Affected: Homebrew: dstack

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

Withdrawn by the publisher.

Affected: CleanStart: prometheus-operator

Multiple security vulnerabilities affect the prometheus-operator package. These issues are resolved in later releases. See references for individual vulnerability details.

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Affected: PyPI: azure-identity, npm: @azure/identity, Maven: com.azure:azure-identity, npm: @azure/msal-node, NuGet: Microsoft.Identity.Client, Go: github.com/Azure/azure-sdk-for-go/sdk/azidentity, Maven: com.microsoft.azure:msal4j, NuGet: Azure.Identity

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

Affected: openEuler:24.03-LTS-SP2: restic

restic is a backup program. It supports verification, encryption, snapshots and deduplication. Security Fix(es):

A vulnerability was found in Microsoft Azure Identity Library and Microsoft Authentication Library (Cloud Software) (the affected version unknown). It has been rated as problematic.Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.Impacted is confidentiality.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2024-35255)

teleport-15.4.3-1.1 on GA media

Affected: PyPI: azure-identity

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

micromatch: vulnerable to Regular Expression Denial of Service braces: fails to limit the number of characters it can handle dset: Prototype Pollution golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses net/http: Denial of service due to improper 100-continue handling in net/http azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity urllib3: proxy-authorization request header is not stripped during cross-origin redirects fast-loops: prototype pollution via objectMergeDeep nodejs-async: Regular expression denial of service while parsing function in autoinject express: Improper Input Handling in Express Redirects serve-static: Improper Sanitization in serve-static

Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure ausnutzen, um seine Privilegien zu erhöhen und um einen Denial of Service Zustand herbeizuführen.