SUSE-SU-2023:4000-1 Security update for yq

This update for yq fixes the following issues: yq was updated to 4.35.2 bsc1215808: Fixed number parsing as float bug in JSON 1756 Fixed string, null concatenation consistency 1712 Fixed expression parsing issue 1711 Update to 4.35.1: Added Lua output support Added BSD checksum format Update to...

GHSA-P6P2-QQ95-VQ5H Remote Code Execution in Custom Integration Upload

Impact The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML files, but Fides can be configured to also accept the inclusion of custom Python code in it. The custom code is executed in a restricted, sandboxed environment, but the sandbox...

Denial Of Service (DoS)

com.fasterxml.jackson.dataformat: jackson-dataformat-toml is vulnerable to Denial of Service DoS attacks. The vulnerability is due a lack of a max nesting depth; If the TOML parser is run on user supplied input an attacker is able to cause a stackoverflow, resulting in an application crash...

SUSE CVE-2023-3894

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

GHSA-RG2C-CFXV-QP6F Denial of service in jackson-dataformat-toml

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

Denial of service in jackson-dataformat-toml

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2023-3894

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

Input validation

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2023-3894 DOS in jackson-dataformats-text

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2023-3894

CVE-2023-3894 affects FasterXML jackson-dataformats-text when parsing TOML, enabling potential DoS via stack overflow. IBM Cloud Pak System products list this CVE among vulnerabilities and recommend upgrading to Cloud Pak System 2.3.3.7 (Interim Fix 1) for general 2.3.x, or to Cloud Pak System 2....

CVE-2023-3894 DOS in jackson-dataformats-text

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2023-3894

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

CVE-2023-3894 DOS in jackson-dataformats-text

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

FasterXML Jackson Buffer Error Vulnerability

FasterXML Jackson is a data manipulation tool for Java from FasterXML USA. A security vulnerability exists in FasterXML Jackson-dataformats-text, which stems from vulnerability to denial-of-service DOS attacks when parsing TOML data...

CVE-2023-3894: Improper Input Validation

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

PT-2023-35499

Name of the Vulnerable Software and Affected Versions base affected versions not specified toml-reader versions 0.1.0.0 Description The issue is related to memory exhaustion with large exponents in the readFloat function. Processing a number expressed in scientific notation with a very large...

go-toml:fuzz_toml: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5116654383398912 Project: go-toml Fuzzing Engine: libFuzzer Fuzz Target: fuzztoml Job Type: libfuzzerasango-toml Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...

go-toml:fuzz_toml: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=6146905338150912 Project: go-toml Fuzzing Engine: libFuzzer Fuzz Target: fuzztoml Job Type: libfuzzerasango-toml Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreate...

go-toml:fuzz_toml: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5513195443322880 Project: go-toml Fuzzing Engine: libFuzzer Fuzz Target: fuzztoml Job Type: libfuzzerasango-toml Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000201350 Crash State: NULL Sanitizer: address ASAN Recommended...

burntsushi-toml:fuzz_toml: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6029837914996736 Project: burntsushi-toml Fuzzing Engine: libFuzzer Fuzz Target: fuzztoml Job Type: libfuzzerasanburntsushi-toml Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash...