Cisco IOS XR gRPC Software Denial of Service Vulnerability

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

CVE-2019-0034

CVE-2019-0034 is rejected/not used; the entry was withdrawn and does not represent a vulnerability.

OPENSUSE-SU-2019:0195-1 Security update for nginx

This update for nginx fixes the following issues: nginx was updated to 1.14.2: - Bugfix: nginx could not be built on Fedora 28 Linux. - Bugfix: in handling of client addresses when using unix domain listen sockets to work with datagrams on Linux. - Change: the logging level of the 'http request',...

openSUSE Security Update : nginx (openSUSE-2019-195)

This update for nginx fixes the following issues : nginx was updated to 1.14.2 : - Bugfix: nginx could not be built on Fedora 28 Linux. - Bugfix: in handling of client addresses when using unix domain listen sockets to work with datagrams on Linux. - Change: the logging level of the 'http request...

Security update for nginx (moderate)

openSUSE Security Update: Security update for nginx Announcement ID: openSUSE-SU-2019:0195-1 Rating: moderate References: 1115015 1115022 1115025 Cross-References: CVE-2018-16843 CVE-2018-16844 CVE-2018-16845 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 SUSE Package Hub for SUSE Linux...

grpc/api_fuzzer: Incorrect-function-pointer-type in grpc_core::AresDnsResolver::StartResolvingLocked

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5642204746350592 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash...

grpc/ssl_server_fuzzer: Heap-buffer-overflow in grpc_core::HandshakerArgs::HandshakerArgs

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5732516768514048 Project: grpc Fuzzer: libFuzzergrpcsslserverfuzzer Fuzz target binary: sslserverfuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Addres...

SUSE SLES15 Security Update : nginx (SUSE-SU-2019:0334-1)

This update for nginx to version 1.14.2 fixes the following issues : Security vulnerabilities addressed : CVE-2018-16843 CVE-2018-16844: Fixed an issue whereby a client using HTTP/2 might cause excessive memory consumption and CPU usage bsc1115025 bsc1115022. CVE-2018-16845: Fixed an issue which...

SUSE-SU-2019:0334-1 Security update for nginx

This update for nginx to version 1.14.2 fixes the following issues: Security vulnerabilities addressed: - CVE-2018-16843 CVE-2018-16844: Fixed an issue whereby a client using HTTP/2 might cause excessive memory consumption and CPU usage bsc1115025 bsc1115022. - CVE-2018-16845: Fixed an issue whic...

grpc/api_fuzzer: Incorrect-function-pointer-type in grpc_core::AresDnsResolver::StartResolvingLocked

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5752853455437824 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash...

grpc/api_fuzzer: Incorrect-function-pointer-type in grpc_core::AresDnsResolver::StartResolvingLocked

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5129478546653184 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash...

(RHSA-2019:0237) Moderate: etcd security, bug fix, and enhancement update

The etcd packages provide a highly available key-value store for shared configuration. The following packages have been upgraded to a later upstream version: etcd 3.3.11. BZ1664290 Security Fixes: etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS via gRPC-gateway CVE-2018-16886 For...

grpc/api_fuzzer: Incorrect-function-pointer-type in grpc_core::AresDnsResolver::StartResolvingLocked

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5635097540165632 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash...

grpc/api_fuzzer: Incorrect-function-pointer-type in grpc_core::AresDnsResolver::StartResolvingLocked

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5168950411788288 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash...

Weak Authentication

github.com/etcd-io/etcd is vulnerable to privilege escalation. The vulnerability exists as it uses Common Name CN in the etcd client server TLS certificate to authenticate user with any valid certificate to the gRPC-gateway...

etcd 3.2.x, 3.3.x Authentication Vulnerability

etcd is vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

Authentication flaw

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

UBUNTU-CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...