8482 matches found
Astra Linux – Vulnerability in mbedtls
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability exists in the decoding of Base64 PEM files. This vulnerability allows system-level administrator attackers to obtain information about secret RSA keys through a controlled-channel and side-channel attack on software running in...
Astra Linux – Vulnerability in Ansible
A flaw was discovered in Ansible 2.7.16 and earlier versions, as well as 2.8.8 and earlier, and 2.9.5 and earlier. When a password is set using the “password” argument of the svn module, it is used in the svn command line, thereby exposing it to other users within the same node. An attacker could...
Astra Linux – Vulnerability in golang-golang-x-net
An attacker can cause excessive memory usage in a Go server that accepts HTTP/2 requests. HTTP/2 server connections include a cache of HTTP header keys sent by the client. Although the total number of entries in this cache is limited, an attacker who sends very large keys can cause the server to...
Astra Linux – Vulnerability in OpenSSL
Issue Summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions. Impact Summary: Attackers may exploit certain server configurations to trigger unbounded memory growth, leading to a Denial of Service attack. This issue can occur in...
Astra Linux – Vulnerability in Ruby 2.5
There is a buffer over-read issue in Ruby before version 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. This issue occurs during the conversion from strings to floats, including in methods like KernelFloat and Stringtof...
Astra Linux – Vulnerability in Redis
Redis is an open-source, in-memory database that persists data on disk. When parsing an incoming Redis Standard Protocol RESP request, Redis allocates memory according to values specified by the user, which determine the number of elements in the multi-bulk header and the size of each element in...
Astra Linux – Vulnerability in golang-gopkg-yaml.v3
A issue with the Un Marshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input...
Astra Linux – Vulnerability in netcdf
A issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxmlentok improperly handles recursion, resulting in stack consumption for a crafted XML file...
Astra Linux – Vulnerability in openjdk-11
Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Concurrency. The supported versions affected by this vulnerability include Oracle Java SE: 8u401, 8u401-perf, 11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. The...
Astra Linux – Vulnerability in avahi
A vulnerability was discovered in Avahi. There exists a potentially exploitable assertion within the dbussethostname function...
Astra Linux – Vulnerability in dcmtk
The service class provider SCP of OFFIS DCMTK all versions prior to 3.6.7 is vulnerable to path traversal attacks, allowing attackers to write DICOM files into arbitrary directories under controlled names. This could enable remote code execution...
Astra Linux – Vulnerability in curl
libcurl provides the CURLOPTCERTINFO option to allow applications to request details about a server’s certificate chain. Due to a faulty function, a malicious server could cause libcurl, built with NSS, to get stuck in an endless busy-loop when attempting to retrieve that information...
Astra Linux – Vulnerability in OpenSSL
Issue summary: Generating excessively long X9.42 DH keys or checking overly long X9.42 DH keys or parameters can be very slow. Applications that use functions like DHgeneratekey to generate an X9.42 DH key may experience prolonged delays. Similarly, applications that use functions like...
Astra Linux – Vulnerability in curl
curl 7.84.0 supports “chained” HTTP compression algorithms, which means that a server response can be compressed multiple times, possibly using different algorithms. The number of allowable “links” in this “decompression chain” is unlimited, allowing a malicious server to insert virtually an...
Astra Linux – Vulnerability in Pypy
A issue was discovered in Python versions 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module incorrectly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of check on the From/To...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: nvmet: fixed a memory leak We forgot to free newmodelnumber...
Astra Linux – Vulnerability in openssl1.0
Calls to the EVPCipherUpdate, EVPEncryptUpdate, and EVPDecryptUpdate functions may cause the output length argument to overflow in some cases where the input length is close to the maximum permissible length for integers on the platform. In such cases, the return value from the function call will...
Astra Linux – Vulnerability in Netty
The Bzip2 decompression decoder function does not allow setting size restrictions on the decompressed output data which affects the allocation size used during decompression. This affects all users of Bzip2Decoder. Malicious inputs can trigger an OOME, thereby causing a DoS attack...
Astra Linux – Vulnerability in openssl1.0
The OpenSSL public API function X509issuerandserialhash attempts to generate a unique hash value based on the issuer and serial number data contained within an X509 certificate. However, it fails to properly handle any errors that may occur during the parsing of the issuer field—errors that could...