CVE-2024-23444 Elasticsearch elasticsearch-certutil csr fails to encrypt private key

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

kernel security update

5.14.0-427.28.14.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

PT-2024-19874

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 8.12.x Description The issue arises when the elasticsearch-certutil CLI tool is used with the csr option to create a new Certificate Signing Request. In this scenario, the associated private key generated is...

CVE-2024-40814

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.6. An app may be able to bypass Privacy preferences...

CVE-2024-40814

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.6, macOS Ventura 13.7. An app may be able to bypass Privacy preferences...

CVE-2024-40775

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.6, macOS Monterey 12.7.6, macOS Ventura 13.6.8. An app may be able to leak sensitive user information...

CVE-2024-40774

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.6.8, macOS Monterey 12.7.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, macOS Sonoma 14.6. An app may be able to bypass Privacy preferences...

CVE-2024-40774

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6, watchOS 10.6. An app may be able to bypass Privacy preferences...

CVE-2024-40775

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to leak sensitive user information...

CVE-2024-40814

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.6, macOS Ventura 13.7. An app may be able to bypass Privacy preferences...

CVE-2024-40814

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.6, macOS Ventura 13.7. An app may be able to bypass Privacy preferences...

CVE-2024-40814

CVE-2024-40814 affects macOS, described as a downgrade issue that could allow an app to bypass Privacy preferences. Apple states the issue was fixed with additional code-signing restrictions and references macOS Sonoma 14.6 as the fixed version. The NVD/NCSC/Nessus entries corroborate the vulnera...

CVE-2024-40775

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to leak sensitive user information...

CVE-2024-40775

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to leak sensitive user information...

CVE-2024-40775

CVE-2024-40775 describes a downgrade issue addressed by adding code-signing restrictions. The vulnerability could allow an app to leak sensitive user information. Apple fixed the issue in macOS Sonoma 14.6, macOS Monterey 12.7.6, and macOS Ventura 13.6.8. The provided connected documents confirm ...

CVE-2024-40774

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6, watchOS 10.6. An app may be able to bypass Privacy preferences...

CVE-2024-40774

CVE-2024-40774 is a downgrade issue addressed by stricter code-signing restrictions. Affected platforms include macOS Ventura 13.6.8, Monterey 12.7.6, iOS 17.6/iPadOS 17.6, watchOS 10.6, tvOS 17.6, and macOS Sonoma 14.6; the flaw could allow an app to bypass Privacy preferences. Remediation is th...

CVE-2024-40774

A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, tvOS 17.6, watchOS 10.6. An app may be able to bypass Privacy preferences...

PT-2024-29071 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.6 Description: A downgrade issue was addressed with additional code-signing restrictions. This issue may allow an app to bypass Privacy preferences. Recommendations: For versions prior to 14.6, update to macOS Sonom...

PT-2024-29034 · Apple · Macos Sonoma +3

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.6 macOS Monterey versions prior to 12.7.6 macOS Ventura versions prior to 13.6.8 Description: A downgrade issue was addressed with additional code-signing restrictions. This issue may allow an app to leak sensitive...