PT-2020-16401

Name of the Vulnerable Software and Affected Versions async-h1 versions prior to 2.3.0 Description The issue is a request smuggling vulnerability that affects webservers using async-h1 behind a reverse proxy, including Tide applications. If a server does not read the body of a request that is...

PT-2020-17573

Name of the Vulnerable Software and Affected Versions async-h1 versions prior to 2.3.0 Description An issue was discovered in the async-h1 crate that allows request smuggling to occur when used behind a reverse proxy. This affects any webserver that uses async-h1 behind a reverse proxy, including...

async-metronome (0.2.0), bach (>=0.0.1, <=0.0.2) +8 more potentially affected by CVE-2020-35926 via nanorand (0.4.4)

nanorand CARGO version 0.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on nanorand and may be impacted: - async-metronome 0.2.0 - bach =0.0.1, =0.1.0, =0.1.0, =0.4.7, =0.1.0, =0.1.1 Source cves: CVE-2020-35926 Source advisory: OSV:RUSTSEC-2020-0089...

PT-2020-17624

Name of the Vulnerable Software and Affected Versions async-coap crate versions through 2020-12-08 Description An issue was discovered in the async-coap crate where Send and Sync are implemented for ArcGuard without trait bounds on RC. This allows users to send RC: !Send to other threads and also...

com.cronutils:cron-utils-spring (1.0.1), de.skuzzle.inject:guice-async-extension (>=0.1.0, <=0.3.0) +1 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (3.1.6)

com.cronutils:cron-utils MAVEN version 3.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - com.cronutils:cron-utils-spring 1.0.1 - de.skuzzle.inject:guice-async-extension =0.1.0, =0.0.2, =0.0.4 Source...

de.skuzzle.inject:guice-async-extension (>=1.0.0, <=1.2.0) potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (5.0.0)

com.cronutils:cron-utils MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - de.skuzzle.inject:guice-async-extension =1.0.0, =1.2.0 Source cves: CVE-2020-26238 Source advisory:...

Elastic: Async search stores authorization headers in clear text

Summary: The .async-search index stores the results of async searches. It also stores a copy of the requests authorization headers, in clear text. These clear text authorization headers are then available to anyone with access to .async-search, probably mostly super users. Description: While you...

org.eclipse.jetty.aggregate:jetty-all (11.0.0.beta1), org.eclipse.jetty.demos:demo-async-rest-server (11.0.0.beta2) +21 more potentially affected by CVE-2020-27216 via org.eclipse.jetty:jetty-webapp (>=11.0.0.beta1, <=11.0.0.beta2)

org.eclipse.jetty:jetty-webapp MAVEN version =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta1, =11.0.0.beta2 and more Source cves: CVE-2020-27216 Source advisory: GHSA-G3WG-6MCF-8JJ6...

edu.gemini:gsp-core-ephemeris_2.12 (>=0.1.3, <=0.1.7), edu.gemini:gsp-core-ocs2_2.12 (>=0.1.3, <=0.1.7) +1 more potentially affected by unknown CVE via org.http4s:http4s-async-http-client_2.12 (>=0.21.0-m6, <=0.21.1)

org.http4s:http4s-async-http-client2.12 MAVEN version =0.21.0-m6, =0.1.3, =0.1.3, =0.1.7 - org.scala-steward:scala-steward-core2.12 0.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8HXH-R6F7-JF45...

org.scala-steward:scala-steward-core_2.13 (>=0.6.0, <=0.7.0) potentially affected by CVE-2020-11612 via org.http4s:http4s-async-http-client_2.13 (>=0.21.4, <=0.21.7)

org.http4s:http4s-async-http-client2.13 MAVEN version =0.21.4, =0.6.0, =0.7.0 Source cves: CVE-2020-11612 Source advisory: GHSA-8HXH-R6F7-JF45...

edu.gemini:gsp-core-ephemeris_2.12 (>=0.1.3, <=0.1.7), edu.gemini:gsp-core-ocs2_2.12 (>=0.1.3, <=0.1.7) +1 more potentially affected by CVE-2020-11612 via org.http4s:http4s-async-http-client_2.12 (>=0.21.0-m6, <=0.21.1)

org.http4s:http4s-async-http-client2.12 MAVEN version =0.21.0-m6, =0.1.3, =0.1.3, =0.1.7 - org.scala-steward:scala-steward-core2.12 0.5.0 Source cves: CVE-2020-11612 Source advisory: GHSA-8HXH-R6F7-JF45...

Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Impact A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a...

org.scala-steward:scala-steward-core_2.13 (>=0.6.0, <=0.7.0) potentially affected by unknown CVE via org.http4s:http4s-async-http-client_2.13 (>=0.21.4, <=0.21.7)

org.http4s:http4s-async-http-client2.13 MAVEN version =0.21.4, =0.6.0, =0.7.0 Source cves: unknown CVE Source advisory: OSV:GHSA-8HXH-R6F7-JF45...

GHSA-8HXH-R6F7-JF45 Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Impact A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM. It does not affect http4s servers, other client backends, or clients that speak only to trusted servers. This is related to a...

Unbreakable Enterprise kernel security update

4.1.12-124.42.3 - can: peakusb: pcanusbfd: Fix info-leaks to USB devices Tomas Bortoli Orabug: 31351221 CVE-2019-19535 - media: hdpvr: Fix an error handling path in hdpvrprobe Arvind Yadav Orabug: 31352053 CVE-2017-16644 - fs/binfmtmisc.c: do not allow offset overflow Thadeu Lima de Souza Cascard...

Sandbox Breakout / Arbitrary Code Execution in value-censorship

All versions of value-censorship are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code. Recommendation No fix is currently available. Consider using an alternative package until a f...

PT-2020-21596

Name of the Vulnerable Software and Affected Versions value-censorship versions affected versions not specified Description The issue concerns the failure to validate async function constructors, allowing attackers to execute arbitrary code, which can lead to Remote Code Execution. Recommendation...

SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2020:2069-1)

This update for webkit2gtk3 fixes the following issues : Update to version 2.28.3 bsc1173998 : + Enable kinetic scrolling with async scrolling. + Fix web process hangs on large GitHub pages. + Bubblewrap sandbox should not attempt to bind empty paths. + Fix threading issues in the media player. +...

Security update for webkit2gtk3 (important)

openSUSE Security Update: Security update for webkit2gtk3 Announcement ID: openSUSE-SU-2020:1064-1 Rating: important References: 1173998 Cross-References: CVE-2020-13753 CVE-2020-9802 CVE-2020-9803 CVE-2020-9805 CVE-2020-9806 CVE-2020-9807 CVE-2020-9843 CVE-2020-9850 Affected Products: openSUSE...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2020:1992-1)

This update for webkit2gtk3 fixes the following issues : Update to version 2.28.3 bsc1173998 : + Enable kinetic scrolling with async scrolling. + Fix web process hangs on large GitHub pages. + Bubblewrap sandbox should not attempt to bind empty paths. + Fix threading issues in the media player. +...