[SECURITY] [DLA 3762-1] unadf security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3762-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk March 15, 2024 https://wiki.debian.org/LTS -...

Spring Tips: Spring Batch Remote Partitioning, your easy button for data scale!

Hi, Spring fans! In this installment, Spring Developer Advocate Josh Long looks at how to use Spring Batch's remote partitioning support to easy-button your data processing scale out strategies. postgresql ai datascience data springboot java java21...

The vulnerability of the Mattermost instant messaging application, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of the Mattermost instant messaging application is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by installing a custom status with an emoji that represents a very long string of text...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2024-1287)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

BIT-MEDIAWIKI-2022-28203

A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query...

BIT-GOLANG-2022-28327

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...

BIT-ENVOY-2020-12605

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs...

BIT-DJANGO-2024-24680

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings...

SUSE CVE-2021-47098

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Prevent integer overflow/underflow in hysteresis calculations Commit b50aa49638c7 "hwmon: lm90 Prevent integer underflows of temperature calculations" addressed a number of underflow situations when writing temperatur...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality due to [CVE-2023-39326]

Summary The operator and some binary components within IBM App Connect Enterprise Certified Container are implemented in Golang. IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the...

Security Bulletin: IBM App Connect Enterprise Certified Container flows using Box are vulnerable to loss of confidentiality due to [CVE-2024-24758]

Summary Node.js module undici is used by IBM App Connect Enterprise Certified Container for communicating with Box in the Box connector. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that run flows using the Box connector are vulnerable to loss o...

SUSE CVE-2024-26622

In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyowritecontrol Since tomoyowritecontrol updates head-writebuf when write of long lines is requested, we need to fetch head-writebuf after head-iosem is held. Otherwise, concurrent write requests c...

UBUNTU-CVE-2021-47098

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Prevent integer overflow/underflow in hysteresis calculations Commit b50aa49638c7 "hwmon: lm90 Prevent integer underflows of temperature calculations" addressed a number of underflow situations when writing temperatur...

USN-6674-1 python-django vulnerability

Seokchan Yoon discovered that the Django Truncator function incorrectly handled very long HTML input. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service...

UBUNTU-CVE-2024-26622

In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyowritecontrol Since tomoyowritecontrol updates head-writebuf when write of long lines is requested, we need to fetch head-writebuf after head-iosem is held. Otherwise, concurrent write requests c...

longislandhomebrew.com Improper Access Control vulnerability OBB-3863752

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2024-14603 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A data race issue was found in the Linux kernel, specifically in the bpf long memcpy function. This issue was reported by syzbot. Recommendations: At the moment, there is no informatio...

Django: denial-of-service in ``intcomma`` template filter

A vulnerability was found in Django. When used with very long strings, the intcomma template filter was subject to a potential denial of service attack...

python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument

A flaw was found in Pillow. A denial of service issue uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for TrueType in ImageFont when text length in an ImageDraw instance operates on a long text argument...

PT-2024-2031 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions prior to v8.1.9 Description: The issue is related to uncontrolled resource consumption. An attacker can exploit this by setting a custom user status with an emoji value as a very long string, causing high resource...