ALSA-2024:0539 Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: HTTP request smuggling via malformed trailer headers CVE-2023-46589 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: HTTP request smuggling via malformed trailer headers CVE-2023-46589 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

FreeBSD : rclone -- Multiple vulnerabilities (b5e22ec5-bc4b-11ee-b0b5-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b5e22ec5-bc4b-11ee-b0b5-b42e991fc52e advisory. - A race condition in go-resty can result in HTTP request body disclosure across requests. Thi...

RHEL 8 : squid:4 (RHSA-2024:0397)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0397 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fixes: squid: DoS against...

Atlassian Confluence SSTI Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Atlassian Confluence SSTI Injection', 'Description' = %q This module exploits an SSTI injection in Atlassian Confluence servers. A specially...

Security Bulletin: IBM Sterling Connect:Direct for UNIX is vulnerable to multiple issues due to Eclipse Jetty.

Summary Eclipse Jetty is used by IBM Sterling Connect:Direct for UNIX in product management. IBM Sterling Connect:Direct for UNIX is impacted by vulnerabilities in Eclipse Jetty. IBM Sterling Connect:Direct for UNIX has upgraded Eclipse Jetty to version 9.4.53 to address the issues. Vulnerability...

CVE-2024-0885

A vulnerability classified as problematic has been found in SpyCamLizard 1.230. Affected is an unknown function of the component HTTP GET Request Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and ma...

CVE-2023-40547 Shim: rce in http boot support may lead to secure boot bypass

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete...

CVE-2023-40547 Shim: rce in http boot support may lead to secure boot bypass

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete...

Security Bulletin: IBM Storage Ceph is vulnerable to a HTTP Request Smuggling vulnerablity in Golang (CVE-2022-1705)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-1705 Vulnerability Details CVEID:CVE-2022-1705 DESCRIPTION: Golang Go is vulnerable to HTTP request smuggling, caused by a flaw with accepting of some invalid Transfer-Encoding headers in the HTTP/...

Ubuntu 23.04 / 23.10 : Puma vulnerability (USN-6597-1)

The remote Ubuntu 23.04 / 23.10 host has a package installed that is affected by a vulnerability as referenced in the USN-6597-1 advisory. It was discovered that Puma incorrectly handled parsing chunked transfer encoding bodies. A remote attacker could possibly use this issue to cause Puma to...

SUSE: Security Advisory (SUSE-SU-2024:0209-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2024:0206-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in trillium-http and trillium-client

Summary Insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have sufficient control over outbound headers. Details Outbound trilliumhttp::HeaderValue and trilliumhttp::HeaderName can be constructed infallibly a...

objstor (>=0.4.6, <=0.4.20), rblog (>=0.100.0, <=0.123.0) +12 more potentially affected by CVE-2024-23644 via trillium-http (>=0.2.14, <=0.3.3)

trillium-http CARGO version =0.2.14, =0.4.6, =0.100.0, =0.2.0, =0.2.0-rc.1, =0.2.0, =0.2.0, =0.2.0, =0.3.0, =0.2.0, =0.3.1, =0.4.2 - trillium-tracing 0.1.0 Source cves: CVE-2024-23644 Source advisory: OSV:GHSA-9F9P-CP3C-72JF...

CVE-2024-23644 trillium-http and trillium-client vulnerable to HTTP Request/Response Splitting

Trillium is a composable toolkit for building internet applications with async rust. In trillium-http prior to 0.3.12 and trillium-client prior to 0.5.4, insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have...

Integrating mPulse’s Beacon API with EdgeWorkers to Visualize All Client Requests

Akamai mPulse combines with Akamai EdgeWorkers to visualize any client request and uses its http-request module to let users send their own requests...

SUSE-SU-2024:0209-1 Security update for tomcat

This update for tomcat fixes the following issues: Security fixes: - CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing. bsc1217649 Other fixes: - Streamline how patches are handled in the spec file of the package...

SUSE-SU-2024:0208-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: Updated to Tomcat 10.1.18 - CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing bsc1217649 Find the full release notes at: https://tomcat.apache.org/tomcat-9.0-doc/changelog.html...

SUSE-SU-2024:0206-1 Security update for tomcat

This update for tomcat fixes the following issues: Security fixes: - CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing. bsc1217649 Other fixes: - Streamline how patches are handled in the spec file of the package...