Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only

Vulnerability type Logging Detail etcd users who have no password can authenticate only through a client certificate. When such users try to authenticate into etcd using the Authenticate endpoint, errors are logged with insufficient information regarding why the authentication failed, and may be...

SUSE CVE-2024-1141

A vulnerability was found in python-glance-store. The issue occurs when the package logs the accesskey for the glance-store when the DEBUG log level is enabled...

glance-store logs s3 access keys

A vulnerability was found in python-glance-store. The issue occurs when the package logs the accesskey for the glance-store when the DEBUG log level is enabled...

DEBIAN-CVE-2024-1141

A vulnerability was found in python-glance-store. The issue occurs when the package logs the accesskey for the glance-store when the DEBUG log level is enabled...

UBUNTU-CVE-2024-1141

A vulnerability was found in python-glance-store. The issue occurs when the package logs the accesskey for the glance-store when the DEBUG log level is enabled...

CVE-2024-1141

A vulnerability was found in python-glance-store. The issue occurs when the package logs the accesskey for the glance-store when the DEBUG log level is enabled...

CVE-2024-1141

CVE-2024-1141 concerns the python-glance-store library, where logging the access_key occurs when DEBUG is enabled. Multiple sources (Red Hat RHSA-2024:2732, USN-6630-1, OSSV references, and related Nessus plugins) confirm the issue and link it to Glance_store’s handling of sensitive data in logs,...

CVE-2024-1141

A vulnerability was found in python-glance-store. The issue occurs when the package logs the accesskey for the glance-store when the DEBUG log level is enabled...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the logging operations when multiple functions write simultaneously. Remediation Upgrade Microsoft.Azure.WebJobs.Logging to version 3.0.0 or higher. References - GitHub Commit - GitHub PR...

CVE-2024-1141

A vulnerability was found in python-glance-store. The issue occurs when the package logs the accesskey for the glance-store when the DEBUG log level is enabled. Mitigation Avoid leaving the DEBUG log level enabled in critical environments...

python-glance-store security vulnerability

python-glance-store is an open source library from pypi. A security vulnerability exists in python-glance-store that originates from storing access keys with DEBUG logging...

CVE-2024-1141: Logging of Excessive Data

A vulnerability was found in python-glance-store. The issue occurs when the package logs the accesskey for the glance-store when the DEBUG log level is enabled...

PT-2024-16967

Name of the Vulnerable Software and Affected Versions python-glance-store affected versions not specified Description A vulnerability was found in python-glance-store. The issue occurs when the package logs the access key for the glance-store when the DEBUG log level is enabled. Recommendations A...

CLSA-2024-1706697909 java-1.8.0-openjdk: Fix of 8 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u402-b06. That fixes following CVEs: - CVE-2024-20918: Array out-of-bounds access due to missing range check in C1 compiler - CVE-2024-20919: JVM class file verifier flaw allows unverified bytecode execution - CVE-2024-20921: Range check loop...

PT-2024-16708

Name of the Vulnerable Software and Affected Versions jberet-core affected versions not specified Description A vulnerability was found in jberet-core logging. An exception in dbProperties might display user credentials such as the username and password for the database-connection. Recommendation...

UBUNTU-CVE-2023-6779

An off-by-one heap-based buffer overflow was found in the vsysloginternal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INTMAX bytes, leading to an incorrect calculation of t...

CVE-2023-46230

In Splunk Add-on Builder versions below 4.1.4, the app writes sensitive information to internal log files...

CVE-2024-23829 aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against...

AZL-34157 CVE-2023-40546 affecting package shim for versions less than 15.8-1

A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a cras...

AZL-35271 CVE-2023-40546 affecting package shim-unsigned-x64 for versions less than 15.8-3

A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a cras...