Debian DLA-2338-2 : proftpd-dfsg regression update

The update of proftpd-dfsg released as DLA-2338-1 incorrectly destroyed the memory pool in function sftpkexhandle in contrib/modsftp/kex.c which may cause a segmentation fault and thus prevent sftp connections. For Debian 9 stretch, this problem has been fixed in version 1.3.5e+r1.3.5b-4+deb9u2. ...

CVE-2020-5416

Cloud Foundry Routing Gorouter, versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthenticated malicious attacker can send specially-crafted HTTP requests that may cause...

CVE-2020-10758

A flaw was found in Keycloak. This flaw allows an attacker to perform a denial of service attack by sending multiple simultaneous requests with a Content-Length header value greater than the actual byte count of the request body. The highest threat from this vulnerability is to system availabilit...

MGASA-2020-0327 Updated apache packages fix security vulnerability

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability f...

netty: compression/decompression codecs don't enforce limits on buffer allocation sizes

A flaw was found in Netty in the way it handles the amount of data it compresses and decompresses. The Compression/Decompression codecs should enforce memory allocation size limits to avoid an Out of Memory Error OOME or exhaustion of the memory pool...

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns logging statements were made on the wrong connection causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2016. Notes: none...

CVE-2018-7130

CVE-2018-7130 entry is rejected/not used and does not represent an active vulnerability.

CVE-2018-7139

This CVE entry is rejected/not used and does not represent an active vulnerability.

CVE-2018-7152

CVE-2018-7152 entry is rejected/not used as stated in the Initial Description.

CVE-2018-7135

CVE-2018-7135 is rejected/not used and does not represent an active vulnerability entry.

CVE-2018-7144

CVE-2018-7144 is rejected/not used and does not represent an active vulnerability entry.

CVE-2017-9009

CVE-2017-9009 entry is rejected/not used and does not represent an active vulnerability.

CVE-2017-9013

CVE-2017-9013 is rejected/not used per the Initial Description.

CVE-2017-9015

CVE-2017-9015 is rejected/not used and does not represent an active vulnerability entry.

CVE-2018-7127

This CVE entry is rejected/not used and does not represent an active vulnerability entry.

CVE-2017-9004

CVE-2017-9004 is rejected/not used; this ID is not assigned to an active vulnerability entry.

CVE-2017-9018

This CVE entry is rejected/not used and does not represent an active vulnerability entry.

CVE-2018-7126

This CVE-2018-7126 entry is rejected/not used and does not represent an active vulnerability.

netty: compression/decompression codecs don't enforce limits on buffer allocation sizes

A flaw was found in Netty in the way it handles the amount of data it compresses and decompresses. The Compression/Decompression codecs should enforce memory allocation size limits to avoid an Out of Memory Error OOME or exhaustion of the memory pool...