16996 matches found
Juju security vulnerabilities
Juju is an open source application orchestration engine from Canonical Juju Open Source. A security vulnerability exists in Juju that stems from the fact that an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJUCONTEXTID value to access th...
Juju security vulnerabilities
Juju is an open source application orchestration engine from Canonical Juju Open Source. Juju has a security vulnerability in 该漏洞源于任何有权访问默认网络命名空间的用户都可以连接到@/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and performs operations normally reserved for the juju charm...
PT-2024-38764
Name of the Vulnerable Software and Affected Versions: juju versions prior to 2.9.51 juju versions prior to 3.1.10 juju versions prior to 3.3.7 juju versions prior to 3.4.6 juju versions prior to 3.5.4 Description: The issue concerns an abstract UNIX domain socket used for juju introspection, whi...
PT-2024-38418
Name of the Vulnerable Software and Affected Versions juju versions prior to 2.9.51 juju versions prior to 3.1.10 juju versions prior to 3.3.7 juju versions prior to 3.4.6 juju versions prior to 3.5.4 Description The JUJU CONTEXT ID is a predictable authentication secret. On a Juju machine or Juj...
Juju security vulnerabilities
Juju is an open source application orchestration engine from Canonical Juju Open Source. A security vulnerability exists in Juju that stems from an abstract UNIX domain socket responsible for introspection being used without locally authenticating the network namespace user, which could lead to a...
CVE-2024-8038: Unprotected Alternate Channel
Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks...
CVE-2024-7558: Predictable Seed in Pseudo-Random Number Generator (PRNG)
JUJUCONTEXTID is a predictable authentication secret. On a Juju machine non-Kubernetes or Juju charm container on Kubernetes, an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJUCONTEXTID value. This gives the unprivileged user access to t...
PT-2024-38763
Name of the Vulnerable Software and Affected Versions: juju versions prior to 2.9.51 juju versions prior to 3.1.10 juju versions prior to 3.3.7 juju versions prior to 3.4.6 juju versions prior to 3.5.4 Description: The juju hook tool's abstract UNIX domain socket is vulnerable. When combined with...
QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure
A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service DoS attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline...
PT-2024-33710
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue is related to a race condition between socket setup and I/O thread creation in the Linux kernel's rxrpc module. Specifically, in rxrpc open socket, there is a gap between setting up...
systemd bug fix update
An update is available for systemd. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The systemd packages contain systemd, a system and service manager for Linux,...
SUSE CVE-2024-46855
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsocket: fix sk refcount leaks We must put 'sk' reference before returning...
AZL-49840 CVE-2024-46855 affecting package kernel for versions less than 6.6.56.1-5
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsocket: fix sk refcount leaks We must put 'sk' reference before returning...
DEBIAN-CVE-2024-46855
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsocket: fix sk refcount leaks We must put 'sk' reference before returning...
OESA-2024-2190 python3 security update
Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...
OESA-2024-2192 python3 security update
Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...
Linux Kernel Security Vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a leak in the handling of sk reference counts...
PT-2024-33788
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability has been resolved in the Linux kernel where the ppp channel bridge input function did not consider the case when the socket lock is acquired and packets are stored in the sock...
PT-2024-32250
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, specifically the netfilter: nft socket issue, which involved sk refcount leaks. The fix involves putting the 'sk' reference before...
QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure
A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service DoS attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline...