RHEL 8 : mariadb:10.3 (RHSA-2023:5259)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5259 advisory. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded ...

GHSA-92JH-GWCH-JQ38 PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)

Impact An attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket. This happened due to the particular handling of NULL types in the json mapper which accepts NULL type values in typed arrays which PocketMine-MP did not expect. Code processing arrays in the JSON data could the...

PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)

Impact An attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket. This happened due to the particular handling of NULL types in the json mapper which accepts NULL type values in typed arrays which PocketMine-MP did not expect. Code processing arrays in the JSON data could the...

GHSA-79RC-JJH6-RC89 PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey

Impact The server uses ECDH to calculate a shared secret for the symmetric encryption key used to encrypt network packets after logging in. ECDH requires that the keys used must both belong to the same elliptic curve. In Minecraft: Bedrock Edition, the curve used is secp384r1. Using any other cur...

Denial Of Service (DoS)

py3-django is vulnerable to Denial of Service DoS attacks. This vulnerability can be exploited by an attacker to cause the Django server to crash by sending a specially crafted URI...

Denial Of Service (DoS)

libreswan is vulnerable to Denial of Service DoS attacks. This vulnerability exists in the ikesainitinfo function in the ike.c file. An attacker can exploit this vulnerability by sending a specially crafted IKE packet to the libreswan server, which could cause the server to crash...

Denial Of Service (DoS)

libreswan is vulnerable to Denial of Service DoS attacks. This vulnerability exists in the pluto/ikev1.c file when processing IKEv1 Quick Mode requests. An attacker can exploit this vulnerability by sending a specially crafted IKEv1 Quick Mode packet to the libreswan server, which could cause the...

SUSE SLED15: libyajl-devel / libyajl-devel-32bit / libyajl-devel-static / etc (SUSE-SU-2023:3301-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3301-1 advisory. - CVE-2023-33460: Fixed memory leak which could cause out-of-memory in server bsc1212928. Tenable has...

Rootstock Labs: DOS of RSKJ server

The RSKJ server was vulnerable to a Denial of Service DoS attack. The vulnerability was due to a flaw in the RLP Recursive Length Prefix decoding function, which could return a negative value, leading to a length of 0. This caused the server to process only one UDP packet forever, preventing it...

Medium: yajl

Issue Overview: There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash. CVE-2023-33460 Affected Packages: yajl Issue Correction: Run dnf update yajl --releasever 2023.1.20230809 or dnf update --advisory ALAS2023-2023-279...

UBUNTU-CVE-2023-4012

ntpd will crash if the server is not NTS-enabled no certificate and it receives an NTS-enabled client request mode 3...

Denial Of Service (DoS)

NPTD is vulnerable to Denial Of Service DoS. The vulnerability is due when the server is not NTS-enabled no certificate, an attacker can submit a NTS-enabled client request, resulting in a server crash...

odoh-rs's Invalid Slice Split Results in Server Panic

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients. Impact An attacker with knowledge of this vulnerability could craft and...

GHSA-GPCV-P28P-FV2P odoh-rs's Invalid Slice Split Results in Server Panic

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients. Impact An attacker with knowledge of this vulnerability could craft and...

CVE-2023-3766

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients and enables an attacker with knowledge of this vulnerability to craft and...

CVE-2023-3766 Invalid Slice Split Results in Server Panic

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients and enables an attacker with knowledge of this vulnerability to craft and...

CVE-2023-3766 Invalid Slice Split Results in Server Panic

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients and enables an attacker with knowledge of this vulnerability to craft and...

CVE-2023-3766 Invalid Slice Split Results in Server Panic

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients and enables an attacker with knowledge of this vulnerability to craft and...

CVE-2023-3766

The CVE-2023-3766 issue affects the odoh-rs Rust crate, caused by faulty logic in parsing encrypted queries. When processing data from remote clients, an attacker can craft specially designed encrypted queries that trigger a server panic/crash, temporarily disrupting ODOH service availability. Pa...

RUSTSEC-2023-0095 Invalid Slice Split Results in Server Panic

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients. Impact An attacker with knowledge of this vulnerability could craft and...