USN-6513-1: Python vulnerabilities

It was discovered that Python incorrectly handled certain plist files. If a user or an automated system were tricked into processing a specially crafted plist file, an attacker could possibly use this issue to consume resources, resulting in a denial of service. CVE-2022-48564 It was discovered...

Debian DSA-5558-1 : netty - security update

The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5558 advisory. - Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The...

Oracle Linux 9 : skopeo (ELSA-2023-6363)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6363 advisory. - rebuild for following CVEs: CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539...

golang: crypto/tls: large handshake records may cause panics

A flaw was found in Golang Go, where it is vulnerable to a denial of service caused when processing large TLS handshake records. By sending specially-crafted TLS handshake records, a remote, authenticated attacker can cause a denial of service condition...

RHEL 8 : container-tools:rhel8 (RHSA-2023:6939)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6939 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: go-yaml:...

RHEL 8 : container-tools:4.0 (RHSA-2023:6938)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6938 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: go-yaml:...

Important: Red Hat Security Advisory: python security update

An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

RHEL 7 : python (RHSA-2023:6885)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6885 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

Important: Red Hat Security Advisory: python3 security update

An update for python3 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: rh-python38-python security update

An update for rh-python38-python is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

AIX is affected by a denial of service (CVE-2023-45167) and a security restrictions bypass (CVE-2023-40217) due to Python

IBM SECURITY ADVISORY First Issued: Tue Nov 7 11:16:49 CST 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/pythonadvisory6.asc Security Bulletin: AIX is affected by a denial of service CVE-2023-45167 and a security restrictions...

RHEL 9 : containernetworking-plugins (RHSA-2023:6402)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6402 advisory. The Container Network Interface CNI project consists of a specification and libraries for writing plug- ins for configuring network interfac...

Calico Typha denial of service vulnerability

In certain conditions for Calico Typha v3.26.2, v3.25.1 and below, and Calico Enterprise Typha v3.17.1, v3.16.3, v3.15.3 and below, a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake call is performed inside the main server...

GHSA-5R5H-Q934-CCCP Calico Typha denial of service vulnerability

In certain conditions for Calico Typha v3.26.2, v3.25.1 and below, and Calico Enterprise Typha v3.17.1, v3.16.3, v3.15.3 and below, a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake call is performed inside the main server...

CVE-2023-41378

In certain conditions for Calico Typha v3.26.2, v3.25.1 and below, and Calico Enterprise Typha v3.17.1, v3.16.3, v3.15.3 and below, a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake call is performed inside the main server...

Design/Logic Flaw

In certain conditions for Calico Typha v3.26.2, v3.25.1 and below, and Calico Enterprise Typha v3.17.1, v3.16.3, v3.15.3 and below, a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake call is performed inside the main server...

CVE-2023-41378 Calico Typha hangs during unclean TLS handshake

In certain conditions for Calico Typha v3.26.2, v3.25.1 and below, and Calico Enterprise Typha v3.17.1, v3.16.3, v3.15.3 and below, a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake call is performed inside the main server...

CVE-2023-41378 Calico Typha hangs during unclean TLS handshake

In certain conditions for Calico Typha v3.26.2, v3.25.1 and below, and Calico Enterprise Typha v3.17.1, v3.16.3, v3.15.3 and below, a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake call is performed inside the main server...

Security Bulletin: Due to use of Netty, IBM® MobileFirst Platform is vulnerable to a denial of service.

Summary Netty is used by IBM® MobileFirst Platform. CVE-2023-34462 Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of heap for each channel during the TLS handshake the SniHandler class. By sending a...

Important: Red Hat Security Advisory: python security update

An update for python is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...