waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request

A flaw was found in the Waitress WSGI server for Python. A remote client can send a request that is exactly recvbytes, which defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default, Waitress won't read any more requests, and when th...

waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request

A flaw was found in the Waitress WSGI server for Python. A remote client can send a request that is exactly recvbytes, which defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default, Waitress won't read any more requests, and when th...

Siemens SCALANCE and RUGGEDCOM Devices Improper Locking (CVE-2024-26925)

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: release mutex after nftgcseqend from abort path The commit mutex should not be released during the critical section between nftgcseqbegin and nftgcseqend, otherwise, async GC worker could collect expired...

MAL-2024-10760 Malicious code in mkt-worker-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf8971f053ecded5e4c81fa201da46f7838e79cf6635808be72fa828ae029a22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mkt-worker-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf8971f053ecded5e4c81fa201da46f7838e79cf6635808be72fa828ae029a22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora 37 : nginx (2022-12721789aa)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-12721789aa advisory. Security: processing of a specially crafted mp4 file by the ngxhttpmp4module might cause a worker process crash, worker process memory disclosure, o...

kernel: io_uring/io-wq: Use set_bit() and test_bit() at worker->flags

A vulnerability was found in the Linux kernel's iouring subsystem within the iowq handling functions, where the issue stems from concurrent access to worker-flags, which can lead to data races when multiple tasks manipulate this structure simultaneously, which result in crashes, impacting the...

mac802154: Fix potential RCU dereference issue in mac802154_scan_worker

...

Malicious code in api-cache-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cc9bdde57f4e80ca9647c2385d252071a1779d2ed98dee773977bac933149638 The OpenSSF Package Analysis project identified 'api-cache-worker' @ 6.1.3 npm as malicious. It is considered malicious because: - The package...

MAL-2024-10385 Malicious code in api-cache-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cc9bdde57f4e80ca9647c2385d252071a1779d2ed98dee773977bac933149638 The OpenSSF Package Analysis project identified 'api-cache-worker' @ 6.1.3 npm as malicious. It is considered malicious because: - The package...

SUSE CVE-2024-49863

In the Linux kernel, the following vulnerability has been resolved: vhost/scsi: null-ptr-dereference in vhostscsigetreq Since commit 3f8ca2e115e5 "vhost/scsi: Extract common handling code from control queue handler" a null pointer dereference bug can be triggered when guest sends an SCSI AN...

SUSE CVE-2022-48954

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix use-after-free in hsci KASAN found that addr was dereferenced after br2deveventwork was freed. ================================================================== BUG: KASAN: use-after-free in...

UBUNTU-CVE-2022-48954

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix use-after-free in hsci KASAN found that addr was dereferenced after br2deveventwork was freed. ================================================================== BUG: KASAN: use-after-free in...

UBUNTU-CVE-2024-50005

In the Linux kernel, the following vulnerability has been resolved: mac802154: Fix potential RCU dereference issue in mac802154scanworker In the mac802154scanworker function, the scanreq-type field was accessed after the RCU read-side critical section was unlocked. According to RCU usage rules,...

CVE-2024-49867

In the Linux kernel, the following vulnerability has been resolved: btrfs: wait for fixup workers before stopping cleaner kthread during umount During unmount, at closectree, we have the following steps in this order: 1 Park the cleaner kthread - this doesn't destroy the kthread, it basically hal...

DEBIAN-CVE-2024-49863

In the Linux kernel, the following vulnerability has been resolved: vhost/scsi: null-ptr-dereference in vhostscsigetreq Since commit 3f8ca2e115e5 "vhost/scsi: Extract common handling code from control queue handler" a null pointer dereference bug can be triggered when guest sends an SCSI AN...

DEBIAN-CVE-2024-49866

In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Fix a race during cpuhp processing There is another found exception that the "timerlat/1" thread was scheduled on CPU0, and lead to timer corruption finally: ODEBUG: init active active state 0 object:...

CVE-2024-49867

In the Linux kernel, CVE-2024-49867 affects the btrfs filesystem when unmounting a filesystem. During close_ctree(), the sequence previously stopped and freed the cleaner kthread before ensuring all fixup workers finished, which could allow a fixup worker to wake a freed task_struct (the cleaner)...

CVE-2024-49867 btrfs: wait for fixup workers before stopping cleaner kthread during umount

In the Linux kernel, the following vulnerability has been resolved: btrfs: wait for fixup workers before stopping cleaner kthread during umount During unmount, at closectree, we have the following steps in this order: 1 Park the cleaner kthread - this doesn't destroy the kthread, it basically hal...

CVE-2024-49867 btrfs: wait for fixup workers before stopping cleaner kthread during umount

In the Linux kernel, the following vulnerability has been resolved: btrfs: wait for fixup workers before stopping cleaner kthread during umount During unmount, at closectree, we have the following steps in this order: 1 Park the cleaner kthread - this doesn't destroy the kthread, it basically hal...