CVE-2023-5954 Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10...

CVE-2023-5954

CVE-2023-5954 affects HashiCorp Vault and Vault Enterprise. Inbound client requests that trigger a policy check can cause unbounded memory growth, leading to denial of service. Fixes are available in Vault 1.15.2, 1.14.6, and 1.13.10.

PT-2023-7090 · Hashicorp +1 · Hashicorp Vault +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault versions prior to 1.13.10 HashiCorp Vault versions prior to 1.14.6 HashiCorp Vault versions prior to 1.15.2 Vault Enterprise versions prior to 1.13.10 Vault Enterprise versions prior to 1.14.6 Vault Enterprise versions prior t...

Rocky Linux 8 : mutt (RLSA-2021:4181)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4181 advisory. - Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $sslforcetls was processed if an IMAP server's initial server response was invalid...

Rocky Linux 8 : container-tools:rhel8 (RLSA-2020:1650)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:1650 advisory. - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfslinux.go. To exploit this, an...

RHEL 9 : skopeo (RHSA-2023:6363)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6363 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and...

Fedora 39 : gdb (2023-89ade611ee)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-89ade611ee advisory. Backport upstream commit d28fbc7197b which fixes RHBZ 2233965, Security fix for CVE-2022-48065 ---- Security fix for CVE-2022-48064, Backport upstre...

Fedora 39 : golang-x-image (2023-28cff1a2de)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-28cff1a2de advisory. Update to 0.13.0 Security fix for CVE-2023-29408 Security fix for CVE-2023-29407 Security fix for CVE-2022-41727 Tenable has extracted the preceding...

Rocky Linux 8 : grafana (RLSA-2022:0001)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0001 advisory. - net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...

Fedora 39 : mod_http2 (2023-492b7be466)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-492b7be466 advisory. - New version 2.0.25 - Security update Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Mattermost vulnerable to excessive memory consumption

Mattermost fails to properly sanitize the request to /api/v4/redirectlocation allowing an attacker, sending a specially crafted request to /api/v4/redirectlocation, to fill up the memory due to caching large items...

GHSA-W496-F5QQ-M58J Mattermost vulnerable to excessive memory consumption

Mattermost fails to properly sanitize the request to /api/v4/redirectlocation allowing an attacker, sending a specially crafted request to /api/v4/redirectlocation, to fill up the memory due to caching large items...

Rocky Linux 8 : go-toolset:rhel8 (RLSA-2022:1819)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1819 advisory. - Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm...

DoS (Denial of Service) net.sourceforge.nekohtml:nekohtml in Confluence Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 7.13.0, 7.19, 8.1.0, 8.2.0, 8.3.0 and 8.5 of Confluence Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H...

GO-2023-2046 Unbounded memory consumption in github.com/ethereum/go-ethereum

Unbounded memory consumption in github.com/ethereum/go-ethereum...

USN-6408-2: libXpm vulnerabilities

USN-6408-1 fixed several vulnerabilities in libXpm. This update provides the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: Yair Mizrahi discovered that libXpm incorrectly handled certain malformed XPM image files. If a user were trick...

Ubuntu 16.04 ESM : libjpeg9 vulnerabilities (USN-5336-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5336-1 advisory. Aladdin Mubaied discovered that the cjpeg utility in libjpeg9 did not properly validate the input image's size. An attacker could possibly use this issue...

Ubuntu 16.04 ESM : Libjpeg6b vulnerabilities (USN-5497-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5497-2 advisory. USN-5497-1 fixed vulnerabilities in Libjpeg6b. This update provides the corresponding updates for Ubuntu 16.04 ESM. Tenable has extracted the preceding...

Ubuntu 16.04 ESM : containerd vulnerabilities (USN-5521-1)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5521-1 advisory. It was discovered that containerd insufficiently restricted permissions on container root and plugin directories. If a user or automated system were...

GHSA-V9JH-J8PX-98VQ go-ethereum vulnerable to denial of service via crafted GraphQL query

Geth aka go-ethereum through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service memory consumption and daemon hang via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint is not designed to withstand attacks by hostile client...