RHEL 9 : Red Hat OpenStack Platform 17.0 (etcd) (RHSA-2023:1014)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:1014 advisory. A highly-available key value store for shared configuration Security Fixes: Improve heuristics preventing CPU/memory abuse by parsing malicious or...

PT-2024-40697 · Apache · Apache Commons Configuration2

Name of the Vulnerable Software and Affected Versions: Apache Commons Configuration2 affected versions not specified Description: The issue is related to a security exception in the org.apache.commons.configuration2 package. Specifically, the problem occurs in the...

Liberapay: Unsafe yaml load can lead to remote code execution

The YAML load function can lead to remote code execution vulnerability. The vulnerability allows the construction of arbitrary Python objects from untrusted YAML data, which can be exploited by an attacker...

OESA-2024-1433 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: A buffer overread flaw was found in rubygem StringIO. The ungetbyte and ungetc methods on a...

SUSE-SU-2024:1137-1 Security update for helm

This update for helm fixes the following issues: - CVE-2024-25620: Fixed with dependency management path traversal bsc1219969. - CVE-2024-26147: Fixed uninitialized variable in yaml parsing bsc1220207...

CVE-2024-3205

A flaw was found in the libyaml library. A specially crafted YAML file can cause a heap-based buffer over-read in the yamlemitteremitflowsequenceitem function in the src/emitter.c file, resulting in denial of service in the application linked to the library. Mitigation Applications that do not...

CVE-2024-3205

Removed by vendor...

CVE-2024-3205

CVE-2024-3205 concerns the YAML LibYAML library. Connected advisories describe a heap-based buffer overflow in yaml_emitter_emit_flow_sequence_item, potentially exploitable remotely to cause code execution. Technical details vary by source, but all point to libyaml up to version 0.2.5 and a vulne...

Security Bulletin: IBM Planning Analytics Connector for SAP is affected by security vulnerabilities

Summary IBM Planning Analytics Connector for SAP is affected but not classified as vulnerable, based on current information, to vulnerabilities in Golang Go CVE-2022-41723 and Go YAML CVE-2021-4235, CVE-2022-3064. These have been addressed by upgrading the vulnerable libraries. Vulnerability...

编号撤回

libyaml is a codec library for YAML from the YAML community. This CVE number has been withdrawn...

CVE-2024-3205

A vulnerability was found in yaml libyaml up to 0.2.5 and classified as critical. Affected by this issue is the function yamlemitteremitflowsequenceitem of the file /src/libyaml/src/emitter.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit h...

Remote Code Execution

rdoc is vulnerable to Remote Code Execution. The vulnerability is due to unrestricted class restoration when parsing .rdocoptions as a YAML file, allowing for object injection and code injection...

Internet Bug Bounty: CVE-2024-27281: RCE vulnerability with .rdoc_options in RDoc

A remote code execution vulnerability was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. The vulnerability was caused by the lack of restrictions on the classes that could be restored when parsing .rdocoptions as a YAML file. Additionally, object injection and...

Critical: Red Hat Security Advisory: ACS 4.3 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes bug and security fixes. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

GHSA-592J-995H-P23J RDoc RCE vulnerability with .rdoc_options

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdocoptions used for configuration in RDoc as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be...

RDoc RCE vulnerability with .rdoc_options

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdocoptions used for configuration in RDoc as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be...

CVE-2024-27281

A flaw was found in Rubygem RDoc. When parsing .rdocoptions used for configuration in RDoc as a YAML file there are no restrictions on the classes that can be restored. This issue may lead to object injection, resulting in remote code execution. Mitigation Mitigation for this issue is either not...

RDoc 安全漏洞

RDoc is a Ruby documentation system open-sourced by The Ruby Programming Language. A security vulnerability exists in RDoc versions 6.3.3 through 6.6.2, which stems from the lack of any restriction on classes that can be recovered when .rdocoptions is parsed as a YAML file, allowing an attacker t...

Code Injection

Overview Affected versions of this package are vulnerable to Code Injection due to the parsing of .rdocoptions as a YAML file without restrictions on the classes that can be restored. An attacker can execute arbitrary code remotely by crafting malicious .rdocoptions files. Remediation Upgrade rdo...

a-gpt (>=0.1.0, <=0.4.0), aa2 (>=0.9.0, <=0.9.1) +3702 more potentially affected by unknown CVE via yaml-rust (>=0.2.2, <=0.4.5)

yaml-rust CARGO version =0.2.2, =0.1.0, =0.9.0, =1.0.0, =0.1.13, =0.0.9, =0.0.1, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.1.1-alpha.0, =0.1.0, =0.1.27, =0.2.2, =0.2.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0320...