ROS-20240805-08

A vulnerability in the golang package of the Debian GNU/Linux operating system is related to a lack of protection for service data. data. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to sensitive information A vulnerability in the golang package of the...

Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities

Summary There are multiple vulnerabilities in components of IBM i Modernization Engine for Lifecycle Integration as described in the Vulnerability Details section. The Bouncy Castle Crypto Package For Java could allow a remote authenticated attacker to obtain sensitive information CVE-2024-30171...

Photon OS 4.0: Protobuf PHSA-2023-4.0-0417

An update of the protobuf package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-4.0-0417. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Security Bulletin: IBM Event Streams is vulnerable to a denial of service attack due to the protobuf-java (CVE-2022-3509).

Summary IBM Event Streams is vulnerable to a denial of service attack due to the protobuf-java core and lite. They are most often used for defining communications protocols together with gRPC and for data storage. Vulnerability Details CVEID:CVE-2022-3509 DESCRIPTION: protobuf-java core and lite...

Photon OS 4.0: Protobuf PHSA-2022-4.0-0170

An update of the protobuf package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2022-4.0-0170. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 4.0: Protobuf PHSA-2023-4.0-0391

An update of the protobuf package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-4.0-0391. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Protobuf PHSA-2023-5.0-0022

An update of the protobuf package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-0022. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Security Bulletin: IBM Storage Ceph is vulnerable to Prototype Pollution in Grafana (CVE-2023-36665)

Summary Protobuf is used by IBM Storage Ceph in Grafana as part of metrics. This bulletin identifies the steps to take to address the vulnerability in Grafana. CVE-2023-36665. Vulnerability Details CVEID:CVE-2023-36665 DESCRIPTION: protobuf.js could allow a remote attacker to execute arbitrary co...

Security Bulletin: Security vulnerabilities may affect Go packages that are shipped with IBM CICS TX Advanced.

Summary Security vulnerabilities may affect Go packages that are shipped with IBM CICS TX Advanced. IBM CICS TX Advanced has addressed the issues. Vulnerability Details CVEID:CVE-2023-45288 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a memory exhaustion flaw due to floo...

Security Bulletin: IBM Event Streams is vulnerable to a denial of service attack due to the protobuf-java core and lite ( CVE-2022-3171).

Summary Protobuf-java core and lite are used by IBM Event Streams. The protobuf-java core library provides comprehensive functionality for working with Protocol Buffers, including advanced parsing and serialization, while the protobuf-java-lite library offers a performance-optimized version for...

Moderate: Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.11.6 security update

An update is now available for Red Hat OpenShift GitOps v1.11.6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON

A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by...

GHSA-QC6V-5G5M-8CW2 ZITADEL Go's GRPC example code vulnerability - GO-2024-2687 HTTP/2 CONTINUATION flood in net/http

Summary Applications using the zitadel-go v3 library next branch might be impacted by package vulnerabilities. The output of govulncheck suggests that only example code seems to be impacted, based on 1 of the 3 potential vulnerabilities. This vulnerability is located in the transitive dependency...

Moderate: Red Hat Security Advisory: OpenShift Virtualization 4.16.0 Images security update

Red Hat OpenShift Virtualization release 4.16.0 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which giv...

envoy:rbac_filter_fuzz_test: Use-after-poison in google::protobuf::internal::RepeatedPtrFieldBase::AllocatedSizeAtCapacity

Detailed Report: https://oss-fuzz.com/testcase?key=6598578378702848 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: rbacfilterfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Use-after-poison READ 4 Crash Address: 0x519000089038 Crash State:...

envoy:rbac_filter_fuzz_test: Use-after-poison in google::protobuf::internal::RepeatedPtrFieldBase::InternalExtend

Detailed Report: https://oss-fuzz.com/testcase?key=6330277710856192 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: rbacfilterfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Use-after-poison READ Crash Address: 0x5190000909e8 Crash State:...

envoy:evaluator_fuzz_test: Use-after-poison in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5199564387188736 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: evaluatorfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Use-after-poison READ 1 Crash Address:...

envoy:rbac_filter_fuzz_test: Use-after-poison in google::protobuf::internal::KeyMapBase<std::__1::basic_string<char, std::__1::ch

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=4817027051618304 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: rbacfilterfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Use-after-poison READ 1 Crash Address:...

AlmaLinux 8 : container-tools (ALSA-2024:4246)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:4246 advisory. golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-24786...

ROS-20240703-08

Vulnerability of the parsetagandwiretype function of the protobuf-c.c component of the data serialization protocol in the C programming language Protobuf-c is related to resource release errors. C programming language Protobuf-c protocol is related to errors in resource release. Exploitation of t...