CVE-2022-36103 Talos worker join token can be used to get elevated access level to the Talos API

Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improper validation of the request while signing a worker node CSR certificate signing request Talos control plane node might issue Talos API...

Talos Linux 安全漏洞

Talos Linux is Sidero Labs' modern Linux distribution built for Kubernetes. Talos Linux suffers from a security vulnerability that stems from incorrect validation of a request when signing a CSR Certificate Signing Request for a worker node, resulting in full access to the Talos API on a control...

flatpak bug fix and enhancement update

An update is available for mozilla-filesystem, sbc, dbus-glib. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list These packages will be released only via the firef...

flatpak bug fix and enhancement update

An update is available for mozilla-filesystem, sbc, dbus-glib. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list These packages will be released only via the...

CVE-2022-36087

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of urivalidate functions depending where it is used. OAuthLib...

CVE-2022-36087

CVE-2022-36087 affects Python OAuthLib (versions 3.1.1–3.2.1). An attacker supplying a malicious redirect URI could cause a denial of service, and there is potential impact related to the use of uri_validate depending on where it is used. The vulnerability specifically impacts OAuthLib applicatio...

CVE-2022-36087

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of urivalidate functions depending where it is used. OAuthLib...

CVE-2022-36087 OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of urivalidate functions depending where it is used. OAuthLib...

PT-2022-25018 · Samsung · Samsung Mtower

Name of the Vulnerable Software and Affected Versions: Samsung mTower versions 0.3.0 and earlier Description: The issue is related to a missing check on the return value of EC KEY set private key in the sign pFwInfo function, leading to a denial of service. Recommendations: For Samsung mTower...

Error while uploading CSR to renew APNS certificate

When customer attempts to upload a certificate signing request athttps://apnsui.xm.cloud.com/apns, they get an error message saying the upload failed, even though the CSR is created correctly...

[R1] Nessus Agent Version 8.3.4 Fixes Multiple Vulnerabilities

R1 Nessus Agent Version 8.3.4 Fixes Multiple Vulnerabilities Arnie Cabral Wed, 08/24/2022 - 12:18 Custom audit files bring tremendous power and flexibility when assessing the configuration of your assets. Two separate vulnerabilities that utilize this custom Audit functionality were identified,...

CVE-2022-30262

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have n...

Design/Logic Flaw

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have n...

CVE-2022-26305

An Improper Certificate Validation vulnerability was found in LibreOffice, where determining if a trusted author signed a macro was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro...

kernel security and bug fix update

3.10.0-1160.76.1.0.1.OL7 debug: lock down kgdb Orabug: 34270798 CVE-2022-21499 3.10.0-1160.76.1.OL7 Update Oracle Linux certificates Ilya Okomin Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] Update x509.genkey Orabug: 24817676 Confli...

GitHub Moves to Guard Open Source Against Supply Chain Attacks

The popular Microsoft-owned code repository plans to roll out code signing, which will help beef up the security of open source projects...

CVE-2022-35929

A flaw was found in the cosign package. The cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid signature and when there are no attestations of the type being verified for example, —type defaults to...

kernel security and bug fix update

4.18.0-372.19.1.0.16.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32...

CVE-2022-35929 False positive signature verification in cosign

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

CVE-2022-35929

CVE-2022-35929 affects cosign prior to version 1.10.1. In cosign verify-attestation, using --type (default: custom) can yield a false positive when there is at least one attestation with a valid signature and no attestations of the type being verified. Repro example uses distroless image with a v...