144034 matches found
tomcat: Apache Tomcat: Denial of Service via AJP request
A flaw was found in Apache Tomcat. An unauthenticated remote attacker can send a specially crafted AJP Apache JServ Protocol request, causing an AJP processing thread to become unresponsive. This resource exhaustion can lead to a denial of service DoS, making the server unavailable to legitimate...
tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake
A flaw was found in Apache Tomcat Native. A remote attacker can exploit a buffer over-read vulnerability during the Transport Layer Security TLS handshake. Successful exploitation causes the Java Virtual Machine JVM to crash, resulting in a denial of service DoS...
tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition
A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or...
Important: Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.3 release and security update
Red Hat JBoss Web Server 7.0.3 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...
tomcat: Apache Tomcat: TLS implementations ignore Certificate Revocation Lists
A flaw was found in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM Transport Layer Security TLS implementations fail to properly check Certificate Revocation Lists CRLs when a certificate uses a keystore. This oversight could allow an attacker to use a revoked certificate, potentially leading to...
tomcat: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
A flaw was found in Apache Tomcat. When client certificate authentication is configured with strict certificate revocation checking, Online Certificate Status Protocol OCSP verification may improperly allow connections instead of failing as intended. A remote attacker presenting an invalid or...
tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts
A flaw was found in Apache Tomcat. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exploiting lost timeouts for asynchronous WebSocket writes. This can lead to the affected system becoming unresponsive or unavailable...
tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration
A flaw was found in Apache Tomcat Native, which enabled several insecure OpenSSL options by default: ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF, and ALLOWNODHEKEX. These defaults can weaken TLS protections. Apache Tomcat Native versions 1.3.0 through 1.3.8 and 2.0.0...
tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close
A flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability occurs when sending a WebSocket close message, which can lead to a busy wait condition. A remote attacker could exploit this to cause a Denial of Service DoS by making the server unresponsive...
pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance
A flaw was found in pyjwt. A remote attacker can forge authentication tokens and bypass security controls by signing tokens with an empty key. When verifying tokens against a JSON Web Key JWK set that contains an empty Hash-based Message Authentication Code HMAC key, the library fails to enforce...
pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects
A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...
pyjwt: PyJWT: Authentication bypass via improper public key validation
A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared...
pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets
A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules DER format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code HMAC operations. If an application supports both asymmetric and...
pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling
A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...
Critical: Red Hat Security Advisory: fence-agents security update
An update for fence-agents is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.31 security, enhancement & bug fix update
Red Hat OpenShift Data Foundation 4.18.31 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.18.31 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-10839: Backport to odf-4.18.z Backport CephX keyType and rotation changes DFBUGS-10146: Backport to...
Important: Red Hat Security Advisory: OpenShift Container Platform 5.0 NUMA resources operator extras update
An update for numaresources-operator is available for Red Hat OpenShift Container Platform 5.0. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the extra...
Important: Red Hat Security Advisory: OpenShift Container Platform 5.0 CNF vRAN extras topology aware lifecycle manager update
An update for topology-aware-lifecycle manager is available for Red Hat OpenShift Container Platform 5.0. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the ext...
freerdp: freerdp: Arbitrary code execution via crafted display frames
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit a heap-based out-of-bounds write vulnerability by sending specially crafted display frames to a client during video stream processing. This flaw allows client memory to be corrupted, potentially resulting in...
freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser
A flaw was found in FreeRDP. An unauthenticated remote attacker can cause a Denial of Service DoS by exhausting server memory. When processing Network Level Authentication NLA connections over Transport Layer Security TLS, the server misinterprets invalid protocol bytes as an incomplete packet...
freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch
A flaw was found in FreeRDP. A remote, unauthenticated attacker can exploit this issue by connecting to the shadow server and transmitting input data before authentication is completed. This allows the attacker to inject synthetic keystrokes directly into the host user's active session, potential...
freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly
A flaw was found in FreeRDP. The proxy component fails to enforce cumulative or absolute size limits when reassembling Remote Desktop Protocol Device Redirection RDPDR channel fragments. A remote attacker can exploit this vulnerability by transmitting an initial fragment followed by continuous da...
freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect
A flaw was found in FreeRDP. When a user connects to a malicious Remote Desktop Protocol RDP server, the server can trigger an invalid smartcard connect operation, leading to a use-after-free vulnerability where previously released memory is accessed. A remote attacker can exploit this issue to...
freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit this vulnerability by sending specially crafted MP3 audio data to a connected client. Due to an incorrect buffer size calculation during audio decoding, decoded audio data can be written beyond allocated memor...
freerdp: FreeRDP: Denial of Service via assertion failure in RemoteFX decoder
A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol RDP server to cause a Denial of Service DoS by crashing the connected client. When a user connects to an attacker-controlled server with RemoteFX decoding enabled, the server can transmit a specially crafte...
freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats
A flaw was found in FreeRDP. An integer wraparound in rdpsndserverselectformat DVIADPCM block-alignment arithmetic bypasses validation in the server-side rdpsnd channel. A malicious RDP client can send crafted SNDCFORMATS PDUs, causing an unbounded heap write during server audio playback that may...
freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication
A flaw was found in FreeRDP. An out-of-bounds write vulnerability in the server-side NT LAN Manager NTLM authentication path can result in a Denial of Service DoS. When processing authentication messages with hash callbacks enabled, FreeRDP fails to properly validate the Message Integrity Check M...
freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit this vulnerability by sending a crafted sequence of progressive display tile updates to a connecting client. Because decompression buffers are allocated without being initialized, processing these updates can...
freerdp: freerdp: Arbitrary code execution via crafted persistent cache file
A flaw was found in FreeRDP. This flaw allows arbitrary code execution or a Denial of Service DoS when parsing persistent cache files. A local attacker can trigger this vulnerability by tricking a user into loading a maliciously crafted cache file containing oversized image dimensions. This...
freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file
A flaw was found in FreeRDP. This vulnerability allows a local attacker to execute arbitrary code or cause a denial of service DoS by supplying a specially crafted persistent cache file. When processing the malformed cache file, an arithmetic calculation error causes an undersized memory buffer t...
freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion
A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol RDP server to cause client memory corruption and a Denial of Service DoS by offering a specially crafted grayscale JPEG image through clipboard redirection. When the client converts the image into bitmap da...
Important: Red Hat Security Advisory: freerdp security, bug fix, and enhancement update
An update for freerdp is now available for Red Hat Enterprise Linux 10.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can trigger a Denial of Service DoS by sending repeated serial device creation requests when serial port redirection is enabled. Because FreeRDP fails to release previous communication handles before allocating new ones,...
freerdp: freerdp: Denial of Service via uncontrolled memory allocation in dynamic virtual channels
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can trigger excessive memory allocation on the connecting client by specifying an arbitrarily large length in dynamic virtual channel messages. Because the application reserves memory before validating incoming message...
freerdp: freerdp: Denial of Service via zero-length dynamic virtual channel messages
A flaw was found in FreeRDP. An authenticated remote attacker can cause a Denial of Service DoS by sending zero-length dynamic virtual channel data messages to the shadow server over an established Remote Desktop Protocol RDP session. Because the server fails to properly consume these empty...
freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server or a man-in-the-middle network attacker can cause a Denial of Service DoS by sending malformed PNG or JPEG image data during clipboard synchronization. Due to missing error handling in the image parsing routines, processi...
freerdp: freerdp: Denial of Service via zero-width graphics reset
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by sending a graphics reset packet with a width of zero, followed by a standard display update. Because the client fails to properly handle the zero-width dimension, it releases its prima...
pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets
A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules DER format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code HMAC operations. If an application supports both asymmetric and...
pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance
A flaw was found in pyjwt. A remote attacker can forge authentication tokens and bypass security controls by signing tokens with an empty key. When verifying tokens against a JSON Web Key JWK set that contains an empty Hash-based Message Authentication Code HMAC key, the library fails to enforce...
pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects
A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...
Critical: Red Hat Security Advisory: fence-agents security update
An update for fence-agents is now available for Red Hat Enterprise Linux 9.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling
A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...
pyjwt: PyJWT: Authentication bypass via improper public key validation
A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared...
kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange [email protected] says: The vulnerability is a race condition between etsqdiscdequeue and etsqdiscchange. It leads to UAF on stru...
kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period
A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol TCP connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could explo...
Critical: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
A flaw was found in the Linux kernel's NVMe over TCP target nvmet-tcp implementation. When a data digest mismatch is detected, nvmetrequninit is called unconditionally, but if the command was already in the INITFAILED state, the matching percpureftrygetlive was never performed. The resulting...
kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
A flaw was found in the Linux kernel's libiscsitcp component. A remote attacker, acting as a malicious iSCSI target, could send a specially crafted iSCSI SCSI Command Response ISCSIOPSCSICMDRSP with an oversized data segment. This could lead to a buffer overflow in a fixed-size buffer, potentiall...
kernel: nvme-tcp: fix host memory disclosure on R2T for a read command
A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...
kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
A flaw was found in the Bluetooth hcisync component of the Linux kernel. When the hcidevclosesync function is called during a device reset, the system may experience queuing timeouts. This occurs because the HCICMDDRAINWORKQUEUE flag is not properly set, which can lead to system instability or a...