CVE-2022-30634

Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 32 - 1 bytes...

CVE-2022-30634 Indefinite hang with large buffers on Windows in crypto/rand

Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 32 - 1 bytes...

CVE-2022-34476

ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnerability affects Firefox 102...

UBUNTU-CVE-2022-34476

ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnerability affects Firefox 102...

PT-2022-20488 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 9.5.34 ELTS TYPO3 versions prior to 10.4.29 TYPO3 versions prior to 11.5.11 Description: The issue concerns Admin Tool sessions in the TYPO3 backend user interface that were not revoked even if the corresponding user...

GO-2022-0477 Indefinite hang with large buffers on Windows in crypto/rand

On Windows, rand.Read will hang indefinitely if passed a buffer larger than 1 32 - 1 bytes...

Keycloak Oauth Implementation Error

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

GHSA-QC72-GFVW-76H7 Keycloak Oauth Implementation Error

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

Sales end time can be postponed indefinitely

Lines of code Vulnerability details Impact Both setSaleStart and setSaleDuration allow owner to postpone the end time of a sale, which make it possible for a token sales be lengthened indefinitely. In such case buyer will never be able to claim. Since the README file specified "Rug Vectors" in th...

krb5 security update

1.15.1-51.0.1 - Add recursion limit for ASN.1 indefinite lengths Orabug: 32582360 1.15.1-51 - Fix KDC null deref on TGS inner body null server CVE-2021-37750 - Resolves: 1997599...

PT-2021-22373 · Octorpki · Octorpki

Name of the Vulnerable Software and Affected Versions: OctoRPKI affected versions not specified Description: The issue arises from OctoRPKI not limiting the depth of a certificate chain, allowing a Certificate Authority CA to create children in an ad-hoc manner. This results in tree traversal nev...

CVE-2021-41973

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater...

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

...

krb5 security update

1.15.1-50.0.1 - Add recursion limit for ASN.1 indefinite lengths Orabug: 32582360...

krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS

A flaw was found in krb5. MIT Kerberos 5 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1encode.c support for BER indefinite lengths lacks a recursion limit...

krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS

A flaw was found in krb5. MIT Kerberos 5 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1encode.c support for BER indefinite lengths lacks a recursion limit...

CVE-2021-22999

On versions 15.0.x before 15.1.0 and 14.1.x before 14.1.4, the BIG-IP system provides an option to connect HTTP/2 clients to HTTP/1.x servers. When a client is slow to accept responses and it closes a connection prematurely, the BIG-IP system may indefinitely retain some streams unclosed. Note:...

Huawei EulerOS: Security Advisory for krb5 (EulerOS-SA-2021-1641)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mongodb Server Input Validation Error Vulnerability (CNVD-2020-67312)

Mongodb Server is the United States Mongodb company's set of open source NoSQL database . The database provides collection-oriented storage , dynamic query , data replication and automatic failover and other functions . An input validation error vulnerability exists in the MongoDB Server version,...

Denial Of Service

krb5is vulnerable to denial of service. The vulnerability exists because lib/krb5/asn.1/asn1encode.c support for indefinite length allows for an unbounded recursion...