SUSE-SU-2018:3815-1 Security update for salt

This update for salt fixes the following issues: Security issues fixed: - CVE-2018-15750: Fixed directory traversal vulnerability in salt-api bsc1113698. - CVE-2018-15751: Fixed remote authentication bypass in salt-apinetapi that allows to execute arbitrary commands bsc1113699. Non-security issue...

389-ds-base security, bug fix, and enhancement update

1.3.8.4-15 - Bump version to 1.3.8.4-15 - Resolves: Bug 1624004 - Fix regression in last patch 1.3.8.4-14 - Bump version to 1.3.8.4-14 - Resolves: Bug 1624004 - potential denial of service attack 1.3.8.4-13 - Bump version to 1.3.8.4-13 - Resolves: Bug 1623949 - Crash in deletepasswdPolicy when...

openSUSE: Security Advisory for tomcat (openSUSE-SU-2018:3054-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

au.com.govlawtech:dvasopapi-client (1.3.1), by.exonit.redmine.client:client-play-ws_2.11 (4.0.0-rc2) +353 more potentially affected by CVE-2017-14063 via org.asynchttpclient:async-http-client (>=2.0.0-alpha13, <=2.0.34)

org.asynchttpclient:async-http-client MAVEN version =2.0.0-alpha13, =1.0, =1.8.0, =1.23.0, =1.2.2, =0.5.4, =0.9.1, =0.0.1, =0.1.13, =1.0, =2.7.0 and more Source cves: CVE-2017-14063 Source advisory: OSV:GHSA-93JQ-624G-4P9P...

GHSA-93JQ-624G-4P9P Improper Input Validation in async-http-client

Async Http Client aka async-http-client before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL CVE-2016-8624 and Oracle Java 8 java.net.URL...

Improper Input Validation in async-http-client

Async Http Client aka async-http-client before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL CVE-2016-8624 and Oracle Java 8 java.net.URL...

org.grails:grails-logging (2.4.0.m1), org.grails:grails-plugin-async (2.4.0.m1) +19 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.4.0.m1)

org.grails:grails-core MAVEN version 2.4.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-logging 2.4.0.m1 - org.grails:grails-plugin-async 2.4.0.m1 - org.grails:grails-plugin-codecs...

org.grails:grails-logging (2.3.0.rc2), org.grails:grails-plugin-async (2.3.0.rc2) +19 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.0.rc2)

org.grails:grails-core MAVEN version 2.3.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-logging 2.3.0.rc2 - org.grails:grails-plugin-async 2.3.0.rc2 - org.grails:grails-plugin-codec...

org.grails:grails-dependencies (2.5.0), org.grails:grails-encoder (2.5.0) +33 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.5.0)

org.grails:grails-core MAVEN version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.5.0 - org.grails:grails-encoder 2.5.0 - org.grails:grails-logging 2.5.0 -...

org.grails:grails-dependencies (2.5.2), org.grails:grails-encoder (2.5.2) +33 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.5.2)

org.grails:grails-core MAVEN version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.5.2 - org.grails:grails-encoder 2.5.2 - org.grails:grails-logging 2.5.2 -...

org.grails:grails-dependencies (2.4.1), org.grails:grails-encoder (2.4.1) +32 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.4.1)

org.grails:grails-core MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.4.1 - org.grails:grails-encoder 2.4.1 - org.grails:grails-logging 2.4.1 -...

org.grails:grails-datastore-gorm (2.0.2.release), org.grails:grails-datastore-gorm-hibernate (2.0.2.release) +28 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.1)

org.grails:grails-core MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm 2.0.2.release - org.grails:grails-datastore-gorm-hibernate 2.0.2.release -...

org.grails:grails-datastore-gorm-grails2-support (>=6.1.0.release, <=6.1.9.release), org.grails:grails-datastore-gorm-grails2-test (>=6.1.0.release, <=6.1.9.release) +35 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.5.6)

org.grails:grails-core MAVEN version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm-grails2-support =6.1.0.release, =6.1.0.release, =6.1.9.release -...

org.grails:grails-dependencies (2.4.0.rc1), org.grails:grails-encoder (2.4.0.rc1) +33 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.4.0.rc1)

org.grails:grails-core MAVEN version 2.4.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.4.0.rc1 - org.grails:grails-encoder 2.4.0.rc1 -...

org.grails:gorm-hibernate4-spring-boot (>=1.0.0.rc1, <=1.0.0.rc2), org.grails:gorm-mongodb-spring-boot (>=1.0.0.m1, <=1.0.0.rc1) +30 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.7)

org.grails:grails-core MAVEN version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:gorm-hibernate4-spring-boot =1.0.0.rc1, =1.0.0.m1, =3.0.2.release, =3.0.2.release, =3.0.2.release,...

org.grails:grails-datastore-gorm (>=2.0.5.release, <=2.0.7.release), org.grails:grails-datastore-gorm-hibernate (>=2.0.5.release, <=2.0.7.release) +27 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.4)

org.grails:grails-core MAVEN version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm =2.0.5.release, =2.0.5.release, =2.0.5.release, =2.0.0-m01, =2.0.5.release,...

org.grails:gorm-hibernate4-spring-boot (1.0.0.m1), org.grails:grails-datastore-gorm (>=3.0.0.release, <=3.0.1.release) +28 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.6)

org.grails:grails-core MAVEN version 2.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:gorm-hibernate4-spring-boot 1.0.0.m1 - org.grails:grails-datastore-gorm =3.0.0.release, =3.0.0.release,...

org.grails:grails-datastore-gorm (2.0.4.release), org.grails:grails-datastore-gorm-hibernate (2.0.4.release) +26 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.3)

org.grails:grails-core MAVEN version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm 2.0.4.release - org.grails:grails-datastore-gorm-hibernate 2.0.4.release -...

org.grails:grails-datastore-gorm (3.1.2.release), org.grails:grails-datastore-gorm-hibernate (3.1.2.release) +29 more potentially affected by CVE-2018-1000529 via org.grails:grails-core (2.3.9)

org.grails:grails-core MAVEN version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm 3.1.2.release - org.grails:grails-datastore-gorm-hibernate 3.1.2.release -...

Apache Tomcat Race Condition vulnerability

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not...