[SECURITY] Fedora 29 Update: kubernetes-1.12.5-2.fc29

Container cluster management...

Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark via crafted URL

In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the...

The vulnerability of the Cluster Service Manager component in Cisco HyperFlex hyperconverged infrastructure allows a attacker to execute arbitrary commands.

The vulnerability of the Cluster Service Manager component in the Cisco HyperFlex hyperconverged infrastructure is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

March 12, 2019—KB4489872 (OS Build 10240.18158)

None None...

March 12, 2019—KB4489891 (Monthly Rollup)

None None...

March 12, 2019—KB4489881 (Monthly Rollup)

None None...

March 12, 2019—KB4489886 (OS Build 16299.1029)

None None...

March 12, 2019—KB4489884 (Security-only update)

None None...

CVE-2018-11793

When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 might overflow the stack due to unbounded recursion. A malicious actor can therefore cause a denial of service of Mesos masters...

The vulnerability of the Kubernetes cluster management software, related to improper error handling, allows a perpetrator to escalate their privileges.

The vulnerability of the Kubernetes cluster management software is related to incorrect error handling. Exploiting this vulnerability allows a malicious actor to gain increased privileges remotely...

CVE-2019-1664

A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the...

CVE-2019-1664 Cisco HyperFlex Software Unauthenticated Root Access Vulnerability

A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the...

CVE-2019-1664 Cisco HyperFlex Software Unauthenticated Root Access Vulnerability

A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the...

[SECURITY] Fedora 28 Update: docker-1.13.1-65.git1185cfd.fc28

Docker is an open-source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that will run virtually anywhere. Docker containers can encapsulate any payload, and will run consistently on and between virtually any server. The same container...

Cisco HyperFlex Software Remote Command Injection Vulnerability

Cisco HyperFlex Software is the United States Cisco Cisco company's set of scalable distributed file system. The system provides unified computing, storage and networking through cloud management, and provides enterprise-class data management and optimization services. A remote command injection...

Corosync Cluster Engine Integer Overflow (CVE-2018-1084)

An integer overflow vulnerability exists in Corosync. The vulnerability is due to an improper data length calculation. Successful exploitation could cause arbitrary code execution in the context of the Corosync user...

Cisco HyperFlex Software Access Control Error Vulnerability

Cisco HyperFlex Software is the United States Cisco Cisco company's set of scalable distributed file system. The system provides unified computing, storage and networking through cloud management, and provides enterprise-class data management and optimization services. An access control error...

CVE-2018-15380

A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting to the cluster...

CVE-2018-15380

A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting to the cluster...

CVE-2018-15380 Cisco HyperFlex Software Command Injection Vulnerability

A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting to the cluster...