CVE-2024-23322 Envoy crashes when idle and request per try timeout occur within the backoff interval

Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedgeonpertrytimeout is enabled, 2. pertryidletimeout is enabled it can only be done in configuration, 3. per-try-timeout...

Fedora: Security Advisory for golang-github-cenkalti-backoff (FEDORA-2023-cb20f08a4e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: golang-github-cenkalti-backoff-4.2.0-2.fc37

This is a Go port of the exponential backoff algorithm from Google's HTTP Client Library for Java. Exponential backoff is an algorithm that uses feedback to multiplicatively decrease the rate of some process, in order to gradually find an acceptable rate. The retries exponentially increase and st...

PT-2022-34135 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 5.10.121 through 5.10.136 Description: The issue is related to the global state lock backoff in the drm/msm/mdp5 module. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kern...

MAL-2022-6248 Malicious code in spotify-backoff (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06908fcee4182da590120989c79d47a9bb4e10af6536a2063c9a483d01453f64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spotify-backoff (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06908fcee4182da590120989c79d47a9bb4e10af6536a2063c9a483d01453f64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

openSUSE Security Update : rclone (openSUSE-2020-2008)

This update for rclone fixes the following issues : rclone was updated to version 1.53.3 : - Bug Fixes - Fix incorrect use of math/rand instead of crypto/rand CVE-2020-28924 boo1179005 Nick Craig-Wood - Check https://github.com/rclone/passwordcheck for a tool check for weak passwords generated by...

Fedora 31 : mosquitto (2019-4c69fb4cd7)

1.6.7 ===== Broker : - Add workaround for working with libwebsockets 3.2.0. - Fix potential crash when reloading config. Client library : - Don't use / in autogenerated client ids, to avoid confusing with topics. - Fix mosquittomaxinflightmessagesset and mosquittointoption..., MOSQOPTMAX,...

Fedora 29 : mosquitto (2019-d99e2329cb)

1.6.7 ===== Broker : - Add workaround for working with libwebsockets 3.2.0. - Fix potential crash when reloading config. Client library : - Don't use / in autogenerated client ids, to avoid confusing with topics. - Fix mosquittomaxinflightmessagesset and mosquittointoption..., MOSQOPTMAX,...

ike-scan - Discover and fingerprint IKE hosts (IPsec VPN Servers)

Discover and fingerprint IKE hosts IPsec VPN Servers. Building and Installing ike-scan uses the standard GNU autoconf and automake tools, so installation is the normal process: Run git clone https://github.com/royhills/ike-scan.git to obtain the project source code Run cd ike-scan to enter source...

Home Depot Agrees $19.5 Million To Settle 2014 Breach

Home Depot agreed this week to pay $19.5 million to compensate the 40 million cardholders it said were impacted by a massive 2014 data breach. As part of a proposed settlement by Home Depot, it admits no wrongdoing or liability in the breach, according to court filings with the US District Court...

POS Malware Nitlove Seen Dropped in Spam Campaign

Toss another strain of point-of-sale POS malware onto the growing heap discovered this year. The latest variant, a variant dubbed NitlovePOS, was spotted being dropped on victims who were compromised by a spam operation. Researchers with the firm FireEye were in the middle of tracking a campaign ...

Payment Cards Exposed in Possible Chik-fil-A Data Breach

It’s been the year of the data breach, so it only makes sense that reports alleging a data breach at the popular fast food chain, Chik-fil-A, would emerge in the final days of 2014. Late yesterday security journalist Brian Krebs reported that an anonymous source at an unnamed financial institutio...

1.2 Million Credit Cards Lost in Staples Data Breach

Retailer Staples has confirmed that point-of-sale malware had been used at 115 of its retail locations in the United States and criminals were able to access 1.16 million payment card numbers during a six-month-long intrusion. Staples said it removed the malware in September from the affected...

Honeywell PoS Software Vulnerable to Stack Buffer Overflows

There are stack buffer overflows in two components of a Honeywell point-of-sale software package that can allow attackers to run arbitrary code on vulnerable systems. The vulnerabilities lie in the HWOPOSScale.ocx and HWOPOSSCANNER.ocx components of Honeywell’s OLE for Retail Point-of-Sale packag...

Payment Card Data Accessed in Parking Provider Data Breach

SP+, a parking management services provider, late last week announced that 17 of its facilities in the United States had been breached and hackers may have made off with an unspecified number of payment card numbers. In a statement, the company said it was notified on Nov. 3 by a payment processo...

New Backoff Variant ROM Tougher to Detect, Analyze

A new and more fine-tuned version of the Backoff point of sale malware known as ROM has been spotted in the wild, according to researchers. While the latest iteration is similar to the preceding version, ROM has tweaks that help the malware better evade detection and hinder the analysis process,...

Backoff Malware Identified as Culprit in Dairy Queen Breach

Backoff apparently has a sweet tooth. International Dairy Queen on Thursday confirmed that 395 of its Dairy Queen locations nationwide were breached by hackers using the dangerous point-of-sale malware. One Orange Julius location was also involved in the breach. The hackers were able to access...

Home Depot Data Breach Confirmed

Home Depot today finally confirmed that its payment systems have been breached, but a number of crucial questions remain unanswered by the giant home improvement retailer. In a statement released late this afternoon, Home Depot said customers using payment cards at its U.S. and Canada locations,...

Home Depot Data Breach Prompts Look at Backoff PoS Malware

Naturally, early speculation on the malware culprit behind the possible Home Depot data breach has leaned toward Backoff. The point-of-sale malware, one of many used against payment terminals, has recently been blamed for more than 1,000 attacks on businesses, prompting the U.S. Secret Service to...