PT-2025-28031

Name of the Vulnerable Software and Affected Versions: protobuf crate for Rust versions prior to 3.7.2 Description: The issue allows uncontrolled recursion in the protobuf::coded input stream::CodedInputStream::skip group function when parsing unknown fields in untrusted input. This can occur due...

Security Bulletin: Multiple vulnerabilies in Go affect IBM Robotic Process Automation for Cloud Pak.

Summary Multiple vulnerabilies in Go affect IBM Robotic Process Automation for Cloud Pak. Go is used by IBM Robotic Process Automation as part of it's operators. This bulletin identifies the fixes to resovle the vulnerabilities. Vulnerability Details CVEID:CVE-2024-21626 DESCRIPTION: Open Contain...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.16.24 security update

Red Hat OpenShift Container Platform release 4.16.24 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

envoy:evaluator_fuzz_test: Use-after-poison in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5620971127504896 Project: envoy Fuzzing Engine: honggfuzz Fuzz Target: evaluatorfuzztest Job Type: honggfuzzasanenvoy Platform Id: linux Crash Type: Use-after-poison READ 1 Crash Address:...

Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-lusitaniae-apacheexporter: Security issues fixed: CVE-2023-3978: Fixed security bug in x/net dependency bsc1213933 Other changes and issues fixed: Delete unpackaged debug files for RHEL Do not include source files in the package for RHEL 9...

Important: protobuf

Issue Overview: Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf...

Malware in appdynamics-protobuf

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Fedora 37 : protobuf (2022-25f35ed634)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-25f35ed634 advisory. Selected notes from packaging changes and improvements: 3.19.6 fixes CVE-2022-3171 3.19.5 fixes CVE-2022-1941 License updated to SPDX Unnecessary...

SUSE-RU-2024:3971-1 Recommended update for mojo-parent

This update for mojo-parent fixes the following issues: xalan-j2 was updated from version 2.7.2 to 2.7.3: - Security issues fixed: CVE-2022-34169: Fixed integer truncation issue when processing malicious XSLT stylesheets bsc1201684 - Changes and Bugs fixed: Java 8 is now the minimum requirement...

Use after free in C++ protobuf

...

OPENSUSE-SU-2024:0351-1 Security update for python-mysql-connector-python

This update for python-mysql-connector-python fixes the following issues: - Update to 9.1.0 boo1231740, CVE-2024-21272 - WL16452: Bundle all installable authentication plugins when building the C-extension - WL16444: Drop build support for DEB packages - WL16442: Upgrade gssapi version to 1.8.3 -...

Malicious code in apc-protobuf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4614be6864d24d518f8097a00e5121fadce06de58b52aebd6053691d12b516a6 The OpenSSF Package Analysis project identified 'apc-protobuf' @ 6.1.3 npm as malicious. It is considered malicious because: - The package...

MAL-2024-10384 Malicious code in apc-protobuf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4614be6864d24d518f8097a00e5121fadce06de58b52aebd6053691d12b516a6 The OpenSSF Package Analysis project identified 'apc-protobuf' @ 6.1.3 npm as malicious. It is considered malicious because: - The package...

Malicious code in appdynamics-protobuf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37a52fe7743188afac58b43269afe61a049bed39642c33558912976f5d73757e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10321 Malicious code in appdynamics-protobuf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37a52fe7743188afac58b43269afe61a049bed39642c33558912976f5d73757e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.19 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.19 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.17.3 security update

Red Hat OpenShift Container Platform release 4.17.3 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in WebSphere Application Server Liberty

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of WebSphere Application Server Liberty Vulnerability Details CVEID:CVE-2024-7254 DESCRIPTION: Google Protocol Buffers a.k.a., protobuf is vulnerable to a denial of service, caused by a stack-based buffer overfl...

Atlassian Jira Service Management Data Center and Server 5.4.x < 5.4.27, 5.12.x < 5.12.14 / 5.13.x < 5.17.4 / 10.0.x < 10.1.1 (JSDSERVER-15617)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-15617 advisory. - Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested...

SUSE SLED15: libprotobuf-lite25_1_0 / libprotobuf25_1_0 / libprotoc25_1_0 / etc (SUSE-SU-2024:3746-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3746-1 advisory. - CVE-2024-7254: Fixed stack overflow vulnerability in Protocol Buffer bsc1230778 Tenable has extracted the preceding...