kernel: af_unix: Fix data-race around unix_tot_inflight

A data race condition was found in the Linux kernel's AFUNIX socket implementation. The unixtotinflight variable is modified under spinlockunixgclock but read without synchronization in unixreleasesock. This was detected by KCSAN Kernel Concurrency Sanitizer. The fix adds READONCE to ensure prope...

Important: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. 'Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Cross Site Request Forgery (CSRF)

org.jenkins-ci.plugins: docker-build-step is vulnerable to Cross Site Request Forgery CSRF. The vulnerability is due to inadequate validation of user inputs, allowing attackers to connect to an attacker-specified TCP or Unix socket URL and reconfigure the plugin using provided connection test...

Nix Security Vulnerabilities

Nix is a powerful package manager from Nix open source. It is used for making packages. A security vulnerability exists in Nix 2.20.3 and earlier versions, which stems from the fact that a fixed-output derivation on Linux can send a file descriptor from Nix storage to another program running on t...

Jenkins docker-build-step Plugin missing permission check

A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting futu...

GHSA-64C5-R2H5-C2FG Jenkins docker-build-step Plugin Cross-Site Request Forgery vulnerability

A cross-site request forgery CSRF vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions...

CVE-2024-2216

A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting futu...

CVE-2024-2215

A cross-site request forgery CSRF vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions...

Design/Logic Flaw

A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting futu...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions...

CVE-2024-2215

A cross-site request forgery CSRF vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions...

BIT-REDIS-2023-45145 Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.

Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, another process...

openSUSE: Security Advisory for redis (SUSE-SU-2023:4290-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2024:0200-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2024-528)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-528 advisory. 2024-02-29: CVE-2023-45145 was added to this advisory. Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer...

OESA-2024-1141 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel before 6.4.5, drivers/gpu/drm/drmatomic.c has a use-after-free during a race condition between a nonblocking atomic commit and a driver unload.CVE-2023-51043 A use-after-free flaw was found in the Linux Kernel...

Amazon Linux 2 : redis (ALASREDIS6-2024-009)

The version of redis installed on the remote host is prior to 6.2.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2024-009 advisory. Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can...

Amazon Linux 2023 : redis6 (ALAS2023-2024-513)

The version of redis6 installed on the remote host is prior to 6.2.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-513 advisory. - Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2024-516)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-516 advisory. Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote...

Low: redis6

Issue Overview: Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time,...