https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 09:21:02 +0000 https://cve.radiocsirt.org/vuln/cve-2015-3254 <p>The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.</p> <p>The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.</p> https://cve.radiocsirt.org/vuln/cve-2015-3254 https://cve.radiocsirt.org/vuln/ghsa-269q-hmxg-m83q <p><strong>Affected:</strong> Maven: io.netty:netty-codec-http</p> <p>### Description ### [GHSA-5mcr-gq6c-3hq2](https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2) (CVE-2021-21290) contains an insufficient fix for the vulnerability identified.</p> <p>### Impact ###</p> <p>When netty&#39;s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.</p> <p>This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.</p> <p>### Vulnerability Details ###</p> <p>To fix the vulnerability the code was changed to the following:</p> <p>```java @SuppressJava6Requirement(reason = &#34;Guarded by version check&#34;) public static File createTempFile(String prefix, String suffix, File directory) throws IOException { if (javaVersion() &gt;= 7) { if (directory == null) { return Files.createTempFile(prefix, suffix).toFile(); } return Files.createTempFile(directory.toPath(), prefix, suffix).toFile(); } if (directory == null) { return File.createTempFile(prefix, suffix); } File file = File.createTempFile(prefix, suffix, directory); // Try to adjust the perms, if this fails there is not much else we can do... file.setReadable(false, false); file.setReadable(true, true…</p> <p><strong>Affected:</strong> Maven: io.netty:netty-codec-http</p> <p>### Description ### [GHSA-5mcr-gq6c-3hq2](https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2) (CVE-2021-21290) contains an insufficient fix for the vulnerability identified.</p> <p>### Impact ###</p> <p>When netty&#39;s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.</p> <p>This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.</p> <p>### Vulnerability Details ###</p> <p>To fix the vulnerability the code was changed to the following:</p> <p>```java @SuppressJava6Requirement(reason = &#34;Guarded by version check&#34;) public static File createTempFile(String prefix, String suffix, File directory) throws IOException { if (javaVersion() &gt;= 7) { if (directory == null) { return Files.createTempFile(prefix, suffix).toFile(); } return Files.createTempFile(directory.toPath(), prefix, suffix).toFile(); } if (directory == null) { return File.createTempFile(prefix, suffix); } File file = File.createTempFile(prefix, suffix, directory); // Try to adjust the perms, if this fails there is not much else we can do... file.setReadable(false, false); file.setReadable(true, true…</p> https://cve.radiocsirt.org/vuln/ghsa-269q-hmxg-m83q