Most recent entries from all

ALSA-2021:4226 — Moderate: grafana security, bug fix, and enhancement update

Affected: AlmaLinux:8: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.9). (BZ#1921191)

Security Fix(es):

* golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

* grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call (CVE-2021-27358)

* golang: net: lookup functions may return invalid host names (CVE-2021-33195)

* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)

* golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-01056

Withdrawn: BELL-CVE-2021-3114 — CVE-2021-3114 does not affect BellSoft software

Withdrawn by the publisher.

BIT-golang-2021-3114

Affected: Bitnami: golang

In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

certfr-2023-avi-0976 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2023-avi-0976

EUVD-2026-20708

fkie_cve-2021-3114

GHSA-gwfm-9vvh-63r3

gsd-2021-3114

msrc_CVE-2021-3114 — In Go before 1.14.14 and 1.15.x before 1.15.7 crypto/elliptic/p224.go can generate incorrect outputs related to an unde…

msrc_CVE-2021-3114

openSUSE-SU-2021:0190-1 — Security update for go1.14

Security update for go1.14

RHBA-2021:0959 — Red Hat Bug Fix Advisory: OpenShift Container Platform 4.7.4 extras update

golang: crypto/elliptic: incorrect operations on the P-224 curve

SUSE-SU-2021:0222-1 — Security update for go1.14

Security update for go1.14

UBUNTU-CVE-2021-3114

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:18.04:LTS: golang-1.8, Ubuntu:18.04:LTS: golang-1.9, Ubuntu:20.04:LTS: golang-1.13, Ubuntu:20.04:LTS: golang-1.14 and 1 more

WID-SEC-W-2024-0794 — Dell ECS: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.