cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2023-33976 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2023-33976 Source advisory: OSV:GHSA-GJH7-XX4R-X345...

USN-6838-1: Ruby vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that Ruby RDoc incorrectly parsed certain YAML files. If a user or automated system were tricked into parsing a specially crafted .rdocoptions file, a remote attacker could possibly use...

USN-6827-1: LibTIFF vulnerability | Cloud Foundry

Severity Low Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description It was discovered that LibTIFF incorrectly handled memory when performing certain cropping operations, leading to a heap buffer overflow. An attacker could use...

USN-6859-1: OpenSSH vulnerability | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that OpenSSH incorrectly handled signal management. A remote attacker could use this issue to bypass authentication and remotely access systems without proper credentials. Update...

USN-6842-1: gdb vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description It was discovered that gdb incorrectly handled certain memory operations when parsing an ELF file. An attacker could possibly use this issue to cause a denial...

USN-6853-1: Ruby vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that Ruby incorrectly handled the ungetbyte and ungetc methods. A remote attacker could use this issue to cause Ruby to crash, resulting in a denial of service, or possibly obtain...

USN-6852-1: Wget vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that Wget incorrectly handled semicolons in the userinfo subcomponent of a URI. A remote attacker could possibly trick a user into connecting to a different host than expected. Update...

USN-6854-1: OpenSSL vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that OpenSSL failed to choose an appropriately short private key size when computing shared-secrets in the Diffie-Hellman Key Agreement Protocol. A remote attacker could possibly use thi...

USN-6839-1: MariaDB vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description A security issue was discovered in MariaDB and this update includes new upstream MariaDB versions to fix the issue. MariaDB has been updated to 10.6.18 in Ubuntu 22.04 LTS and to 10.11.8 in Ubuntu 23.10 a...

USN-6806-1: GDK-PixBuf vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description Pedro Ribeiro and Vitor Pedreira discovered that the GDK-PixBuf library did not properly handle certain ANI files. An attacker could use this flaw to cause...

USN-6793-1: Git vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that Git incorrectly handled certain submodules. An attacker could possibly use this issue to execute arbitrary code. This issue was fixed in Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu...

USN-6805-1: libarchive vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that libarchive incorrectly handled certain RAR archive files. An attacker could possibly use this issue to execute arbitrary code or cause a crash. Update Instructions: Run sudo pro fix...

USN-6797-1: Intel Microcode vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description It was discovered that some 3rd and 4th Generation Intel® Xeon® Processors did not properly restrict access to certain hardware features when using Intel® SGX...

USN-6791-1: Unbound vulnerability | Cloud Foundry

Severity Low Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that Unbound could take part in a denial of service amplification attack known as DNSBomb. This update introduces certain resource limits to make the impact from Unbound significantly lower...

CBL Mariner 2.0 Security Update: cf-cli / cri-o / gh / libcontainers-common (CVE-2021-43565)

The version of cf-cli / cri-o / gh / libcontainers-common installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-43565 advisory. - The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of...

CVE-2021-43565 affecting package cf-cli for versions less than 8.4.0-18

CVE-2021-43565 affecting package cf-cli for versions less than 8.4.0-18. A patched version of the package is available...

bastion-key-client (>=1.0.1, <=1.4.0), fabric-am-handlers (>=0.11.0, <=1.4.0b2) +5 more potentially affected by CVE-2024-37568 via authlib (0.15.2)

authlib PYPI version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - bastion-key-client =1.0.1, =0.11.0, =0.14.0, =0.4.0, =0.9.0, =1.0.0b1, =1.0.0 Source cves: CVE-2024-37568 Source advisory: OSV:GHSA-5357-C2JX-V7Q...

bastion-key-client (>=1.0.1, <=1.4.0), fabric-am-handlers (>=0.11.0, <=1.4.0b2) +5 more potentially affected by CVE-2024-37568 via authlib (0.15.2)

authlib PYPI version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - bastion-key-client =1.0.1, =0.11.0, =0.14.0, =0.4.0, =0.9.0, =1.0.0b1, =1.0.0 Source cves: CVE-2024-37568 Source advisory: OSV:PYSEC-2024-52...

CVE-2024-22279 - GoRouter Denial of Service Attack | Cloud Foundry

Severity MEDIUM Vendor CloudFoundry Foundation Versions Affected Routing Release v0.273.0 and v30.9.0 and = v40.13.0 Description Cloud foundry routing release versions from v0.273.0 to v0.297.0 are vulnerable to a DOS attack. An unauthenticated attacker can exploit this vulnerability to force...

USN-6768-1: GLib vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description Alicia Boya García discovered that GLib incorrectly handled signal subscriptions. A local attacker could use this issue to spoof D-Bus signals resulting in a variety of impacts including possible privileg...