1669 matches found
google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON
A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by...
RHEL 8 / 9 : OpenShift Container Platform 4.12.54 (RHSA-2024:1574)
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1574 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.6 packages and security update
Red Hat OpenShift Container Platform release 4.15.6 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...
google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON
A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by...
Infinite Loop
protobuf is vulnerable to an infinite loop. The vulnerability is due to improper handling of malformed JSON structures, specifically when unmarshaling into messages containing a google.protobuf.Any value or when the UnmarshalOptions.DiscardUnknown option is set. This can potentially leads to deni...
Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.13.38 low-latency extras security update
An update for cnf-tests-container, dpdk-base-container, performance-addon-operator-must-gather NUMA-aware secondary scheduler, numaresources-operator is now available for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a security impact of...
Moderate: Red Hat Security Advisory: logging for Red Hat OpenShift security update
An update is now available for RHOL-5.8-RHEL-9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
Moderate: Red Hat Security Advisory: logging for Red Hat OpenShift security update
An update is now available for RHOL-5.7-RHEL-8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
Moderate: Red Hat Security Advisory: logging for Red Hat OpenShift security update
An update is now available for RHOL-5.6-RHEL-8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.13.38 packages and security update
Red Hat OpenShift Container Platform release 4.13.38 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...
google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON
A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by...
Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.14.17 low-latency extras security update
An update for cnf-tests-container, dpdk-base-container, NUMA-aware secondary scheduler, numaresources-operator and numaresources-operator-must-gather is now available for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a security impact of...
Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.15.3 low-latency extras security update
An update for cnf-tests-container, dpdk-base-container, NUMA-aware secondary scheduler, numaresources-operator and numaresources-operator-must-gather is now available for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a security impact of...
CVE-2022-1941 affecting package protobuf for versions less than 25.3-1
CVE-2022-1941 affecting package protobuf for versions less than 25.3-1. An upgraded version of the package is available that resolves this issue...
Advisory ROSA-SA-2024-2374
Software: protobuf-c 1.3.0 OS: ROSA Virtualization 2.1 packageevrstring: protobuf-c-1.3.0-8.rv3 CVE-ID: CVE-2022-48468 BDU-ID: 2023-03313 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the parserequiredmember function of the protobuf-c data serialization protocol is related to integer overflow...
SUSE CVE-2024-24786
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...
Infinite loop in JSON unmarshaling in google.golang.org/protobuf
...
BIT-TENSORFLOW-2022-23570 Null-dereference in Tensorflow
Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK. However, DCHECK is a no-op in production builds...
BIT-TENSORFLOW-2022-23583 `CHECK`-failures in binary ops in Tensorflow
Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer...