CVE-2024-5550 Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3

In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead...

CVE-2024-5550

CVE-2024-5550 affects h2oai/h2o-3 3.40.0.4. The Typeahead API allows an arbitrary system path lookup, exposing full filesystem paths (e.g., /home, /usr, /bin) to remote users. This is an information-disclosure flaw; exploitation is potentially facilitated when combined with a Local File Inclusion...

PT-2024-36531

Name of the Vulnerable Software and Affected Versions h2oai/h2o-3 version 3.40.0.4 Description The issue is caused by an arbitrary system path lookup feature, allowing any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the problem resides in the...

RHCOS 4 : OpenShift Container Platform 4.14.24 (RHSA-2024:2672)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2672 advisory. - golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45288 - buildah: full container escape ...

buildah: full container escape at build time

A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation ...

buildah: full container escape at build time

A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation ...

buildah: full container escape at build time

A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation ...

buildah: full container escape at build time

A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation ...

PT-2024-21517 · Unknown +1 · Util-Linux +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability has been resolved in the Linux kernel related to the mount setattr function, which had stricter permission checks compared to the legacy do reconfigure mnt and do chang...

AZL-42509 CVE-2024-1753 affecting package buildah 1.18.0-29

A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation ...

CVE-2020-36770

pkgpostinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the slurm user to become the owner of root-owned files...

CVE-2020-36770

pkgpostinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the slurm user to become the owner of root-owned files...

Gentoo Security Vulnerabilities

Gentoo is an open source Linux system from the Gentoo Foundation. A security vulnerability exists in Gentoo ebuild for Slurm 22.05.3 and earlier versions, which stems from the fact that pkgpostinst can call chown to assign ownership of files in the root filesystem...

PT-2024-10822 · Gentoo +1 · Gentoo +1

Name of the Vulnerable Software and Affected Versions: Slurm versions through 22.05.3 Description: The issue arises from the pkg postinst in the Gentoo ebuild for Slurm, which unnecessarily calls chown to assign root's ownership on files in the live root filesystem. This could be exploited by the...

runc: volume mount race condition (regression of CVE-2019-19921)

A flaw was found in runc. An attacker who controls the container image for two containers that share a volume can race volume mounts during container initialization by adding a symlink to the rootfs that points to a directory on the volume...

XenMobile upgrade on VMware - boot fails with error: VFS: Unable to mount root fs

After update Endpoint Management aka XenMobile no longer boots with error: not syncing: VFS: Unable to mount root fs on unknown-block0,0...

GHSA-X9MP-JM4H-JJF8 Duplicate Advisory: EVE Doesn't Protect Rootfs

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wc42-fcjp-v8vq. This link is maintained to preserve external references. Original Description In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in t...

Duplicate Advisory: EVE Doesn't Protect Rootfs

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wc42-fcjp-v8vq. This link is maintained to preserve external references. Original Description In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in t...

CVE-2023-43636 Rootfs Not Protected

In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot” design, the PCR values calculated at different stages of the boot process will change if any of their respective parts are changed. This...

EVE OS Data Forgery Issue Vulnerability

EVE OS is a general-purpose, open Linux-based operating system for distributed edge computing open-sourced by IF Edge. EVE OS suffers from a security vulnerability that stems from the fact that the MEASURED boot mechanism does not validate the entire rootfs, leading to an attacker being able to...