Security Bulletin: Multiple vulnerabilities in Eclipse Jetty affect IBM Installation Manager and IBM Packaging Utility

Summary There are multiple vulnerabilities in Eclipse Jetty used by IBM Installation Manager and IBM Packaging Utility. The IBM Installation Manager and IBM Packaging Utility have addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-28163 DESCRIPTION: In Eclipse Jetty 9.4.32 to...

The vulnerability of the Postorius-permissions.sh web interface implementation allows a hacker to escalate their privileges.

The vulnerability of the Postorius-permissions.sh web interface implementation for accessing Mailman archives is related to the tracking of symbolic links. Exploiting this vulnerability could allow an attacker to increase their privileges...

openSUSE: Security Advisory for containerd, (openSUSE-SU-2021:0878-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2021:0878-1 Security update for containerd, docker, runc

This update for containerd, docker, runc fixes the following issues: Docker was updated to 20.10.6-ce bsc1184768, bsc1182947, bsc1181594 Switch version to use -ce suffix rather than ce to avoid confusing other tools bsc1182476. CVE-2021-21284: Fixed a potential privilege escalation when the root...

RHEL 8 : container-tools:3.0 (RHSA-2021:2370)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2370 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: runc: vulnerable to...

CentOS 8 : container-tools:2.0 (CESA-2021:2291)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2291 advisory. - runc: vulnerable to symlink exchange attack CVE-2021-30465 Note that Nessus has not tested for this issue but has instead relied only on the application's...

CentOS 8 : container-tools:3.0 (CESA-2021:2370)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2370 advisory. - runc: vulnerable to symlink exchange attack CVE-2021-30465 Note that Nessus has not tested for this issue but has instead relied only on the application's...

RHEL 8 : container-tools:rhel8 (RHSA-2021:2371)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2371 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: runc: vulnerable to...

CentOS 8 : container-tools:rhel8 (CESA-2021:2371)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2371 advisory. - runc: vulnerable to symlink exchange attack CVE-2021-30465 Note that Nessus has not tested for this issue but has instead relied only on the application's...

Path Traversal in kalcaddle/kodexplorer

✍️ Description KodExplorer A web-based file manager, web IDE/browser-based code editor. I discovered that by uploading a symbolic linked file via any user, he/she could see any file in the server which causes Path Traversal vulnerability. 🕵️‍♂️ Proof of Concept 1. Create a file by the following...

Oracle Linux 8 : container-tools:ol8 (ELSA-2021-2371)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2371 advisory. - fix CVE-2021-30465 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not tested for...

Oracle Linux 8 : container-tools:3.0 (ELSA-2021-2370)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-2370 advisory. - fix CVE-2021-30465 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not tested for...

CVE-2021-32553

It was discovered that readfile in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users...

CVE-2021-32550

It was discovered that readfile in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users...

CVE-2021-32547

It was discovered that readfile in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package apport hooks, it could expose private data to other local users...

CVE-2021-32547

The CVE-2021-32547 entry concerns Ubuntu Apport: read_file() in apport/hookutils.py can follow symbolic links or open FIFOs when used by the openjdk-lts package apport hooks, allowing a local attacker to access private data. Documents confirm the vulnerability affects Ubuntu’s Apport hooks and th...

SUSE-SU-2021:1954-1 Security update for containerd, docker, runc

This update for containerd, docker, runc fixes the following issues: Docker was updated to 20.10.6-ce bsc1184768, bsc1182947, bsc1181594 Switch version to use -ce suffix rather than ce to avoid confusing other tools bsc1182476. CVE-2021-21284: Fixed a potential privilege escalation when the root...

CVE-2021-25322

A UNIX Symbolic Link Symlink Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperKitty version 1.3.2-lp152.2.3.1 and prior...

CVE-2021-31997

A UNIX Symbolic Link Symlink Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate from users postorius or postorius-admin to root. This issue affects: openSUSE Leap 15.2 python-postorius version 1.3.2-lp152.1.2 and prior versions. openSUSE...

CVE-2021-25322

A UNIX Symbolic Link Symlink Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperKitty version 1.3.2-lp152.2.3.1 and prior...