CVE-2022-47581

CVE-2022-47581 affects Isode M-Vault servers, specifically versions 16.0v0 through 17.x prior to 17.0v24. The issue causes a crash when handling an LDAP v1 bind request, with CVSS v3.1 base score 7.5 (HIGH) and network attack vector, no user interaction required. Remediation: upgrade to 17.0v24 o...

PT-2022-28077 · Isode · Isode M-Vault

Name of the Vulnerable Software and Affected Versions: Isode M-Vault versions 16.0v0 through 17.x before 17.0v24 Description: The issue causes Isode M-Vault to crash when it receives an LDAP v1 bind request. Recommendations: For versions 16.0v0 through 17.x before 17.0v24, update to version 17.0v...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.1 release and security update

Red Hat JBoss Web Server 5.7.1 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Microsoft Windows. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which give...

Staking Funds vault's LP holder cannot claim EIP1559 rewards after derivatives are minted for a new BLS public key that is not the first BLS public key registered for syndicate

Lines of code Vulnerability details Impact After the derivatives are minted for the first BLS public key registered for the syndicate, the Staking Funds vault's LP holder can claim the corresponding EIP1559 rewards received by the syndicate. However, after the derivatives are minted for a new BLS...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.0 release and security update

Red Hat JBoss Web Server 5.7.0 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Microsoft Windows. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which give...

RHEL 7 / 8 / 9 : Red Hat JBoss Web Server 5.7.0 (RHSA-2022:7272)

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7272 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of...

Improper Certificate Validation

vault is vulnerable to Improper Certificate Validation. The vulnerability exists due to insufficient validation of URI subject alternative names which allows an attacker to bypass the certificate subject verification...

CVE-2022-41316

A flaw was found in HashiCorp Vault and Vault Enterprise. Vault’s TLS certificate auth method did not initially load the optionally-configured CRL issued by the role’s Certificate Authority CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been...

CVE-2022-41316

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and...

Denial of service

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and...

Vault's TLS Cert Auth Method Only Loaded CRL After First Request

Summary Vault’s TLS certificate auth method did not initially load the optionally-configured CRL issued by the role’s CA into memory on startup, resulting in the revocation list not being checked, if the CRL has not yet been retrieved. This vulnerability, CVE-2022-41316, is fixed in Vault 1.12.0,...

CVE-2022-41316

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and...

HashiCorp Vault 信任管理问题漏洞

HashiCorp Vault is a private key access management tool from the US-based HashiCorp. A security vulnerability exists in HashiCorp Vault and Vault Enterprise that stems from its TLS certificate authentication method initially failing to load an optionally configurable CRL issued by the role's CA...

CVE-2022-41316

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and...

CVE-2022-41316

CVE-2022-41316 affects HashiCorp Vault and Vault Enterprise: the TLS certificate auth method did not load the optional CRL into memory on startup, potentially skipping revocation checks until retrieval. A fix is available in Vault/Vault Enterprise releases 1.12.0, 1.11.4, 1.10.7, and 1.9.10.

CVE-2022-41316

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and...

CVE-2022-41316

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and...

PT-2022-25812 · Hashicorp +1 · Hashicorp Vault +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.12.0 HashiCorp Vault and Vault Enterprise versions prior to 1.11.4 HashiCorp Vault and Vault Enterprise versions prior to 1.10.7 HashiCorp Vault and Vault Enterprise versions prior to...

PT-2022-34615 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.9 Description: The issue is related to handling data vault when the value is ZERO SIZE PTR in the thermal/int340x thermal component. The actual impact and attack plausibility have not yet been proven...

OESA-2022-1950 ansible security update

\ Security Fixes: A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the...