Moderate: Red Hat Security Advisory: Openshift Logging Bug Fix Release (5.0.5)

Openshift Logging Bug Fix Release 5.0.5 This release includes a security update. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

Moderate: Red Hat Security Advisory: Openshift Logging security and bugs update (5.0.4)

Openshift Logging Bug Fix Release 5.0.4 This release includes a security update. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

protobuf-c bug fix and enhancement update

An update is available for protobuf-c. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

ALBA-2021:1937 protobuf-c bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.7.8 security and extras update

Red Hat OpenShift Container Platform release 4.7.8 is now available with updates to packages and images that fix several bugs. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Processes may panic upon receipt of malicious protobuf messages

Issue Details A security issue was discovered in code generated by the gogo protobuf compiler used by Kubernetes. The gogo protobuf compiler issue has been assigned CVE-2021-3121 and is also known as the “skippy peanut butter bug”. A program which uses affected code to handle a malicious protobuf...

golang-protobuf:wirefuzz: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5917153682391040 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: wirefuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

Security Bulletin: protobuf Vulnerability in Apache Solr affect IBM Operations Analytics - Log Analysis Analysis (CVE-2015-5237)

Summary A potential Buffer Error and Out-of-Bounds Write vulnerabilities in protobuf were addressed by IBM Operations Analytics - Log Analysis. Vulnerability Details CVEID: CVE-2015-5237 DESCRIPTION: Google Protocol Buffers could allow a remote attacker to execute arbitrary code on the system,...

swift-protobuf:FuzzTextFormat_release: Stack-buffer-overflow in SwiftProtobuf.TextFormatScanner.

Project: https://github.com/apple/swift-protobuf.git Detailed Report: https://oss-fuzz.com/testcase?key=5836572361621504 Project: swift-protobuf Fuzzing Engine: libFuzzer Fuzz Target: FuzzTextFormatrelease Job Type: libfuzzerasanswift-protobuf Platform Id: linux Crash Type: Stack-buffer-overflow...

swift-protobuf:FuzzJSON_debug: Invalid-free in SwiftProtobuf.JSONDecoder.decodeExtensionField

Project: https://github.com/apple/swift-protobuf.git Detailed Report: https://oss-fuzz.com/testcase?key=4506617283477504 Project: swift-protobuf Fuzzing Engine: libFuzzer Fuzz Target: FuzzJSONdebug Job Type: libfuzzerasanswift-protobuf Platform Id: linux Crash Type: Invalid-free Crash Address:...

swift-protobuf:FuzzTextFormat_release: Stack-buffer-overflow in SwiftProtobuf.TextFormatScanner.nextUInt

Project: https://github.com/apple/swift-protobuf.git Detailed Report: https://oss-fuzz.com/testcase?key=4519429842010112 Project: swift-protobuf Fuzzing Engine: libFuzzer Fuzz Target: FuzzTextFormatrelease Job Type: libfuzzerasanswift-protobuf Platform Id: linux Crash Type: Stack-buffer-overflow...

GO-2021-0053 Panic due to improper input validation in github.com/gogo/protobuf

Due to improper bounds checking, maliciously crafted input to generated Unmarshal methods can cause an out-of-bounds panic. If parsing messages from untrusted parties, this may be used as a denial of service vector...

swift-protobuf:swift-protobuf-fuzz: Invalid-free in SwiftProtobuf.BinaryDecoder.

Project: https://github.com/apple/swift-protobuf.git Detailed Report: https://oss-fuzz.com/testcase?key=4649469707681792 Project: swift-protobuf Fuzzing Engine: libFuzzer Fuzz Target: swift-protobuf-fuzz Job Type: libfuzzerasanswift-protobuf Platform Id: linux Crash Type: Invalid-free Crash...

gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation

A flaw was found in github.com/gogo/protobuf before 1.3.2 that allows an out-of-bounds access when unmarshalling certain protobuf objects. This flaw allows a remote attacker to send crafted protobuf messages, causing panic and resulting in a denial of service. The highest threat from this...

RHEL 7 / 8 : OpenShift Container Platform 4.7.5 (RHSA-2021:1006)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1006 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

golang-protobuf:wirefuzz: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=6194911335546880 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: wirefuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...

golang-protobuf:wirefuzz: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6104386922217472 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: wirefuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x10c0000bc688 Crash State: NULL Sanitizer: address ASAN...

gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation

A flaw was found in github.com/gogo/protobuf before 1.3.2 that allows an out-of-bounds access when unmarshalling certain protobuf objects. This flaw allows a remote attacker to send crafted protobuf messages, causing panic and resulting in a denial of service. The highest threat from this...

RHEL 7 / 8 : OpenShift Container Platform 4.7.0 (RHSA-2020:5634)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5634 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

golang-protobuf:wirefuzz: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5087367825326080 Project: golang-protobuf Fuzzing Engine: libFuzzer Fuzz Target: wirefuzz Job Type: libfuzzerasangolang-protobuf Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate...