CVE-2024-2758

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...

CVE-2024-2758

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...

CVE-2024-2758

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...

CVE-2024-2758 CVE-2024-2758

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...

CVE-2024-2758 CVE-2024-2758

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...

CVE-2024-2758

The Tempesta FW web application firewall is vulnerable to a denial-of-service (DoS) attack due to the HTTP/2 CONTINUATION Flood vulnerability. The root cause is the incorrect handling of CONTINUATION frames in the HTTP/2 protocol, where an attacker can send a continuous stream of frames without t...

CVE-2024-26743: Allocation of Resources Without Limits or Throttling

In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix qedrcreateuserqp error flow Avoid the following warning by making sure to free the allocated resources in case that qedrinituserqueue fail. ----------- cut here ----------- WARNING: CPU: 0 PID: 143192 at...

AI application scaling framework Python Ray Path Traversal

The vulnerability of the AI application scaling framework and Python Ray is related to an incorrect path name limitation for the restricted access directory. Exploiting this vulnerability allows a malicious actor to read arbitrary files using the “filename” parameter...

CVE-2024-26710: Allocation of Resources Without Limits or Throttling

In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Limit KASAN thread size increase to 32KB KASAN is seen to increase stack usage, to the point that it was reported to lead to stack overflow on some 32-bit machines see link. To avoid overflows the stack size was...

PT-2024-2623 · Tempesta · Tempesta

Name of the Vulnerable Software and Affected Versions: Tempesta affected versions not specified Description: The issue is related to a firewall vulnerability in the implementation of the HTTP/2 protocol, specifically concerning the handling of CONTINUATION frames. This can lead to an uncontrolled...

CVE-2024-2758: Undefined Security Weakness

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately...

CVE-2024-26707: Allocation of Resources Without Limits or Throttling

In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARNONCE in sendhsrsupervisionframe Syzkaller reported 1 hitting a warning after failing to allocate resources for skb in hsrinitskb. Since a WARNONCE call will not help much in this case, it might be prudent to...

CVE-2024-26741: Allocation of Resources Without Limits or Throttling

In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after checkestalblished. syzkaller reported a warning 0 in inetcskdestroysock with no repro. WARNONinetsksk-inetnum && !inetcsksk-icskbindhash; However, the syzkaller's log...

SuperSize Me

SuperSize Me By Floser Bacurio Jr., Bernadette Canubas, Michaelo Oliveros · April 02, 2024 Introduction Cyber attackers are always finding new ways to outsmart security systems and distribute malware effectively. We discovered an interesting detection evasion technique of delivering archive files...

CVE-2024-26675: Allocation of Resources Without Limits or Throttling

In the Linux kernel, the following vulnerability has been resolved: pppasync: limit MRU to 64K syzbot triggered a warning 1 in allocpages: WARNONONCEGFPorder MAXPAGEORDER, gfp Willem fixed a similar issue in commit c0a2a1b0d631 "ppp: limit MRU to 64K" Adopt the same sanity check for...

BIT-DISCOURSE-2024-27100 Denial of service via Staff Actions in Discourse

Discourse is an open source platform for community discussion. In affected versions the endpoints for suspending users, silencing users and exporting CSV files weren't enforcing limits on the sizes of the parameters that they accept. This could lead to excessive resource consumption which could...

CVE-2024-22436: Allocation of Resources Without Limits or Throttling

A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a denial of service...

CVE-2023-52622: Allocation of Resources Without Limits or Throttling

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg When we online resize an ext4 filesystem with a oversized flexbgsize, mkfs.ext4 -F -G 67108864 $dev -b 4096 100M mount $dev $dir resize2fs $dev 16G the following WARNO...

OESA-2024-1306 golang security update

The Go Programming Language. Security Fixes: When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com...

Tomcat: HTTP/2 header handling DoS

A vulnerability was found in the Tomcat package due to its handling of HTTP/2 requests. Specifically, when an HTTP/2 request surpasses the predetermined limits for headers configured within the server, the associated HTTP/2 stream isn't reset immediately. Instead, the reset action occurs only aft...