This Week in Spring - November 7th, 2023

Hi, Spring fans! Can you believe we've already turned the calendar page to November? Time sure is a swift developer, deploying months as if they were minor versions in an ever-evolving application. As we adjust our clocks to fall back, waving a reluctant goodbye to daylight savings time, the...

SSL hot reload in Spring Boot 3.2.0

In Spring Boot 3.2.0, we're adding the ability for embedded web servers to hot-reload SSL certificates and keys. That means you can rotate your SSL trust material without restarting your application. Hot reloading is supported for Tomcat and Netty embedded web servers. Let's see that in action!...

CVE-2023-20086

A vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to improper processing of ICMPv6 messages. A...

PT-2023-7129 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center FMC Software affected versions not specified Description: The issue is related to a lack of rate-limiting of requests sent to a specific API related to an FMC log, which could allow an unauthenticated, remote...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: skaffold, flux-source-controller, stakater-reloader, flux-helm-controller, gobuster, sigstore-scaffolding, kubernetes-dashboard-metrics-scraper, prometheus-mysqld-exporter, k8sgpt, up, flux-kustomize-controller, nats, configmap-reload-fips, nodetaint,...

CVE-2023-39323 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, configmap-reload-fips, kind, metrics-server, smarter-device-manager-fips...

Minor update (5) for Vivaldi Desktop Browser 6.2

Download Vivaldi The following improvements were made since the fourth 6.2 minor update: Address bar Can be blank/empty VB-99745 Chromium Upgraded to 116.0.5845.230: CVE-2023-5217 CrashSpatial Navigation Crash while reloading a page VB-100012 CrashWorkspaces Closing window with an open workspace...

CVE-2023-20187

A vulnerability in the Multicast Leaf Recycle Elimination mLRE feature of Cisco IOS XE Software for Cisco ASR 1000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause the affected device to reload, resulting in a denial of service DoS condition. This...

Design/Logic Flaw

A vulnerability in the Layer 2 Tunneling Protocol L2TP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain L2TP packets. An attacker could explo...

CVE-2023-20226

A vulnerability in Application Quality of Experience AppQoE and Unified Threat Defense UTD on Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This vulnerability is due to the...

Cisco IOS XE Software Application Quality of Experience and Unified Threat Defense Denial of Service Vulnerability

A vulnerability in Application Quality of Experience AppQoE and Unified Threat Defense UTD on Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This vulnerability is due to the...

PT-2023-5575 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software for Wireless LAN Controllers affected versions not specified Description: A vulnerability in the Wireless Network Control daemon wncd could allow an unauthenticated, adjacent attacker to cause a denial of service DoS...

Cisco IOS XE Software Security Vulnerability

Cisco IOS XE Software is an operating system from Cisco, Inc. A single operating system for enterprise wired and wireless access, aggregation, core and WAN, Cisco IOS XE reduces business and network complexity. A security vulnerability exists in Cisco IOS XE Software that originates from an...

Cisco IOS XE Software Security Vulnerability

Cisco IOS XE Software is an operating system from Cisco, Inc. A single operating system for enterprise wired and wireless access, aggregation, core and WAN, Cisco IOS XE reduces business and network complexity. A security vulnerability exists in Cisco IOS XE Software that originates when an...

PT-2023-5641 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in Application Quality of Experience AppQoE and Unified Threat Defense UTD on Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an...

Cisco IOS XE Software Security Vulnerability

Cisco IOS XE Software is an operating system from Cisco, Inc. A single operating system for enterprise wired and wireless access, aggregation, core and WAN, Cisco IOS XE reduces business and network complexity. A security vulnerability exists in Cisco IOS XE Software that originates when an...

CVE-2023-3646

On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload...

CVE-2023-3646

On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload...

Design/Logic Flaw

On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload...

CVE-2023-3646

The CVE-2023-3646 issue affects Arista EOS when mirroring to multiple destinations is configured, causing an internal system error that can trigger a kernel panic and system reload. The issue is tracked through BUG829136, requiring BUG765111 not to be impacted to be exploitable. Mitigation in off...