Medium: cloud-init

Issue Overview: The default cloud-init configuration included "sshdeletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one...

Amazon Linux 2 : cloud-init (ALAS-2021-1576)

The version of cloud-init installed on the remote host is prior to 19.3-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1576 advisory. The default cloud-init configuration included sshdeletekeys: 0, disabling cloud-init's deletion of ssh host keys. In som...

@scullyio/init (>=1.0.0-beta.4 <=1.1.0), @scullyio/scully-plugin-google-analytics (>=1.0.0 <=1.0.0-beta.0) potentially affected by CVE-2020-28470 via @scullyio/scully (>=1.0.0-beta.0 <=1.0.11)

@scullyio/scully NPM version =1.0.0-beta.0, =1.0.0-beta.4, =1.0.0, =1.0.0-beta.0 Source cves: CVE-2020-28470 Source advisory: SNYK:JS-SCULLYIOSCULLY-1055829...

ListingPro < 2.6.1 - Unauthenticated Sensitive Data Disclosure (Usernames, Emails etc)

Unauthenticated users could gain access to sensitive data, such as usernames, full names, email addresses and in some case phone numbers by sending a request to /wp-admin/index.php?download-lp-users=yes which is registered to the init hook...

A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0.

...

CVE-2020-26957

OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox...

NewStart CGSL CORE 5.04 / MAIN 5.04 : poppler Multiple Vulnerabilities (NS-SA-2020-0074)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has poppler packages installed that are affected by multiple vulnerabilities: - An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc...

NewStart CGSL CORE 5.05 / MAIN 5.05 : poppler Multiple Vulnerabilities (NS-SA-2020-0110)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has poppler packages installed that are affected by multiple vulnerabilities: - An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc...

SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2020:3473-1)

This update for ceph fixes the following issues : CVE-2020-25660: Bring back CEPHXV2 authorizer challenges bsc1177843. Added --container-init feature bsc1177319, bsc1163764 Made journald as the logdriver again bsc1177933 Fixes a condition check for copytree, copyfiles, and movefiles in cephadm...

OSV-2020-2217 Heap-buffer-overflow in std::__1::pair<int, void*> uWS::HttpParser::fenceAndConsumePostPadded<0>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28143 Crash type: Heap-buffer-overflow READ Crash state: std::1::pair uWS::HttpParser::fenceAndConsumePostPadded uWS::HttpParser::consumePostPadded uWS::HttpContext::init...

The vulnerability in the loaded module drivers/net/ethernet/broadcom/bnx2.ko of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the loaded module drivers/net/ethernet/broadcom/bnx2.ko in the Linux operating system is related to a memory leak in the implementation of the bnx2initone handler. Exploiting this vulnerability can allow an attacker to cause a service failure by connecting a QLogic bnx2 netwo...

PT-2020-7005 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a reference leak in the Linux kernel's i2c component, specifically in the img-scb driver. The problem occurs when the pm runtime get sync function fails, causin...

CVE-2020-8632 affecting package cloud-init 19.1-6

CVE-2020-8632 affecting package cloud-init 19.1-6. A patched version of the package is available...

CVE-2020-8631 affecting package cloud-init 19.1-6

CVE-2020-8631 affecting package cloud-init 19.1-6. A patched version of the package is available...

openSUSE Security Update : ceph (openSUSE-2020-2082)

This update for ceph fixes the following issues : - CVE-2020-25660: Bring back CEPHXV2 authorizer challenges bsc1177843. - Added --container-init feature bsc1177319, bsc1163764 - Made journald as the logdriver again bsc1177933 - Fixes a condition check for copytree, copyfiles, and movefiles in...

OPENSUSE-SU-2020:2082-1 Security update for ceph

This update for ceph fixes the following issues: - CVE-2020-25660: Bring back CEPHXV2 authorizer challenges bsc1177843. - Added --container-init feature bsc1177319, bsc1163764 - Made journald as the logdriver again bsc1177933 - Fixes a condition check for copytree, copyfiles, and movefiles in...

Security update for ceph (moderate)

openSUSE Security Update: Security update for ceph Announcement ID: openSUSE-SU-2020:2082-1 Rating: moderate References: 1163764 1170200 1170498 1173079 1174466 1174529 1174644 1175120 1175161 1175169 1176451 1176499 1176638 1177078 1177151 1177319 1177344 1177450 1177643 1177676 1177843 1177933...

SUSE-SU-2020:3473-2 Security update for ceph

This update for ceph fixes the following issues: - CVE-2020-25660: Bring back CEPHXV2 authorizer challenges bsc1177843. - Added --container-init feature bsc1177319, bsc1163764 - Made journald as the logdriver again bsc1177933 - Fixes a condition check for copytree, copyfiles, and movefiles in...

Oracle Linux 8 : cloud-init (ELSA-2020-4650)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-4650 advisory. - Resolves: bz1812171 CVE-2020-8632 cloud-init: Too short random password length in ccsetpassword in config/ccsetpasswords.py rhel-8 - Resolves:...

cloud-init security, bug fix, and enhancement update

19.4-11.0.1 - Forward port applicable cloud-init 18.4-2.0.3 changes to cloud-init-18-5 Orabug: 30435672 - Update OCI Datasource to support IMDSv2 - limit permissions Orabug: 31352433 - Changes to ignore all enslaved interfaces Orabug: 30092148 - Fix swap file size allocation logic to allocate...