Important: ecs-init

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.4.20240513 to update your system. New Packages: aarch64: ecs-init-1.70.1-1.amzn2023.aarch64 src: ...

PT-2024-28075

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.9.0-rc6 Description The issue arises from the reinitialization of the whole EST structure, which resets the mutex lock embedded in the EST structure and triggers a warning. To address this, the lock is moved to...

Medium: ecs-init

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-620)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-620 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has no...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-619)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-619 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can...

Medium: ecs-init

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Important: ecs-init

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: ecs-init Issue Correction: Run dnf update ecs-init --releasever 2023.4.20240513 or dnf update --advisory ALAS2023-2024-620 --releasever 2023.4.20240513 to update your system. More informati...

OESA-2024-1569 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: tun: avoid double free in tunfreenetdev Avoid double free in tunfreenetdev by moving the dev-tstats and tun-security allocs to a new ndoinit routine tunnetinit...

SUSE CVE-2024-27394

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix Use-After-Free in tcpaoconnectinit Since callrcu, which is called in the hlistforeachentryrcu traversal of tcpaoconnectinit, is not part of the RCU read critical section, it is possible that the RCU grace period will pas...

RHEL 6 : cloud-init (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - cloud-init: default configuration disabled deletion of SSH host keys CVE-2018-10896 - cloud-init through...

RHEL 7 : cloud-init (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - cloud-init: sensitive data could be exposed in logs CVE-2023-1786 - When instructing cloud-init to set a...

OESA-2024-1550 kubernetes security update

Container cluster management. Security Fixes: A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with t...

Advisory ROSA-SA-2024-2410

Software: cloud-init 20.3 OS: ROSA Virtualization 2.1 packageevrstring: cloud-init-20.3-10.el84.5.src.rpm CVE-ID: CVE-2021-3429 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: When instructing Cloud-init to set a random password for a new version user account, Cloud-init wrote that password to the publi...

DEBIAN-CVE-2024-27073

In the Linux kernel, the following vulnerability has been resolved: media: ttpci: fix two memleaks in budgetavattach When saa7146registerdevice and saa7146vvinit fails, budgetavattach should free the resources it allocates, like the error-handling of ttpcibudgetinit does. Besides, there are two...

AZL-40325 CVE-2024-27391 affecting package hyperv-daemons for versions less than 6.6.29.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: do not realloc workqueue everytime an interface is added Commit 09ed8bfc5215 "wilc1000: Rename workqueue from "WILCwq" to "NETDEV-wq"" moved workqueue creation in wilcnetdevifcinit in order to set the interface na...

CVE-2024-26988

In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential staticcommandline memory overflow We allocate memory of size 'xlen + strlenbootcommandline + 1' for staticcommandline, but the strings copied into staticcommandline are extracommandline and commandline,...

AZL-54584 CVE-2024-26983 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: bootconfig: use memblockfreelate to free xbc memory to buddy On the time to free xbc memory in xbcexit, memblock may has handed over memory to buddy allocator. So it doesn't make sense to free memory back to memblock. memblockfre...

CVE-2024-31225 Lack of size check and buffer overflow in RIOT

RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontrollers. The onrdinit function does not implement a size check before copying data to the resultbuf static buffer. If an attacker can craft a long enough...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a bo leak in intelfbboframebufferinit...

kernel: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed

A use-after-free vulnerability was found in the Linux kernel's netfilter queue subsystem. When setting up a new network namespace, if ops-init fails during opsinit, the allocated data is freed but the pointer in net-gen remains pointing to the freed memory. When nfqnlnfhookdrop is subsequently...