CVE-2024-28137

A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability...

DEBIAN-CVE-2024-27394

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Use-After-Free in tcpaoconnectinit Since callrcu, which is called in the hlistforeachentryrcu traversal of tcpaoconnectinit, is not part of the RCU read critical section, it is possible that the RCU grace period will pas...

CVE-2024-28137 PHOENIX CONTACT: privilege escalation due to a TOCTOU vulnerability in the CHARX Series

A local attacker with low privileges can perform a privilege escalation with an init script due to a TOCTOU vulnerability...

PT-2024-22287 · Phoenix Contact · Charx Sec-3100

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 affected versions not specified Description: A local attacker with low privileges can perform a privilege escalation with an init script due to a Time-of-Check-to-Time-of-Use TOCTOU vulnerability. Recommendation...

Important: ecs-init

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.4.20240513 to update your system. New Packages: aarch64: ecs-init-1.70.1-1.amzn2023.aarch64 src: ...

Medium: ecs-init

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

PT-2024-28075

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.9.0-rc6 Description The issue arises from the reinitialization of the whole EST structure, which resets the mutex lock embedded in the EST structure and triggers a warning. To address this, the lock is moved to...

Medium: ecs-init

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Important: ecs-init

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.4.20240513 or dnf update --advisory ALAS2023-2024-620 --releasever 2023.4.20240513 to update your system. More informati...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-619)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-619 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-620)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-620 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has no...

OESA-2024-1569 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: tun: avoid double free in tunfreenetdev Avoid double free in tunfreenetdev by moving the dev-tstats and tun-security allocs to a new ndoinit routine tunnetinit...

SUSE CVE-2024-27394

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Use-After-Free in tcpaoconnectinit Since callrcu, which is called in the hlistforeachentryrcu traversal of tcpaoconnectinit, is not part of the RCU read critical section, it is possible that the RCU grace period will pas...

RHEL 6 : cloud-init (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - cloud-init: default configuration disabled deletion of SSH host keys CVE-2018-10896 - cloud-init through...

RHEL 7 : cloud-init (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - cloud-init: sensitive data could be exposed in logs CVE-2023-1786 - When instructing cloud-init to set a...

OESA-2024-1550 kubernetes security update

Container cluster management. Security Fixes: A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with t...

Advisory ROSA-SA-2024-2410

Software: cloud-init 20.3 OS: ROSA Virtualization 2.1 packageevrstring: cloud-init-20.3-10.el84.5.src.rpm CVE-ID: CVE-2021-3429 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: When instructing Cloud-init to set a random password for a new version user account, Cloud-init wrote that password to the publi...

AZL-40325 CVE-2024-27391 affecting package hyperv-daemons for versions less than 6.6.29.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: do not realloc workqueue everytime an interface is added Commit 09ed8bfc5215 "wilc1000: Rename workqueue from "WILCwq" to "NETDEV-wq"" moved workqueue creation in wilcnetdevifcinit in order to set the interface na...

DEBIAN-CVE-2024-27073

In the Linux kernel, the following vulnerability has been resolved: media: ttpci: fix two memleaks in budgetavattach When saa7146registerdevice and saa7146vvinit fails, budgetavattach should free the resources it allocates, like the error-handling of ttpcibudgetinit does. Besides, there are two...

CVE-2024-26988

In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential staticcommandline memory overflow We allocate memory of size 'xlen + strlenbootcommandline + 1' for staticcommandline, but the strings copied into staticcommandline are extracommandline and commandline,...