Moderate: Red Hat Security Advisory: etcd security, bug fix, and enhancement update

An update for etcd is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS() via gRPC-gateway

Etcd, versions 3.2.0 through 3.2.25 and 3.3.0 through 3.3.10, are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server's TLS certificate contains a Common Name CN which matches a valid RBAC username, a...

Cisco IOS XR gRPC Software Denial of Service Vulnerability

According to its self-reported version, Cisco IOS XR Software is affected by following vulnerability : - A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected...

CVE-2019-1711

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

CVE-2019-1711

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

CVE-2019-1711

Cisco IOS XR Software vulnerability CVE-2019-1711 affects the Event Management Service daemon (emsd). The issue arises from improper handling of gRPC requests, allowing an unauthenticated, remote attacker to repeatedly send gRPC requests and cause emsd to crash, resulting in a DoS. Exploitation i...

CVE-2019-1711 Cisco IOS XR gRPC Software Denial of Service Vulnerability

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

Cisco IOS XR gRPC Software Denial of Service Vulnerability

A vulnerability in the Event Management Service daemon emsd of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this...

CVE-2019-0034

CVE-2019-0034 is rejected/not used; the entry was withdrawn and does not represent a vulnerability.

OPENSUSE-SU-2019:0195-1 Security update for nginx

This update for nginx fixes the following issues: nginx was updated to 1.14.2: - Bugfix: nginx could not be built on Fedora 28 Linux. - Bugfix: in handling of client addresses when using unix domain listen sockets to work with datagrams on Linux. - Change: the logging level of the 'http request',...

openSUSE Security Update : nginx (openSUSE-2019-195)

This update for nginx fixes the following issues : nginx was updated to 1.14.2 : - Bugfix: nginx could not be built on Fedora 28 Linux. - Bugfix: in handling of client addresses when using unix domain listen sockets to work with datagrams on Linux. - Change: the logging level of the 'http request...

Security update for nginx (moderate)

openSUSE Security Update: Security update for nginx Announcement ID: openSUSE-SU-2019:0195-1 Rating: moderate References: 1115015 1115022 1115025 Cross-References: CVE-2018-16843 CVE-2018-16844 CVE-2018-16845 Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0 SUSE Package Hub for SUSE Linux...

grpc/api_fuzzer: Incorrect-function-pointer-type in grpc_core::AresDnsResolver::StartResolvingLocked

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5642204746350592 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash...

grpc/ssl_server_fuzzer: Heap-buffer-overflow in grpc_core::HandshakerArgs::HandshakerArgs

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5732516768514048 Project: grpc Fuzzer: libFuzzergrpcsslserverfuzzer Fuzz target binary: sslserverfuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 8 Crash Addres...

SUSE SLES15 Security Update : nginx (SUSE-SU-2019:0334-1)

This update for nginx to version 1.14.2 fixes the following issues : Security vulnerabilities addressed : CVE-2018-16843 CVE-2018-16844: Fixed an issue whereby a client using HTTP/2 might cause excessive memory consumption and CPU usage bsc1115025 bsc1115022. CVE-2018-16845: Fixed an issue which...

SUSE-SU-2019:0334-1 Security update for nginx

This update for nginx to version 1.14.2 fixes the following issues: Security vulnerabilities addressed: - CVE-2018-16843 CVE-2018-16844: Fixed an issue whereby a client using HTTP/2 might cause excessive memory consumption and CPU usage bsc1115025 bsc1115022. - CVE-2018-16845: Fixed an issue whic...

grpc/api_fuzzer: Incorrect-function-pointer-type in grpc_core::AresDnsResolver::StartResolvingLocked

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5752853455437824 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash...

grpc/api_fuzzer: Incorrect-function-pointer-type in grpc_core::AresDnsResolver::StartResolvingLocked

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5129478546653184 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash...

(RHSA-2019:0237) Moderate: etcd security, bug fix, and enhancement update

The etcd packages provide a highly available key-value store for shared configuration. The following packages have been upgraded to a later upstream version: etcd 3.3.11. BZ1664290 Security Fixes: etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS via gRPC-gateway CVE-2018-16886 For...

grpc/api_fuzzer: Incorrect-function-pointer-type in grpc_core::AresDnsResolver::StartResolvingLocked

Project: https://github.com/grpc/grpc.git Detailed report: https://oss-fuzz.com/testcase?key=5635097540165632 Project: grpc Fuzzer: libFuzzergrpcapifuzzer Fuzz target binary: apifuzzer Job Type: libfuzzerubsangrpc Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash Address: Crash...