Moderate: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.12.10 Bug Fix Update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.12.10 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation...

lakeFS logs S3 credentials in plain text

Impact S3 credentials are logged in plain text S3Creds:Key:AKIAIOSFODNN7EXAMPLE Secret:wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY appears as part of the log message: time="2023-05-12T13:51:52Z" level=error msg="failed to perform diff" func="pkg/plugins/diff.Service.RunDiff"...

GHSA-4RGC-5G6R-2RJF lakeFS logs S3 credentials in plain text

Impact S3 credentials are logged in plain text S3Creds:Key:AKIAIOSFODNN7EXAMPLE Secret:wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY appears as part of the log message: time="2023-05-12T13:51:52Z" level=error msg="failed to perform diff" func="pkg/plugins/diff.Service.RunDiff"...

Internet Bug Bounty: Misconfiguration in AWS CloudFront CDN configuration makes rubygems.org serve (and cache) content from a unclaimed S3-bucket

A misconfiguration in the AWS CloudFront CDN configuration for rubygems.org caused content to be served from an unclaimed S3 bucket. This could have enabled an attacker to serve malicious content and affect availability. Artifactory instances were observed accessing files, presenting a potential...

CVE-2023-6017

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

Code injection

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

CVE-2023-6017 H2O S3 Bucket Takeover

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

CVE-2023-6017

CVE-2023-6017 concerns H2O with a reference to an S3 bucket that no longer exists, which could allow an attacker to take over the S3 bucket URL. The connected sources (NVD/Red Hat/PRION-like records) confirm the same vulnerability description across multiple feeds, indicating an issue where an ou...

S3 Bucket can lead to spread of malicious R package

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL...

CVE-2023-33045

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute...

Memory corruption

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute...

CVE-2023-33045 Buffer Copy Without Checking Size of Input in WLAN Firmware

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute...

CVE-2023-33045 Buffer Copy Without Checking Size of Input in WLAN Firmware

Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute...

PT-2023-24158 · Unknown · Wlan Firmware

Name of the Vulnerable Software and Affected Versions: WLAN Firmware affected versions not specified Description: The issue is related to memory corruption in the WLAN Firmware when it parses a NAN management frame that carries an S3 attribute. Recommendations: At the moment, there is no...

The Rise of S3 Ransomware: How to Identify and Combat It

In today's digital landscape, around 60% of corporate data now resides in the cloud, with Amazon S3 standing as the backbone of data storage for many major corporations. Despite S3 being a secure service from a reputable provider, its pivotal role in handling vast amounts of sensitive data custom...

Apache Traffic Server Information Disclosure Vulnerability (CNVD-2023-93322)

Apache Traffic Server ATS is the United States Apache Apache Foundation's set of scalable HTTP proxy and caching server. Apache Traffic Server suffers from an information disclosure vulnerability that stems from the application exposing sensitive information and is vulnerable to HTTP/2 and s3...

Apache Traffic Server Input Validation Error Vulnerability (CNVD-2023-93321)

Apache Traffic Server ATS is the United States Apache Apache Foundation's set of scalable HTTP proxy and caching server. Apache Traffic Server suffers from an input validation error vulnerability that stems from an HTTP/2 frame formatting error and is vulnerable to HTTP/2 and s3 authentication...

Important: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as...

RHEL 8 : kernel-rt (RHSA-2023:5794)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5794 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

CVE-2023-44194 Junos OS: An unauthenticated attacker with local access to the device can create a backdoor with root privileges

An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a backdoor with root privileges. The issue is caused by improper directory permissions on a certain system directory, allowing an attacker with...