Amazon Linux 2 : cloud-init (ALAS-2021-1595)

The version of cloud-init installed on the remote host is prior to 19.3-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1595 advisory. A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use...

cloud-init bug fix and enhancement update

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts. Bug Fixes and Enhancements: Azure Update existing user password RHEL8x BZ1916839...

DEBIAN-CVE-2021-27212

In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service daemon exit via a short timestamp. This is related to schemainit.c and checkTime...

CVE-2021-27167

An issue was discovered on FiberHome HG6245D devices through RP2613. There is a password of four hexadecimal characters for the admin account. These characters are generated in init3bbpassword in libciadaptationlayer.so...

CentOS 8 : cloud-init (CESA-2020:3050)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:3050 advisory. - cloud-init: default configuration disabled deletion of SSH host keys CVE-2018-10896 Note that Nessus has not tested for this issue but has instead relied only...

Unspecified Vulnerability in Rust (CNVD-2021-13699)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust lazy-init crate through 2021-01-17, which stems from a lack of send bindings in Lazy, leading to data contention. No details of the vulnerability are provided at this time...

CentOS 8 : cloud-init (CESA-2020:4650)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:4650 advisory. - cloud-init: Use of random.choice when generating random password CVE-2020-8631 - cloud-init: Too short random password length in ccsetpassword in...

CVE-2021-25901

An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race...

CVE-2021-25901

An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race...

Design/Logic Flaw

An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race...

CVE-2021-25901

An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race...

DEBIAN-CVE-2020-36221

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service schemainit.c serialNumberAndIssuerCheck...

Rust 缓冲区错误漏洞

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust lazy-init crate through 2021-01-17, which stems from a lack of send bindings in Lazy, leading to data contention. No details of the vulnerability are provided at this time...

CVE-2021-25901

CVE-2021-25901 concerns the lazy-init crate for Rust, where the absence of a Send bound enables data races in safe code. Consequence is potential data contention and non-deterministic behavior if the crate is used in multi-threaded contexts. Public advisories (RustSec/RustSec-advisory style) desc...

CVE-2021-25901

An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race...

FreeBSD : cloud-init -- Wrong access permissions of authorized keys (8899298f-5a92-11eb-8558-3085a9a47796)

cloud-init reports : cloud-init release 20.4.1 is now available. This is a hotfix release, that contains a single patch to address a security issue in cloud-init 20.4. Briefly, for users who provide more than one unique SSH key to cloud-init and have a shared AuthorizedKeysFile configured in...

addr2line (=0.6.0), backtrace (>=0.3.6 <=0.3.9) +11 more potentially affected by CVE-2021-25901 via lazy-init (>=0.1.1 <=0.3.0)

lazy-init CARGO version =0.1.1, =0.3.6, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.4.0, =0.4.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.3.0 Source cves: CVE-2021-25901 Source advisory: OSV:RUSTSEC-2021-0004...

Quest Policy Authority For Unified Communications Cross-Site Scripting Vulnerability

Quest Policy Authority For Unified Communications is a software from Quest, Inc. that is used in corporate environments to consolidate communication data between various media text and instant messaging, video conferencing, email and voicemail. A cross-site scripting vulnerability exists in Quest...

cloud-init -- Wrong access permissions of authorized keys

cloud-init reports: cloud-init release 20.4.1 is now available. This is a hotfix release, that contains a single patch to address a security issue in cloud-init 20.4. Briefly, for users who provide more than one unique SSH key to cloud-init and have a shared AuthorizedKeysFile configured in...

OSV-2018-226 Heap-buffer-overflow in pcf_get_encodings

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9561 Crash type: Heap-buffer-overflow READ 1 Crash state: pcfgetencodings pcfloadfont PCFFaceInit...