Most recent entries from all

ALSA-2021:1796 — Moderate: container-tools:rhel8 security, bug fix, and enhancement update

Affected: AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: crit, AlmaLinux:8: criu, AlmaLinux:8: fuse-overlayfs, AlmaLinux:8: libslirp, AlmaLinux:8: libslirp-devel, AlmaLinux:8: python3-criu, AlmaLinux:8: slirp4netns and 1 more

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference (CVE-2020-29652)

* podman: Remote traffic to rootless containers is seen as orginating from localhost (CVE-2021-20199)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2023-05734

certfr-2022-avi-591 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2022-avi-591

Withdrawn: CLEANSTART-2026-NG63443 — Security fixes in cfssl 1.5.0-r1

Withdrawn by the publisher.

Affected: CleanStart: cfssl

Package cfssl version 1.5.0-r1 fixes 81 vulnerabilities: CVE-2020-29652, CVE-2021-31525, CVE-2021-33194, CVE-2021-38561, CVE-2021-43565...

EUVD-2026-47442

fkie_cve-2020-29652

A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.

GHSA-3vm4-22fp-5rfm — golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability

Affected: Go: golang.org/x/crypto

A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers. An attacker can craft an authentication request message for the `gssapi-with-mic` method which will cause NewServerConn to panic via a nil pointer dereference if ServerConfig.GSSAPIWithMICConfig is nil.

gsd-2020-29652

openSUSE-SU-2024:11667-1 — velero-1.7.1-1.1 on GA media

velero-1.7.1-1.1 on GA media

RHSA-2021:0799 — Red Hat Security Advisory: OpenShift Virtualization 2.6.0 security and bug fix update

golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash golang: data race in certain net/http servers including ReverseProxy can lead to DoS golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs jwt-go: access restriction bypass vulnerability golang-github-gorilla-websocket: integer overflow leads to denial of service golang: math/big: panic during recursive division of very large numbers golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation containernetworking-cni: Arbitrary path injection via type field in CNI configuration

UBUNTU-CVE-2020-29652

Affected: Ubuntu:Pro:20.04:LTS: golang-go.crypto, Ubuntu:22.04:LTS: golang-go.crypto

A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.

WID-SEC-W-2022-0510 — IBM DB2: Mehrere Schwachstellen

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, willkürlichen Code mit erhöhten Rechten auszuführen, Informationen falsch darzustellen und beliebigen Code auszuführen.