CVE-2021-41805

CVE-2021-41805 affects HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4, due to Incorrect Access Control. An ACL token with default operator:write permissions in one namespace can be used for unintended privilege escalation in a different namespace. The pro...

OESA-2021-1454 redis6 security update

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

OESA-2021-1452 redis5 security update

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

GHSA-PFMW-VJ74-PH8G HashiCorp Vault Incorrect Permission Assignment for Critical Resource

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault...

HashiCorp Vault Incorrect Permission Assignment for Critical Resource

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault...

CVE-2021-43998

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault...

CVE-2021-43998

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault...

Design/Logic Flaw

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault...

CVE-2021-43998

HashiCorp Vault and Vault Enterprise were affected by a logic flaw in templated ACL policies: if an entity had multiple aliases for a given entity+mount, the policy could incorrectly apply and match the first-created alias. Affected versions are 0.11.0 through 1.7.5 and 1.8.4. The issue is fixed ...

CVE-2021-43998

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault...

Apache Ozone Access Control Error Vulnerability (CNVD-2021-91628)

Apache Ozone is an application. An accessible control error vulnerability exists in Apache Ozone, which stems from the product's failure to add valid permission checks for users. An attacker could bypass ACL checks to access sensitive information through this vulnerability...

CVE-2021-39234

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL...

CVE-2021-39234

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL...

CVE-2021-39234 Raw block data can be read bypassing ACL/authorization

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL...

SUSE-SU-2021:3722-1 Security update for libarchive

This update for libarchive fixes the following issues: - CVE-2019-19221: Fixed out-of-bounds read caused by incorrect mbrtowc or mbtowc call bsc1157569 - backporting symlink security fixes from 3.5.2: - extracting with ACLs modifies ACLs of target bsc1192425 - modifies file flags of target...

CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2021:4191)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4191 advisory. - QEMU: net: e1000e: use-after-free while sending packets CVE-2020-15859 - QEMU: slirp: invalid pointer initialization may lead to information disclosu...

pacemaker security update

1.1.23-1.0.1 - Upstream reference in pacemaker crmreport binary Orabug: 31611300 1.1.23-1.1 - Prevent ACL bypass CVE-2020-25654 - Resolves: rhbz1892140...

NewStart CGSL CORE 5.05 / MAIN 5.05 : pacemaker Vulnerability (NS-SA-2021-0160)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has pacemaker packages installed that are affected by a vulnerability: - An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with...

CVE-2021-34787 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass Vulnerability

A vulnerability in the identity-based firewall IDFW rule processing feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass security protections. This vulnerability is due to improper...

CVE-2021-34787

Cisco ASA/FTD IDFW rule-bypass (CVE-2021-34787) affects Identity-Based Rule Processing in ASA Software and FTD. Affected devices that use object group search may mishandle certain network requests, allowing an unauthenticated remote attacker to bypass ACLs and security protections, potentially se...