OpenSSL 3.0.7 update assessment

OpenSSL 3.0.7 update assessment Summary The vulnerability in the OpenSSL Security Advisory of Dec 13 2022 do not affect any active Node.js release lines. Analysis Our assessment of the security advisory is: X.509 Policy Constraints Double Locking CVE-2022-3996 Node.js doesn't call OpenSSL as a...

[SECURITY] [DSA 5301-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5301-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 14, 2022 https://www.debian.org/security/faq -...

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui

Impact Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The URL...

GHSA-9HQH-FMHG-VQ2J Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml

Impact Any user with the right to edit his personal page can follow one of the scenario below: Scenario 1: - Log in as a simple user with just edit rights on the user profile - Go to the user's profile - Upload an attachment in the attachment tab at the bottom of the page any image is fine - Clic...

[SECURITY] [DSA 5285-1] asterisk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5285-1 [email protected] https://www.debian.org/security/ Markus Koschany November 17, 2022 https://www.debian.org/security/faq -...

Moderate: logrotate security update

The logrotate utility simplifies the administration of multiple log files by allowing their automatic rotation, compression, removal, and mailing. Security Fixes: logrotate: potential DoS from unprivileged users via the state file CVE-2022-1348 For more details about the security issues, includin...

GHSA-44MR-8VMM-WJHG Wasmtime out of bounds read/write with zero-memory-pages configuration

Impact There is a bug in Wasmtime's implementation of its pooling instance allocator when the allocator is configured to give WebAssembly instances a maximum of zero pages of memory. In this configuration the virtual memory mapping for WebAssembly memories did not meet the compiler-required...

XWiki OIDC Authenticator vulnerable to bypassing OpenID login by providing a custom provider

Impact Even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider by providing its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the...

OpenSSL November Security Release

OpenSSL November Security Release Summary The Node.js project may be releasing new versions across all of its supported release lines in the first week of November to incorporate upstream patches from OpenSSL. Please read on for full details. OpenSSL The OpenSSL project announced will release...

[SECURITY] [DSA 5262-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5262-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 27, 2022 https://www.debian.org/security/faq -...

OpenSSL and zlib update assessment, and Node.js Assessment workflow

OpenSSL and zlib update assessment, and Node.js Assessment workflow Summary The vulnerability in the OpenSSL Security release of Oct 11 2022 does not affect any active Node.js release lines, as well as the zlib vulnerability CVE-2022-37434 patched on the zlib Security release of Oct 13 2022, does...

Improper use of metav1.Duration allows for Denial of Service

Flux controllers within the affected versions range are vulnerable to a denial of service attack. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interval or .spec.timeout and structured...

Mass email campaign with a pinch of targeted spam

Most mass malicious mailing campaigns are very primitive and hardly diverse, with the content limited to several sentences offering the user to download archives that supposedly contain some urgent bills or unpaid fines. The email messages may contain no signatures or logos, with typos and other...

GHSA-JGC8-GVCX-9VFX XWiki Platform Improper Authorization check for inactive users

Impact Some resources are missing a check for inactive not yet activated or disabled users in XWiki, including the REST service: so a disabled user can enable themselves using a REST call. On the same way some resources handler created by extensions are not protected by default: so an inactive...

XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list

Impact It's possible to store a JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. For example, attachment a file with name .jpg will execute the alert. Patches This issue has been patched in XWiki 13.10.6 and...

GHSA-9R9J-57RF-F6VJ XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

Impact It's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. For example, an attachment with name .jpg will execute the alert. Patches This issue has been patched in XWiki 14.4RC1. Workarounds It is possible to fix t...

[SECURITY] [DSA 5199-1] xorg-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5199-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 06, 2022 https://www.debian.org/security/faq -...

Cilium host policy bypass in endpoint-routes mode with dual-stack

Impact This vulnerability allows bypassing host policies for IPv6 traffic coming from a Cilium-managed pod and destined to the host-network namespace e.g., to a host-network pod. Host policy enforcement on IPv4 or for traffic coming from outside the node is not affected. Cilium is only affected b...

No Rate Limit On Reset Password Page

Description I have identified that when Reset Password for account , the request has no rate limit which then can be used to loop through one request. This can annoy to the root users sending mass password to one email. A rate limiting algorithm is used to check if the user session or IP-address...

OpenSSL update assessment, and Node.js project plans

OpenSSL update assessment, and Node.js project plans By Rafael Gonzaga, Jun 21, 2022 Summary The vulnerabilities in the OpenSSL Security releases of Jun 21 2022 do not affect any active Node.js release lines. Analysis Our assessment of the security advisory is: The crehash script allows command...