52 matches found
CVE-2025-58189
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information the ALPN protocols sent by the client which is not escaped...
CVE-2025-58188
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains...
CVE-2025-58187
Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains...
CVE-2025-58186
Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption...
SUSE-SU-2025:3825-1 Recommended update 5.0.5.1 for Multi-Linux Manager Server
This update fixes the following issues: server-attestation-image: - CVE-2025-53192: Do not use apache-commons-ognl but its successor ognl bsc1248252 - Image rebuilt to the newest version and updated build dependencies server-hub-xmlrpc-api-image, server-image, server-migration-14-16-image: - Imag...
CVE-2025-47910
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections...
Fedora 44 : rust-matchers / rust-tracing-subscriber (2025-75e3e58200)
The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-75e3e58200 advisory. - Update the tracing-subscriber crate to version 0.3.20. - Update the matchers crate to version 0.2.0. This update also includes a fix for CVE-2025-58160...
Fedora 41 : rust-slab (2025-92719fd556)
The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-92719fd556 advisory. Update to version 0.4.11. This version includes a fix for CVE-2025-55159, but there are zero packages in Fedora or EPEL that use the affected API, so no...
python-zipp security update
3.20.1-2 - Make package buildable for epel=9 3.20.1-1 - Update to 3.20.1 rhbz2307990 3.20.0-1 - Update to 3.20.0 rhbz2304028 3.19.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora41MassRebuild 3.19.2-2 - Rebuilt for Python 3.13 3.19.2-1 - Update to 3.19.2 rhbz2290429 3.19.1-1 - Update to...
SUSE SLES15: suse-manager-5.0-aarch64-proxy-httpd-image / etc (SUSE-SU-2025:02478-1)
The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02478-1 advisory. proxy-helm: - Version 5.0.15: Image rebuilt to the newest version with updated dependencies proxy-httpd-image: - Version 5.0.13: Add redirect of API...
apache-commons-beanutils security update
1.8.3-15.0.1 - Add SuppressPropertiesBeanIntrospector.SUPPRESSDECLARINGCLASS Orabug: 38176946CVE-2025-48734 1.8.3-15 - Fix CVE-2014-0114 - Fix CVE-2019-10086 1.8.3-14 - Mass rebuild 2013-12-27 1.8.3-13 - Add BuildRequires on apache-commons-parent = 26-7 - Remove BuildRequires on...
CVE-2025-4673
Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...
CVE-2025-22866
Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private...
[SECURITY] [DSA 5812-2] postgresql-15 regression update
------------------------------------------------------------------------- Debian Security Advisory DSA-5812-2 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 21, 2024 https://www.debian.org/security/faq -...
Oracle Linux 9 : podman (ELSA-2024-9102)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-9102 advisory. - Rebuild for following CVEs: CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 - rebuild for following CVEs: CVE-2023-25173 CVE-2022-41724...
CVE-2024-34155
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion...
SUSE-SU-2024:1311-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container
This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues: - Impro...
CVE-2022-34789
A cross-site request forgery CSRF vulnerability in Jenkins Matrix Reloaded Plugin 1.1.3 and earlier allows attackers to rebuild previous matrix builds...
PT-2022-22340 · Jenkins · Jenkins Matrix Reloaded Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Matrix Reloaded Plugin versions 1.1.3 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to rebuild previous matrix builds. This issue arises because the plugin does not require POST requests for...