134 matches found
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...
PYSEC-2026-4023 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...
PT-2026-105784
AnyIO 4.14.0 accepts the POSIX extra groups argument on anyio.run process and anyio.open process, but open process forwards the wrong variable to the backend: when extra groups is not None, it assigns kwargs"extra groups" = group instead of extra groups. As a result, callers cannot reliably clear...
Linux Distros Unpatched Vulnerability : CVE-2026-63349
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX...
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...
GHSA-3W57-8XMC-8V26 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
AnyIO 4.14.0 accepts the POSIX extragroups argument on anyio.runprocess and anyio.openprocess, but openprocess forwards the wrong variable to the backend: when extragroups is not None, it assigns kwargs"extragroups" = group instead of extragroups. As a result, callers cannot reliably clear or set...
CVE-2026-63349
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...
DEBIAN-CVE-2026-63349
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...
UBUNTU-CVE-2026-63349
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...
CVE-2026-63349
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...
CVE-2026-63349 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...
CVE-2026-63349
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...
CVE-2026-63349
AnyIO 4.14.0, a high-level asynchronous concurrency framework for Python, contains a correctness bug in its POSIX subprocess helpers. When open_process() receives a non-None extra_groups argument, it incorrectly assigns the group variable instead of extra_groups to the backend's kwargs. As a resu...
PT-2026-95513
Name of the Vulnerable Software and Affected Versions AnyIO versions 4.14.0 through 4.14.1 Description AnyIO is a high-level asynchronous concurrency and networking framework. In POSIX applications, the anyio.open process function incorrectly forwards the group variable to the backend instead of...
UBUNTU-CVE-2026-45767
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some...
USN-8580-1: AccountsService vulnerabilities
It was discovered that the Ubuntu-specific SetLanguage patch to AccountsService incorrectly handled dropping privileges. A local attacker could use this issue to execute arbitrary commands as an administrator. CVE-2026-61897 It was discovered that the Ubuntu-specific SetLanguage helpers for...
CVE-2026-61897
An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...
UBUNTU-CVE-2026-61897
An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...
PT-2026-63318
Name of the Vulnerable Software and Affected Versions AccountsService versions prior to 23.13.9-8ubuntu7 Description An Ubuntu-specific patch in the SetLanguage function only partially drops privileges before launching language helper scripts. While the effective UID/GID is changed to the target...
OESA-2026-3031 cifs-utils security update
The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux. Security Fixes: A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in...