551 matches found
GO-2024-2911 go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression
go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression...
Denial Of Service (DoS)
github.com/klauspost/compress/zstd is vulnerable to a Denial of service DoS. The vulnerability is due to its zstd decompression implementation not respecting the limits imposed by gRPC, which allows attacker to trigger rapid and uncontrolled increases in memory usage on the server or client...
go-grpc-compression has a zstd decompression bombing vulnerability
Impact A malicious user could cause a denial of service DoS when using a specially crafted gRPC request. The decompression mechanism for zstd did not respect the limits imposed by gRPC, allowing rapid memory usage increases. Versions v1.1.4 through to v1.2.2 made use of the Decoder.DecodeAll...
GHSA-87M9-RV8P-RGMG go-grpc-compression has a zstd decompression bombing vulnerability
Impact A malicious user could cause a denial of service DoS when using a specially crafted gRPC request. The decompression mechanism for zstd did not respect the limits imposed by gRPC, allowing rapid memory usage increases. Versions v1.1.4 through to v1.2.2 made use of the Decoder.DecodeAll...
Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC
Summary An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. Details The OpenTelemetry Collector handles compressed HTTP requests by recognizing the Content-Encoding header, rewriting the HTTP request body, and allowing...
RHEL 9 : zstd (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - zstd: mysql: buffer overrun in util.c CVE-2022-4899 Note that Nessus has not tested for this issue but has instead...
RHEL 8 : zstd (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - zstd: mysql: buffer overrun in util.c CVE-2022-4899 Note that Nessus has not tested for this issue but has instead...
c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in ZSTD_decompressSequencesLong_bmi2
Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5393115362951168 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Addres...
CVE-2023-52733
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2023-52733
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in ZSTD_decompressMultiFrame
Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5194340354818048 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...
PT-2024-40989 · Skopeo · Skopeo
Name of the Vulnerable Software and Affected Versions: skopeo versions 1.13.0 through 1.14.1 Description: This update for skopeo fixes several issues, including updates to various modules and dependencies, such as github.com/containers/common, github.com/containers/image/v5, and golang.org/x/term...
Moderate: Red Hat Security Advisory: rh-mysql80-mysql security update
An update for rh-mysql80-mysql is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CVE-2024-3508: Uncontrolled Resource Consumption
A flaw was found in Bombastic, which allows authenticated users to upload compressed bzip2 or zstd SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed...
Bombastic 安全漏洞
Bombastic is an Android system inventory manager and automated tester. A security vulnerability exists in Bombastic that originates from allowing authenticated users to upload compressed bzip2 or zstd...
zstd: Heap-buffer-overflow in ZSTD_generateSequences
Hi! This is a manual report, different from the robot-generated ones you've probably seen in the past. With the following new fuzz target and NDEBUG set to disable assertions: include include include include define ZSTDSTATICLINKINGONLY include "fuzzhelpers.h" include "zstd.h" include...
CVE-2022-4899 affecting package zstd for versions less than 1.5.4-1
CVE-2022-4899 affecting package zstd for versions less than 1.5.4-1. An upgraded version of the package is available that resolves this issue...
AlmaLinux 9 : mysql (ALSA-2024:1141)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1141 advisory. - A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun...