RHEL 9 : dnsmasq (RHSA-2024:1522)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1522 advisory. The dnsmasq packages contain Dnsmasq, a lightweight DNS Domain Name Server forwarder and DHCP Dynamic Host Configuration Protocol server...

K000138989: BIND vulnerability CVE-2023-5517

Security Advisory Description A flaw in query-handling code can cause named to exit prematurely with an assertion failure when: - nxdomain-redirect ; is configured, and - the resolver receives a PTR query for an RFC 1918 address that would normally result in an authoritative NXDOMAIN response. Th...

OESA-2024-1323 bind security update

Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server. Security Fixes: The DNS...

Moby's external DNS requests from 'internal' networks could lead to data exfiltration

Moby is an open source container framework originally developed by Docker Inc. as Docker. It is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. As a batteries-included container runtime, Moby comes with a built-in networking implementati...

Token Exchange support in Spring Security 6.3.0-M3

I'm excited to share that the there will be support for the OAuth 2.0 Token Exchange Grant RFC 8693 in Spring Security 6.3, which is available for preview now in the latest milestone 6.3.0-M3. This support provides the ability to use Token Exchange with OAuth2 Client. Similarly, server-side suppo...

AlmaLinux 8 : dnsmasq (ALSA-2024:1335)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1335 advisory. - Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denial of service CPU...

AlmaLinux 9 : dnsmasq (ALSA-2024:1334)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1334 advisory. - Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denial of service CPU...

Oracle Linux 9 : dnsmasq (ELSA-2024-1334)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1334 advisory. 2.85-14.1 - Fix CVE 2023-50387 and CVE 2023-50868 - Resolves: RHEL-25674 - Resolves: RHEL-25638 Tenable has extracted the preceding description block...

GHSA-XHG9-XWCH-VR7X quiche vulnerable to unbounded storage of information related to connection ID retirement

Impact Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers IDs; see RFC 9000 Section 5.1. Endpoints declare the...

quiche vulnerable to unbounded storage of information related to connection ID retirement

Impact Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers IDs; see RFC 9000 Section 5.1. Endpoints declare the...

CVE-2024-1410

Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers IDs; see RFC 9000 Section 5.1...

Design/Logic Flaw

Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers IDs; see RFC 9000 Section 5.1...

CVE-2024-1410

CVE-2024-1410 affects Cloudflare quiche, an open-source QUIC implementation. The issue is unbounded storage of information related to connection ID retirement, where an unauthenticated attacker can cause RETIRE_CONNECTION_ID frames to arrive faster than they can be retired, potentially overflowin...

CVE-2024-1410 Unbounded storage of information related to connection ID retirement, in quiche

Cloudflare quiche was discovered to be vulnerable to unbounded storage of information related to connection ID retirement, which could lead to excessive resource consumption. Each QUIC connection possesses a set of connection Identifiers IDs; see RFC 9000 Section 5.1...

[SECURITY] Fedora 38 Update: cpp-jwt-1.4-7.fc38

JSON Web TokenJWT is a JSON based standard RFC- 7519 for creating assertions or access tokens that consists of some claims encoded within the assertion. This assertion can be used in some kind of bearer authentication mechanism that the server will provide to clients, and the clients can make use...

BIT-HAPROXY-2023-40225

HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpre...

Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2024-558)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-558 advisory. This update enables libpsl support in curl, which adds protection against domain spanning super cookies as described in section 5.3 of RFC 6265. Tenable has extracted the preceding description block...

Amazon Linux 2023 : dnsmasq, dnsmasq-utils (ALAS2023-2024-552)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-552 advisory. Certain DNSSEC aspects of the DNS protocol in RFC 4035 and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses when there is a zone...

Amazon Linux 2 : curl (ALAS-2024-2490)

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2490 advisory. This update enables libpsl support in curl, which adds protection against domain spanning super cookies as described in section 5.3 of...

Low: curl

Issue Overview: This update enables libpsl support in curl, which adds protection against domain spanning "super cookies" as described in section 5.3 of RFC 6265. Affected Packages: curl Issue Correction: Run dnf update curl --releasever 2023.3.20240304 to update your system. New Packages: aarch6...