OPENSUSE-SU-2021:0899-1 Security update for salt

This update for salt fixes the following issues: Update to Salt release version 3002.2 jscECO-3212, jscSLE-18033, jscSLE-18028 - Check if dpkgnotify is executable bsc1186674 - Drop support for Python2. Obsoletes python2-salt package jscSLE-18028 - virt module updates network: handle missing ipv4...

SUSE-SU-2021:2106-1 Security update for salt

This update for salt fixes the following issues: Update to Salt release version 3002.2 jscECO-3212, jscSLE-18033, jscSLE-18028 - Check if dpkgnotify is executable bsc1186674 - Drop support for Python2. Obsoletes python2-salt package jscSLE-18028 - virt module updates network: handle missing ipv4...

SUSE-SU-2021:1690-1 Security Beta update for Salt

This update fixes the following issues: salt: - Update to Salt release version 3002.2 jscECO-3212 - Drop support for Python2. Obsoletes 'python2-salt' package - Virt module updates network: handle missing ipv4 netmask attribute more network support PCI/USB host devices passthrough support - Set...

Deserialization of Untrusted Data

Amendment This was deemed not a vulnerability. Overview msgpack is an A space-efficient object serialization library for node.js Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the unpack function. N.B: this affects the NPM package msgpack only, NOT the...

CVE-2021-21368

msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "proto", it assigns the decoded value to proto. Object.prototype.proto is an access...

fluent-bit:flb-it-fuzz-flb_json_fuzzer_OSSFUZZ: Crash in msgpack_sbuffer_write

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=5667190028238848 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-flbjsonfuzzerOSSFUZZ Job Type: libfuzzerubsanfluent-bit Platform Id: linux Crash Type: UNKNOWN READ Crash...

PT-2020-22170

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read, as indicated by the crash type. The crash state involves several functions: flb sds cat utf8, flb...

fluent-bit:flb-it-fuzz-flb_json_fuzzer_OSSFUZZ: Heap-use-after-free in flb_pack_msgpack_to_json_format

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=5136174263566336 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-flbjsonfuzzerOSSFUZZ Job Type: libfuzzerasanfluent-bit Platform Id: linux Crash Type: Heap-use-after-free RE...

PT-2020-22113

Name of the Vulnerable Software and Affected Versions flb versions affected versions not specified Description The issue is related to a heap-buffer-overflow read. Technical details about the crash include the flb msgpack gelf value ext, flb msgpack to gelf, and flb msgpack raw to gelf functions...

fluent-bit:flb-it-fuzz-msgpack_to_gelf_fuzzer_OSSFUZZ: Heap-buffer-overflow in flb_msgpack_gelf_value_ext

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=5076752961110016 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-msgpacktogelffuzzerOSSFUZZ Job Type: libfuzzerasanfluent-bit Platform Id: linux Crash Type:...

PT-2020-22064

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow WRITE 1 crash has been reported. The crash involves the flb msgpack to json and flb msgpack raw to json sds functions, and it occurs...

PT-2020-22063

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow read crash. Technical details about the crash include the functions flb sds cat, flb msgpack gelf value, an...

fluent-bit:flb-it-fuzz-msgpack_to_gelf_fuzzer_OSSFUZZ: Stack-buffer-overflow in flb_sds_cat

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=5162073690210304 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-msgpacktogelffuzzerOSSFUZZ Job Type: libfuzzerasanfluent-bit Platform Id: linux Crash Type:...

PT-2020-21994

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions: flb sds cat, flb msgpack gelf key, and flb msgpack gelf...

PT-2020-21983

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 4 crash has been reported. The crash involves the flb msgpack to gelf and flb msgpack raw to gelf functions. The issue was...

Denial Of Service (DoS)

github.com/vmihailenco/msgpack is vulnerable to denial of serviceDoS attacks. The library does not limit the decoding message size, allowing an attacker to submit large size of messages which cause an application to crash...

[SECURITY] Fedora 30 Update: msgpack-d-1.0.0-0.6.beta.7.fc30

MessagePack is a binary-based JSON-like serialization library...

Denial Of Service (DoS)

msgpack is vulnerable to denial of service. The default decode limits is too large, which will allow an attacker to deplete available resource and cause the process to crash...

RUSTSEC-2017-0006 Unchecked vector pre-allocation

Affected versions of this crate pre-allocate memory on deserializing raw buffers without checking whether there is sufficient data available. This allows an attacker to do denial-of-service attacks by sending small msgpack messages that allocate gigabytes of memory...

Tarantool Key-type Denial Of Service Vulnerability(CVE-2016-9037)

Summary An exploitable out-of-bounds array access vulnerability exists in the xrowheaderdecode function of Tarantool 1.7.2.0-g8e92715. A specially crafted packet can cause the function to access an element outside the bounds of a global array that is used to determine the type of the specified...