prometheus-ha cluster exporter affected versions not specified Description: The issue is related to a security concern that has been addressed by rebuilding the package with the go 19.9 secure release. Recommendations: At the moment, there is...

PT-2023-36159 · Unknown · Prometheus-Ha Cluster Exporter

Name of the Vulnerable Software and Affected Versions: prometheus-ha cluster exporter affected versions not specified Description: The issue is related to a security concern that has been addressed by rebuilding the package with the go 19.9 secure release. Recommendations: At the moment, there is...

DEBIAN-CVE-2023-25950

HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service DoS condition...

SUSE CVE-2023-0836

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGIBEGINREQUEST record. Sensitive data may be disclos...

Security Bulletin: Vulnerability in moment-timezone affects IBM VM Recovery Manager HA GUI

Summary There is vulnerability in moment-timezone opensource package which affects IBM VM Recovery Manager HA and DR GUI. Vulnerability Details IBM X-Force ID: 237819 DESCRIPTION: Node.js moment-timezone module could allow a remote attacker to execute arbitrary commands on the system, caused by a...

Security Bulletin: Vulnerability in moment-timezone affects IBM VM Recovery Manager HA GUI

Summary There is vulnerability in moment-timezone opensource package which affects IBM VM Recovery Manager HA and DR GUI. Vulnerability Details IBM X-Force ID: 238619 DESCRIPTION: Moment Moment-Timezone is vulnerable to a man-in-the-middle attack, caused by cleartext transmission of tz data durin...

K05123525: ConfigSync vulnerability CVE-2019-6649

Security Advisory Description F5 BIG-IP and Enterprise Manager may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings. CVE-2019-6649 Impact The vulnerability is only present when the system is configured for high availability ...

K25033460: TMM vulnerability CVE-2017-6133

Security Advisory Description In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests may cause a denial of service. CVE-2017-6133 Impact The Traffic Management Microkernel TMM generates a core...

K43815022: BIG-IP crypto driver vulnerability CVE-2020-5882

Security Advisory Description Under certain conditions, the Intel QuickAssist Technology QAT cryptography driver may produce a Traffic Management Microkernel TMM core file. CVE-2020-5882 Impact The BIG-IP system temporarily fails to process traffic as it recovers from TMM restarting, and systems...

K19361245: BIG-IP TMM vulnerability CVE-2017-6158

Security Advisory Description The Traffic Management Microkernel TMM has a vulnerability related to the handling of invalid IP addresses. CVE-2017-6158 This issue is exposed only when all of the following conditions are met: You have disabled the Auto Last Hop setting at the Virtual Server, VLAN,...

K51754851: BIG-IP system vulnerability CVE-2018-5512

Security Advisory Description When Large Receive Offload LRO and SYN cookies are enabled default settings, undisclosed traffic patterns may cause TMM to restart. CVE-2018-5512 Impact An attacker may be able to cause a disruption of service. Exposure to this vulnerability is limited to the data...

K65720640: BIG-IP SSL state mirroring vulnerability CVE-2020-5886

Security Advisory Description BIG-IP systems setup for connection mirroring in a High Availability HA pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring...

K21971977: TMM vulnerability CVE-2021-22975

Security Advisory Description Under some circumstances, Traffic Management Microkernel TMM may restart on the BIG-IP system while passing large bursts of traffic. CVE-2021-22975 Impact This vulnerability may allow an attacker to cause a denial-of-service DoS to the BIG-IP system. The BIG-IP syste...

K25595031: zxfrd vulnerability CVE-2020-27725

Security Advisory Description zxfrd leaks memory when listing DNS zones. Zones can be listed via TMSH, iControl or SNMP; only users with access to those services can trigger this vulnerability. CVE-2020-27725 Impact The memory leak by the zxfrd process eventually causes the system to experience a...

K45320419: TMM with HTTP/2 vulnerability CVE-2018-5514

Security Advisory Description Maliciously crafted HTTP/2 request frames can lead to denial of service. There is data plane exposure for virtual servers when the HTTP2 profile is enabled. There is no control plane exposure to this issue. CVE-2018-5514 Impact The BIG-IP system may temporarily fail ...

K19501795: BIG-IP HTTP profile vulnerability CVE-2019-6631

Security Advisory Description iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by a Virtual Server with an associated HTTP profile, in specific circumstances, when the requests do not strictly conform to RFCs. CVE-2019-6631 Impact The...

K12044607: TMM vulnerability CVE-2017-6132

Security Advisory Description In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11.5.0 - 11.5.4, an undisclosed sequence of packets sent to BIG-IP High Availability state mirror listeners...

K00103216: BIG-IP VIPRION MCPD vulnerability CVE-2020-5921

Security Advisory Description SYN flood causes a large number of MCPD context messages destined to secondary blades consuming memory and leading to MCPD failure. CVE-2020-5921 Impact This issue affects only VIPRION hosts with two or more blades installed, including those with Virtual Clustered...

K04518313: BIG-IP APM network access VPN vulnerability CVE-2020-27724

Security Advisory Description In BIG-IP APM, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially-crafted malicious traffic over the tunnel. CVE-2020-27724 Impact This vulnerability may cause the Traffic Management Microkernel...