SUSE-SU-2022:0845-2 Security update for chrony

This update for chrony fixes the following issues: Chrony was updated to 4.1, bringing features and bugfixes. Update to 4.1 Add support for NTS servers specified by IP address matching Subject Alternative Name in server certificate Add source-specific configuration of trusted certificates Allow...

Undercollateralized loans possible

Lines of code Vulnerability details Impact The setPoolCollateralFactors function does not check that the collateral factor is 100%. It's possible that it's set to 200% and then borrows more than the collateral is worth, stealing from the pool. Recommended Mitigation Steps Disable the possibility ...

CORTX-S3 Server 安全漏洞

CORTX-S3 Server is is an object storage service with high data availability, persistence, scalability, performance and security. A security vulnerability exists in CORTX-S3 Server that stems from a denial of service vulnerability in CORTX-S3 Server due to a failure to release a lock pool - lock...

The vulnerability of the `pool_installable` function in the `src/repo.h` file of the Libsolv library allows a hacker to trigger a service failure.

The vulnerability of the poolinstallable function in the src/repo.h file of the Libsolv library is related to writing beyond buffer boundaries. Exploiting this vulnerability allows a remote attacker to cause service failure...

The vulnerability of the `pool_installable_whatprovides` function in the `src/repo.h` file of the Libsolv library allows a attacker to cause a service failure.

The vulnerability of the poolinstallablewhatprovides function in the src/repo.h file of the Libsolv library is related to buffer overflow attacks. Exploiting this vulnerability allows an attacker who operates remotely to cause service failures...

[WP-M9] sendNative with CBridge will always revert

Lines of code Vulnerability details function startBridgeCBridgeData memory cBridgeData internal Storage storage s = getStorage; address bridge = bridge; // Do CBridge stuff requires.cBridgeChainId != cBridgeData.dstChainId, "Cannot bridge to the same network."; if...

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

...

CVE-2021-32505

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...

CVE-2021-32501

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...

CVE-2021-32501

CVE-2021-32501 entry rejected/not used per the initial description.

GHSA-PVX3-GM3C-GMPR Denial of Service in Go-Ethereum

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service DoS...

Denial of Service in Go-Ethereum

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and th...

CVE-2022-23327

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service DoS...

CVE-2022-23328

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and th...

CVE-2022-23328

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and th...

Design/Logic Flaw

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service DoS...

CVE-2022-23328

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and th...

Denial Of Service (DoS)

libvirt.so is vulnerable to denial of service. Lack of proper handling of a locked virStoragePoolObj object to release on ACL permission failure in the function virStoragePoolLookupByTargetPath allows other users to access storage pool APIs, causing an application crash...

Ethereum Go-ethereum 资源管理错误漏洞

Ethereum Go-ethereum is a codebase from the Ethereum community that implements the ethereum protocol in the Go language. A resource management error vulnerability exists in Ethereum Go-Ethereum that stems from when sending 5,120 unfinished HFO transactions from an account that uses up the entire...

Go-Ethereum 代码问题漏洞

Ethereum Go-ethereum is a codebase from the Ethereum community that implements the ethereum protocol in the Go language. A code issue vulnerability exists in Go-Ethereum that stems from a product that allows an attacking node to send 5,120 future high-oil transactions in a single message, which c...