Spring Framework has Authorization Bypass for Case Sensitive Comparisons

The usage of String.toLowerCase and String.toUpperCase has some Locale dependent exceptions that could potentially result in authorization rules not working properly...

CVE-2024-38827

CVE-2024-38827 (IBM Controller) is described as a locale-dependent issue in String.toLowerCase()/toUpperCase() that could cause authorization rules to bypass. Affected product/version: IBM Controller 11.1.0–11.1.1. Remediation: upgrade to IBM Controller 11.1.2 (per IBM bulletin). Connected docs p...

CVE-2024-38827 Spring Security Authorization Bypass for Case Sensitive Comparisons

The usage of String.toLowerCase and String.toUpperCase has some Locale dependent exceptions that could potentially result in authorization rules not working properly...

CVE-2024-38827 Spring Security Authorization Bypass for Case Sensitive Comparisons

The usage of String.toLowerCase and String.toUpperCase has some Locale dependent exceptions that could potentially result in authorization rules not working properly...

3m (=0.1.0), aaa-ml-datasets-course (=1.0.0) +1429 more potentially affected by CVE-2024-11394 via transformers (>=4.0.0 <=4.47.1)

transformers PYPI version =4.0.0, =0.1.1, =0.1.0, =0.0.3, =0.0.0.dev20230804, =0.1.0, =0.3.0, =0.1.0, =0.2.5, =0.0.1, =0.1.0, =0.1.1 - advtok =0.0.2 and more Source cves: CVE-2024-11394 Source advisory: SNYK:PYTHON-TRANSFORMERS-8400820...

Fedora 38 : capnproto / fastnetmon / librime / rr / sonic-visualiser (2022-ef11bad952)

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2022-ef11bad952 advisory. Update capnproto to version 0.10.3 to address CVE-2022-46149. Dependent packages were rebuilt for both the fix for the security issue and the capnproto SONAM...

Low: Red Hat Bug Fix Advisory: updated el9/flatpak-sdk container image

Updated el9/flatpak-sdk container image is now available for Red Hat Enterprise Linux 9. The el9/flatpak-sdk container image has been updated for Red Hat Enterprise Linux 9 to address the following security advisory: RHSA-2024:8617 see References Users of el9/flatpak-sdk container images are...

au.csiro.pathling:encoders (>=5.1.0 <=7.1.0), au.csiro.pathling:fhir-server (>=5.3.1 <=7.1.0) +287 more potentially affected by CVE-2024-51132 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (>=0.0.1 <=6.3.9)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version =0.0.1, =5.1.0, =5.3.1, =6.2.1, =5.3.1, =5.3.1, =5.3.0, =0.0.9, =5.6.5, =4.0.0, =5.6.5, =4.1.0, =4.0.3, =4.1.0, =4.0.0, =4.0.0, =7.4.5 and more Source cves: CVE-2024-51132 Source advisory: OSV:GHSA-4CF2-CXP3-RJR7...

OESA-2024-2328 botan2 security update

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

OESA-2024-2329 botan2 security update

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

tomcat: Denial of Service in Tomcat

A vulnerability was found in Tomcat. Under certain configurations on any platform, this flaw allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process...

10minions-engine (>=0.0.1 <=0.0.4), @0xd541ecb3/byte-babe (>=1.0.0 <=1.2.1) +507 more potentially affected by CVE-2024-7774 via langchain (>=0.0.100 <=0.2.10)

langchain NPM version =0.0.100, =0.0.1, =1.0.0, =0.1.4, =0.0.11, =0.0.0, =0.0.2-alpha, =0.0.33-alpha2, =3.114.0, =1.0.0, =0.1.0, =2.0.68, =0.0.2, =0.1.0, =0.1.4 - @builderbot-plugins/free-gpt =0.0.6-alpha.0 and more Source cves: CVE-2024-7774 Source advisory: OSV:GHSA-HC5W-C9F8-9CC4...

a-data-processing (=0.0.1), ab-data-processing (=0.0.1) +601 more potentially affected by CVE-2024-8309 via langchain (>=0.0.100 <=0.1.9)

langchain PYPI version =0.0.100, =0.1.0, =0.1.7, =0.2.1, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.0.18, =0.1.5, =0.2.0, =0.7.1 and more Source cves: CVE-2024-8309 Source advisory: OSV:GHSA-45PG-36P6-83V9...

tomcat: Denial of Service in Tomcat

A vulnerability was found in Tomcat. Under certain configurations on any platform, this flaw allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process...

SUSE CVE-2024-50383

Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 used in Chacha-Poly1305 and x25519. An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i38...

acedeploy (>=2.4.15 <=2.4.115), apache-airflow-providers-snowflake (>=2.4.0 <=2.5.1rc1) +121 more potentially affected by CVE-2024-49750 via snowflake-connector-python (>=1.7.11 <=3.12.2)

snowflake-connector-python PYPI version =1.7.11, =2.4.15, =2.4.0, =0.0.4, =0.1.0, =1.13.21, =20230717.1.0, =0.4.0, =0.1.0, =0.4.0, =0.5.1, =1.0.5, =1.0.6 and more Source cves: CVE-2024-49750 Source advisory: OSV:GHSA-5VVG-PVHP-HV2M...

CVE-2024-50383

Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 used in Chacha-Poly1305 and x25519. An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i38...

CVE-2024-50382

Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V...

DEBIAN-CVE-2024-50383

Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 used in Chacha-Poly1305 and x25519. An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i38...

AZL-51701 CVE-2024-50383 affecting package botan2 2.14.0-2

Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 used in Chacha-Poly1305 and x25519. An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i38...