RHEL 7 : java-1.8.0-ibm (RHSA-2022:6756)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6756 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE ...

CVE-2022-39250 Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification

Matrix JavaScript SDK is the Matrix Client-Server software development kit SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one o...

CVE-2022-23716

A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster...

CVE-2022-23716

A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster...

CVE-2022-23716

A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster...

CVE-2022-23716

The CVE-2022-23716 entry pertains to Elastic Cloud Enterprise (ECE) before 3.1.1, where the SAML signing private key used for RBAC could be disclosed via deployment logs in the Logging and Monitoring cluster. Connected sources confirm affected product/version and the root cause (private key expos...

CVE-2022-23716

A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster...

Elastic Cloud Enterprise 3.1.1 Security Update

Elastic Cloud Enterprise Sensitive information disclosure issue ESA-2022-11 A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster. Affected Versions: Elastic...

PT-2022-16225 · Ece · Ece

Name of the Vulnerable Software and Affected Versions: ECE versions prior to 3.1.1 Description: A flaw was discovered that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster. Recommendations: For versio...

Elastic Cloud Enterprise 日志信息泄露漏洞

Elastic Cloud Enterprise is a cloud platform from Elastic. It makes it easy to deploy, operate, and scale Elastic Stack in the cloud. A security vulnerability exists in Elastic Cloud Enterprise versions prior to 3.1.1, which stems from the disclosure of the SAML signature private key used for RBA...

DEBIAN-CVE-2022-40716

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."...

PT-2022-25492 · Hashicorp +3 · Hashicorp Consul +4

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul and Consul Enterprise versions prior to 1.11.9, 1.12.5, and 1.13.2 Description: The issue concerns HashiCorp Consul and Consul Enterprise, where versions prior to 1.11.9, 1.12.5, and 1.13.2 do not check for multiple SAN URI...

HashiCorp Consul 安全漏洞

HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp USA. The product is used to connect and configure applications across dynamically distributed infrastructures. A security vulnerability exists in HashiCorp Consul and Consul Enterprise versions...

kernel security, bug fix, and enhancement update

5.14.0-70.26.1.0.10.OL9 - lockdown: also lock down previous kgdb use Daniel Thompson Orabug: 34290418 CVE-2022-21499 5.14.0-70.26.10.OL9 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted...

Consul Service Mesh Intention Bypass with Malicious Certificate Signing Request

Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that a specially crafted CSR sent directly to Consul’s internal server agent RPC endpoint can include multiple SAN URI values with additional service names. This vulnerability, CVE-2022-40716, was fixed in Consul...

CVE-2022-29835 WD Discovery's Use of Weak Hashing Algorithm for Code Signing

WD Discovery software executable files were signed with an unsafe SHA-1 hashing algorithm. An attacker could use this weakness to create forged certificate signatures due to the use of a hashing algorithm that is not collision-free. This could thereby impact the confidentiality of user content...

Talos worker join token can be used to get elevated access level to the Talos API

Impact Talos worker nodes use a join token to get accepted into the Talos cluster. A misconfigured Kubernetes environment may allow workloads to access the join token of the worker node. A malicious workload could then use the join token to construct a Talos CSR certificate signing request. Due t...

Huawei EulerOS: Security Advisory for python-jwt (EulerOS-SA-2022-2331)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-36103

Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improper validation of the request while signing a worker node CSR certificate signing request Talos control plane node might issue Talos API...

CVE-2022-36103 Talos worker join token can be used to get elevated access level to the Talos API

Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improper validation of the request while signing a worker node CSR certificate signing request Talos control plane node might issue Talos API...