envoy:http2_connection_fuzz_test: Container-overflow in Envoy::Http::Http2::ConnectionImpl::onFrameReceived

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=6381413813256192 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: http2connectionfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Container-overflow READ 4 Crash Address:...

Fedora 39 : golang-github-facebook-time (2024-07c811c7a5)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-07c811c7a5 advisory. Security fix for CVE-2023-39325 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Fedora 38 : golang-github-facebook-time (2024-f99ecead66)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-f99ecead66 advisory. Security fix for CVE-2023-39325 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Security Bulletin: IBM Storage Ceph is vulnerable to Uncontrolled Resource Consumption in Grafana (CVE-2023-44487)

Summary Grafana is used by IBM Storage Ceph for visualization of metrics. CVE-2023-44487 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID: CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a...

Important: Red Hat Security Advisory: RHACS 3.74 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security 3.74. The updated images includes bug and security fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Fedora 38 : golang-x-net (2024-0ac454dafc)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-0ac454dafc advisory. update to v0.20.0 for CVE-2023-39325 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 39 : golang-x-net (2024-5d8e87ec66)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5d8e87ec66 advisory. update to v0.20.0 for CVE-2023-39325 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 39 : golang-x-text (2024-b85b97c0e9)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b85b97c0e9 advisory. update to v0.14.0, address CVE-2023-39325 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

Fedora 39 : golang-x-mod (2024-fb32950d11)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-fb32950d11 advisory. Update to v0.14.0 to address CVE-2022-41717 and CVE-2023-39325 Tenable has extracted the preceding description block directly from the Fedora securi...

Fedora 38 : golang-x-mod (2024-ae653fb07b)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-ae653fb07b advisory. Update to v0.14.0 to address CVE-2022-41717 and CVE-2023-39325 Tenable has extracted the preceding description block directly from the Fedora securi...

Fedora 38 : golang-x-text (2024-fd3545a844)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-fd3545a844 advisory. update to v0.14.0, address CVE-2023-39325 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

a2 (>=0.2.0, <=0.5.3), abacuz (>=0.1.0, <=0.1.1) +4572 more potentially affected by CVE-2019-9514 via h2 (>=0.1.26, <=0.3.21)

h2 CARGO version =0.1.26, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.1.0, =1.0.0, =0.1.0, =0.9.1 and more Source cves: CVE-2019-9514 Source advisory: OSV:RUSTSEC-2024-0003...

RUSTSEC-2024-0003 Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)

An attacker with an HTTP/2 connection to an affected endpoint can send a steady stream of invalid frames to force the generation of reset frames on the victim endpoint. By closing their recv window, the attacker could then force these resets to be queued in an unbounded fashion, resulting in Out ...

Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js and packaged modules affect IBM Business Automation Workflow Configuration Editor

Summary IBM Business Automation Workflow Configuration Editor is vulnerable to multiple attacks. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams in the HTTP/2 protocol. By sending...

envoy:http2_connection_fuzz_test: Container-overflow in Envoy::Http::Http2::ReceivedSettingsImpl::ReceivedSettingsImpl

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=4529552193814528 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: http2connectionfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Container-overflow READ 4 Crash Address:...

EulerOS 2.0 SP11 : nghttp2 (EulerOS-SA-2023-3038)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon...

EulerOS Virtualization 2.11.1 : nghttp2 (EulerOS-SA-2023-3363)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

EulerOS Virtualization 2.10.0 : nghttp2 (EulerOS-SA-2023-3478)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

EulerOS Virtualization 2.10.1 : nghttp2 (EulerOS-SA-2023-3506)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

EulerOS 2.0 SP11 : nghttp2 (EulerOS-SA-2023-3015)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon...