rabbitmq: RabbitMQ: Information disclosure of decrypted Shovel URIs in debug logs

A flaw was found in RabbitMQ, a messaging and streaming broker. When the Shovel plugin is enabled with URI-embedded credentials and debug logging is active, the completion of an autodelete shovel can cause decrypted AMQP Advanced Message Queuing Protocol URIs, including usernames and passwords, t...

rabbitmq-server: RabbitMQ: Denial of Service via atom table exhaustion in stream chunk_selector

A flaw was found in RabbitMQ. An authenticated stream client with read access to any stream can exploit a vulnerability in the getchunkselector/1 function. This function processes a client-supplied chunkselector property without proper validation, leading to an atom table exhaustion. Successful...

rabbitmq: RabbitMQ: Denial of Service via management API regular expression filter

A flaw was found in RabbitMQ. A remote attacker with management privileges could exploit a regular expression regex filter in the management API by providing a specially crafted regex to the ?name= filter. This vulnerability, known as Regular Expression Denial of Service ReDoS, causes excessive C...

rabbitmq: RabbitMQ: Information disclosure via cross-vhost authorization bypass

A flaw was found in RabbitMQ. An authorization bypass vulnerability allows a management-tagged user to read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible virtual hosts vhosts. This exposes sensitive cross-tenant queue names and cluster topology...

rabbitmq: rabbitmq_web_mqtt: RabbitMQ Web-MQTT plugin: Denial of Service via decompression bomb

A flaw was found in the rabbitmqwebmqtt plugin of RabbitMQ. An unauthenticated remote attacker can exploit a decompression bomb vulnerability by sending a highly-compressed WebSocket frame. This frame, when decompressed, inflates to gigabytes of memory, leading to a Denial of Service DoS by...

rabbitmq-server: RabbitMQ: Privilege escalation allows monitoring users to delete shovels

A flaw was found in RabbitMQ. An authenticated monitoring user, who is intended to have read-only access, can exploit an improper authorization vulnerability. This allows them to delete or restart 'shovels' in any virtual host they can access, leading to a denial of service or disruption of messa...

RabbitMQ: RabbitMQ: Account takeover via stored Cross-Site Scripting in TLS peer-certificate DN

A flaw was found in RabbitMQ. This vulnerability, a stored Cross-Site Scripting XSS, exists in the management UI. An attacker who can obtain a trusted TLS client certificate can embed malicious JavaScript in the certificate's Subject Distinguished Name DN. When the TLS listener is configured for...

rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing

A flaw was found in RabbitMQ. An unauthenticated network attacker can exploit an issue in the AMQP 1.0 listener by sending a specially crafted 19-byte frame. This causes the system to attempt to build a list of approximately 4 billion empty elements, exhausting heap memory and terminating the...

rabbitmq: RabbitMQ: Information disclosure of AMQP 1.0 shovel URI passwords

A flaw was found in RabbitMQ, a messaging and streaming broker. The AMQP 1.0 shovel component incorrectly stores connection Uniform Resource Identifiers URIs with embedded plaintext passwords. This information can be exposed to an authenticated attacker with monitoring privileges via the...

rabbitmq-server: RabbitMQ: Denial of Service due to atom-table exhaustion via reply-to queue name decoding

A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP Advanced Message Queuing Protocol client can trigger an atom-table exhaustion by sending specially crafted reply-to queue names for decoding. This can lead to the entire Erlang Virtual Machine VM crashing,...

rabbitmq-server: RabbitMQ: Unauthorized cross-vhost message access via missing Federation upstream authorization

A flaw was found in RabbitMQ. The Federation feature fails to enforce virtual host vhost authorization checks when validating upstream connections. An authenticated user with policy configuration privileges in one vhost can exploit this flaw by targeting another vhost where they lack permissions...

openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing

A flaw was found in OpenSSL. A signed integer overflow vulnerability exists when sizing the destination buffer for Unicode output. This can lead to a heap buffer overflow, which may result in a crash or potentially allow an attacker to execute arbitrary code. Exploitation requires an application ...

openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys

A flaw was found in OpenSSL. This vulnerability allows a remote attacker to forge PKCS12 Public-Key Cryptography Standards 12 files that use Password-Based Message Authentication Code 1 PBMAC1 with short HMAC Hash-based Message Authentication Code keys. This can lead to a service accepting...

openssl: Double-free When Checking OCSP Stapled Response

A flaw was found in OpenSSL. A malicious server can exploit the TLS Online Certificate Status Protocol OCSP stapling feature by sending a specially crafted response. This can trigger a double-free vulnerability in the client's certificate verification process, potentially leading to a Denial of...

openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate

A flaw was found in the Certificate Management Protocol CMP implementation within OpenSSL. An attacker with existing Registration Authority RA level credentials could exploit an error in the certificate verification process during a Root Certificate Authority CA key update. This vulnerability...

openssl: AES-OCB IV Ignored on EVP_Cipher() Path

A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface EVPCipher will have their provided Initialization Vector IV silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the...

openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption

A flaw was found in OpenSSL. An attacker controlling a Certificate Management Protocol CMP server, or acting as a man-in-the-middle, could craft a malicious CMP response. This response, containing a Certificate Request Message Format CRMF CertRepMessage with a specific malformed EncryptedValue...

openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()

A flaw was found in OpenSSL's CMSdecrypt and PKCS7decrypt functions. This vulnerability, a Bleichenbacher-style oracle, could allow a remote attacker to decrypt or sign messages using the victim's private RSA key. Exploitation requires the attacker to provide specially crafted CMS or S/MIME...

openssl: Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()

A flaw was found in OpenSSL. When an application uses the X509VERIFYPARAMset1email function to validate a specially crafted S/MIME Secure/Multipurpose Internet Mail Extensions email address, an out-of-bounds read can occur. A remote attacker could exploit this vulnerability by sending a malicious...

openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure.

A flaw was found in OpenSSL. An integer truncation vulnerability in the ASN.1 decoder can occur when processing a crafted DER-encoded ASN.1 structure with a primitive element exceeding 2 gigabytes. A remote attacker could exploit this to cause a heap buffer over-read. This may lead to an...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust-bootupd: bootupd-0.3.2-1.hum1 aarch64, x8664 rust-bootupd-0.3.2-1.hum1.src src...

openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption

A flaw was found in OpenSSL. When processing attacker-supplied Cryptographic Message Syntax CMS data using password-based decryption, an attacker can choose a stream-mode Key Encryption Key KEK cipher. This can trigger a heap out-of-bounds read, potentially causing an application crash and leadin...

openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

A flaw was found in OpenSSL's QUIC PATHCHALLENGE handler. A remote attacker can exploit this vulnerability by flooding a QUIC client or server with specially crafted PATHCHALLENGE frames. This leads to unbounded memory allocation within the local QUIC stack, as the system continuously allocates...

openssl: NULL pointer dereference in QUIC server initial packet handling

A flaw was found in the OpenSSL QUIC Quick UDP Internet Connections server. A remote attacker could send a specially crafted QUIC initial packet with an invalid token. If the server's address validation is explicitly disabled, this could lead to a NULL pointer dereference, causing the server...

openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()

A flaw was found in OpenSSL. When processing a specially crafted PKCS7 or S/MIME Secure/Multipurpose Internet Mail Extensions signed message, a heap use-after-free vulnerability in the PKCS7verify function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an emp...

openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages

A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...

openssl: NULL Dereference in Certificate Verification with OCSP Checking

A flaw was found in OpenSSL. When an application is configured with specific non-default settings for certificate verification, including both Online Certificate Status Protocol OCSP response checking and partial chain verification, a NULL dereference can occur. This vulnerability can be triggere...

openssl: Possible NULL Dereference in Password-Based CMS Decryption

A flaw was found in OpenSSL. A remote attacker could exploit a NULL pointer dereference vulnerability in the Cryptographic Message Syntax CMS decryption process by providing a specially crafted password-encrypted CMS message. This occurs because the keyDerivationAlgorithm field, which is optional...

openssl: FFC-DH Peer Validation Uses Attacker-Supplied q

A flaw was found in OpenSSL. A malicious peer can exploit this vulnerability by presenting a specially crafted DHX X9.42 peer key. Due to improper validation of the peer key's subgroup membership, an attacker can recover the victim's private key after a small number of key exchange attempts. This...

openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

A flaw was found in OpenSSL. The implementations of AES-SIV Advanced Encryption Standard - SIV and AES-GCM-SIV Advanced Encryption Standard - Galois/Counter Mode - SIV incorrectly process authentication tags for empty messages. This vulnerability allows a remote attacker to forge empty messages...

dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally...

Important: Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update

An update for .NET 10.0 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

Important: Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

An update for .NET 9.0 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally...

dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.17.2 security update

Red Hat Advanced Cluster Management for Kubernetes v2.17 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.5 security update

Red Hat Advanced Cluster Management for Kubernetes v2.16 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.7 security update

Red Hat Advanced Cluster Management for Kubernetes v2.15 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.12 security update

Red Hat Advanced Cluster Management for Kubernetes v2.13 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.5 security update

Red Hat Advanced Cluster Management for Kubernetes v2.14 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.11.12 security update

Red Hat Advanced Cluster Management for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

Moderate: Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

An update for .NET 8.0 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

Moderate: Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

An update for .NET 8.0 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: pcre2: pcre2-10.48-0.1.hum1 aarch64, x8664 pcre2-devel-10.48-0.1.hum1 aarch64, x8664 pcre2-static-10.48-0.1.hum1 aarch64, x8664 pcre2-syntax-10.48-0.1.hum1 noarch pcre2-tools-10.48-0.1.hum1...

pcre2: PCRE2: Information disclosure via pcre2_serialize_encode

A flaw was found in PCRE2. The pcre2serializeencode function might disclose two bytes of information to an attacker. This vulnerability typically occurs in scenarios where the attacker already has unsafe access to the system, making exploitation difficult. The primary impact is a limited...

PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback

A flaw was found in PCRE2. An attacker can provide invalid UTF Unicode Transformation Format data, leading to an out-of-bounds read during a Just-In-Time JIT fallback. This vulnerability could potentially result in a denial of service...

pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching

A flaw was found in PCRE2, a library for processing regular expressions. A remote attacker could exploit this vulnerability by providing a specially crafted input that triggers an out-of-bounds read during pattern matching with invalid UTF Unicode Transformation Format characters. This could lead...