EUVD-2021-1289

Malware in sbrugna...

EUVD-2022-6862

Malicious code in bioql PyPI...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to libxml2, Go JOSE and FreeType

Summary libxml2, Go JOSE, FreeType and IBM MQ used by IBM MQ Operator and Queue Manager container images are vulnerable to memory exhaustion and a Denial of Service by sending numerous malformed tokens, and arbitrary code execution by writing up to 6 signed long integers out of bounds. This...

Amazon Linux 2 : containerd (ALASECS-2025-053)

The version of containerd installed on the remote host is prior to 1.7.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-053 advisory. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support...

jose security update

An update is available for jose. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Jose is a C-language implementation of the Javascript Object Signing and...

jose security update

14-1 - Rebase jose-14 upstream version Resolves: RHEL-38079...

MGASA-2024-0343 Updated buildah, podman, skopeo packages fix security vulnerabilities

A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation ...

jose security update

10-2.3 - Backport fix for CVE-2024-28176 Resolves: RHEL-28719 10-2.2 - Fix tests on s390x Related: RHEL-29857 10-2.1 - Fixes CVE-2023-50967...

OPENSUSE-SU-2024:0118-1 Security update for python-python-jose

This update for python-python-jose fixes the following issues: CVE-2024-33663: Fixed algorithm confusion with OpenSSH ECDSA keys and other key formats boo1223417...

CVE-2016-9121

go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making ...

Buy an Infected PC for 5 Cents

From PC World Erik Larkin It doesn’t take much to get started in Internet crime these days. Find the right site, hand over $50, and you can start wreaking havoc with 1,000 already-infected PCs. Finjan, a San Jose, CA security company, looked into the “Golden Cash” site, used by black hats to buy...