https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:29:10 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-08651 bdu:2023-08651 https://cve.radiocsirt.org/vuln/bdu:2023-08651 https://cve.radiocsirt.org/vuln/certfr-2022-avi-932 certfr-2022-avi-932 https://cve.radiocsirt.org/vuln/certfr-2022-avi-932 https://cve.radiocsirt.org/vuln/cleanstart-2026-cu18187 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: stargate</p> <p>Package stargate version 1.0.90-r4 fixes 87 vulnerabilities: ghsa-76h9-2vwh-w278, ghsa-pqr6-cmr2-h8hf, ghsa-fjpj-2g6w-x25r, ghsa-qcwq-55hx-v3vh, ghsa-55g7-9cwv-5qfv...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: stargate</p> <p>Package stargate version 1.0.90-r4 fixes 87 vulnerabilities: ghsa-76h9-2vwh-w278, ghsa-pqr6-cmr2-h8hf, ghsa-fjpj-2g6w-x25r, ghsa-qcwq-55hx-v3vh, ghsa-55g7-9cwv-5qfv...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-cu18187 https://cve.radiocsirt.org/vuln/euvd-2026-232740 EUVD-2026-232740 https://cve.radiocsirt.org/vuln/euvd-2026-232740 https://cve.radiocsirt.org/vuln/fkie_cve-2022-24823 <p>Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty&#39;s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one&#39;s own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.</p> <p>Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty&#39;s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one&#39;s own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-24823 https://cve.radiocsirt.org/vuln/ghsa-269q-hmxg-m83q <p><strong>Affected:</strong> Maven: io.netty:netty-codec-http</p> <p>### Description ### [GHSA-5mcr-gq6c-3hq2](https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2) (CVE-2021-21290) contains an insufficient fix for the vulnerability identified.</p> <p>### Impact ###</p> <p>When netty&#39;s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.</p> <p>This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.</p> <p>### Vulnerability Details ###</p> <p>To fix the vulnerability the code was changed to the following:</p> <p>```java @SuppressJava6Requirement(reason = &#34;Guarded by version check&#34;) public static File createTempFile(String prefix, String suffix, File directory) throws IOException { if (javaVersion() &gt;= 7) { if (directory == null) { return Files.createTempFile(prefix, suffix).toFile(); } return Files.createTempFile(directory.toPath(), prefix, suffix).toFile(); } if (directory == null) { return File.createTempFile(prefix, suffix); } File file = File.createTempFile(prefix, suffix, directory); // Try to adjust the perms, if this fails there is not much else we can do... file.setReadable(false, false); file.setReadable(true, true…</p> <p><strong>Affected:</strong> Maven: io.netty:netty-codec-http</p> <p>### Description ### [GHSA-5mcr-gq6c-3hq2](https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2) (CVE-2021-21290) contains an insufficient fix for the vulnerability identified.</p> <p>### Impact ###</p> <p>When netty&#39;s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.</p> <p>This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.</p> <p>### Vulnerability Details ###</p> <p>To fix the vulnerability the code was changed to the following:</p> <p>```java @SuppressJava6Requirement(reason = &#34;Guarded by version check&#34;) public static File createTempFile(String prefix, String suffix, File directory) throws IOException { if (javaVersion() &gt;= 7) { if (directory == null) { return Files.createTempFile(prefix, suffix).toFile(); } return Files.createTempFile(directory.toPath(), prefix, suffix).toFile(); } if (directory == null) { return File.createTempFile(prefix, suffix); } File file = File.createTempFile(prefix, suffix, directory); // Try to adjust the perms, if this fails there is not much else we can do... file.setReadable(false, false); file.setReadable(true, true…</p> https://cve.radiocsirt.org/vuln/ghsa-269q-hmxg-m83q https://cve.radiocsirt.org/vuln/gsd-2022-24823 gsd-2022-24823 https://cve.radiocsirt.org/vuln/gsd-2022-24823 https://cve.radiocsirt.org/vuln/oesa-2025-2149 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: netty</p> <p>Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers &amp;amp;amp; clients. %package help Summary: Documents for Buildarch: noarch Requires: man info Provides: -javadoc = - Obsoletes: -javadoc &amp;amp;lt; - %description help Man pages and other related documents for . Security Fix(es):</p> <p>Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty&amp;apos;s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one&amp;apos;s own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.(CVE-2022-24823)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: netty</p> <p>Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers &amp;amp;amp; clients. %package help Summary: Documents for Buildarch: noarch Requires: man info Provides: -javadoc = - Obsoletes: -javadoc &amp;amp;lt; - %description help Man pages and other related documents for . Security Fix(es):</p> <p>Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty&amp;apos;s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one&amp;apos;s own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.(CVE-2022-24823)</p> https://cve.radiocsirt.org/vuln/oesa-2025-2149 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14442-1 <p>netty-4.1.114-1.1 on GA media</p> <p>netty-4.1.114-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14442-1 https://cve.radiocsirt.org/vuln/rhsa-2022:5892 <p>minimist: prototype pollution netty: world readable temporary file containing sensitive data com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson</p> <p>minimist: prototype pollution netty: world readable temporary file containing sensitive data com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson</p> https://cve.radiocsirt.org/vuln/rhsa-2022:5892 https://cve.radiocsirt.org/vuln/suse-su-2023:2096-2 <p>Security update for netty, netty-tcnative</p> <p>Security update for netty, netty-tcnative</p> https://cve.radiocsirt.org/vuln/suse-su-2023:2096-2 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-24823 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:25.10: netty, Ubuntu:Pro:26.04:LTS: netty</p> <p>Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty&#39;s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one&#39;s own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:25.10: netty, Ubuntu:Pro:26.04:LTS: netty</p> <p>Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty&#39;s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one&#39;s own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-24823 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0508 <p>Ein lokaler Angreifer kann eine Schwachstelle in IBM Tivoli Netcool/OMNIbus ausnutzen, um Informationen offenzulegen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in IBM Tivoli Netcool/OMNIbus ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0508