oss-security mailing list - 2021/07

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2021/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹	² 2	³	⁴ 1
⁵ 1	⁶ 3	⁷	⁸	⁹	¹⁰	¹¹
¹² 2	¹³ 6	¹⁴ 1	¹⁵	¹⁶	¹⁷	¹⁸ 1
¹⁹ 2	²⁰ 5	²¹ 4	²² 7	²³ 3	²⁴ 4	²⁵ 2
²⁶ 5	²⁷ 3	²⁸ 5	²⁹ 2	³⁰ 2	³¹

Messages by day:

July 2 (2 messages)

CVE-2021-26920: Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (Jihoon Son <jihoonson@...che.org>)
Django: CVE-2021-35042: Potential SQL injection via unsanitized QuerySet.order_by() input (Mariusz Felisiak <felisiak.mariusz@...il.com>)

July 4 (1 message)

CVE-2021-33192: Apache Jena Fuseki: Display information UI XSS (Andy Seaborne <andy@...che.org>)

July 5 (1 message)

Re: Blind in/on-path attacks against VPN-tunneled connections (CVE-2019-14899 follow-up) (vpn-research@...akpointingbad.com)

July 6 (3 messages)

linuxptp: Fixes published for CVE-2021-3570 and CVE-2021-3571 (Richard Cochran <richardcochran@...il.com>)
xscreensaver 5.45 crash (Mustafa Kuscu <mustafakuscu@...il.com>)
CVE-2021-35039: Linux kernel loading unsigned kernel modules via init_module syscall (Nayna <nayna@...ux.vnet.ibm.com>)

July 12 (2 messages)

CVE-2021-30129: DoS/OOM leak vulnerability in Apache Mina SSHD Server (Guillaume Nodet <gnodet@...che.org>)
[OSSA-2021-001] Neutron: Anti-spoofing bypass for Open vSwitch networks (CVE-2021-20267) (Jeremy Stanley <fungi@...goth.org>)

July 13 (6 messages)

CVE-2021-35515: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability (Stefan Bodewig <bodewig@...che.org>)
CVE-2021-35516: Apache Commons Compress 1.6 to 1.20 denial of service vulnerability (Stefan Bodewig <bodewig@...che.org>)
CVE-2021-35517: Apache Commons Compress 1.1 to 1.20 denial of service vulnerability (Stefan Bodewig <bodewig@...che.org>)
CVE-2021-36090: Apache Commons Compress 1.0 to 1.20 denial of service vulnerability (Stefan Bodewig <bodewig@...che.org>)
CVE-2021-36373: Apache Ant TAR archive denial of service vulnerability (Stefan Bodewig <bodewig@...che.org>)
CVE-2021-36374: Apache Ant ZIP, and ZIP based, archive denial of service vulerability (Stefan Bodewig <bodewig@...che.org>)

July 14 (1 message)

[kubernetes] CVE-2021-25740: Endpoint & EndpointSlice permissions allow cross-Namespace forwarding (CJ Cullen <cjcullen@...gle.com>)

July 18 (1 message)

Re: Polipo: denial-of-service using range (John Helmert III <jchelmert3@...teo.net>)

July 19 (2 messages)

Re: Polipo: denial-of-service using range (Jeffrey Walton <noloader@...il.com>)
CVE-2021-32760: containerd archive package allows chmod of file outside of unpack target directory ("Karp, Samuel" <skarp@...zon.com>)

July 20 (5 messages)

CVE-2021-33909: size_t-to-int vulnerability in Linux's filesystem layer (Qualys Security Advisory <qsa@...lys.com>)
CVE-2021-33910: Denial of service (stack exhaustion) in systemd (PID 1) (Qualys Security Advisory <qsa@...lys.com>)
Re: CVE-2021-33909: size_t-to-int vulnerability in Linux's filesystem layer (Petr Matousek <pmatouse@...hat.com>)
Re: CVE-2021-33910: Denial of service (stack exhaustion) in systemd (PID 1) (Mauro Matteo Cascella <mcascell@...hat.com>)
Pop!_OS Membership to linux-distros list ("Jeremy Soller" <jeremy@...tem76.com>)

July 21 (4 messages)

[SECURITY ADVISORY] curl: Wrong content via metalink not discarded (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: Metalink download sends credentials (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: Bad connection reuse due to flawed path name checks (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: TELNET stack contents disclosure again (Daniel Stenberg <daniel@...x.se>)

July 22 (7 messages)

CVE-2021-3640: Linux kernel: UAF in sco_send_frame function (Lin Horse <kylin.formalin@...il.com>)
ipython3 may execute code from the current working directory (Georgi Guninski <gguninski@...il.com>)
CVE-2021-28131: Apache Impala: Impala logs contain secrets (Zoltán Borók-Nagy <boroknagyz@...che.org>)
Re: ipython3 may execute code from the current working directory (Jakub Wilk <jwilk@...lk.net>)
Prosody XMPP server advisory 2021-07-22 (Remote Information Disclosure) (CVE Request) (Jonas Schäfer <j.wielicki@...ecware.net>)
Re: ipython3 may execute code from the current working directory (Jakub Wilk <jwilk@...lk.net>)
Re: CVE-2021-33909: size_t-to-int vulnerability in Linux's filesystem layer (Qualys Security Advisory <qsa@...lys.com>)

July 23 (3 messages)

WebKitGTK and WPE WebKit Security Advisory WSA-2021-0004 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
Re: ipython3 may execute code from the current working directory (Jakub Wilk <jwilk@...lk.net>)
Re: ipython3 may execute code from the current working directory (Mats Wichmann <mats@...hmann.us>)

July 24 (4 messages)

CVE-2021-33900: Apache Directory Studio: StartTLS and SASL confidentiality protection bypass (Stefan Seelmann <seelmann@...che.org>)
Potential symlink attack in python3 __pycache__ (Georgi Guninski <gguninski@...il.com>)
Re: Potential symlink attack in python3 __pycache__ (Michael Orlitzky <michael@...itzky.com>)
Re: ipython3 may execute code from the current working directory (Jakub Wilk <jwilk@...lk.net>)

July 25 (2 messages)

CVE-2020-28020: Integer overflow in Exim that can lead to RCE: Some questions to the Qualys researchers who designed th… ("Jonas Dellinger" <jdellinger@...l2tor.…)
Re: ipython3 may execute code from the current working directory (Georgi Guninski <gguninski@...il.com>)

July 26 (5 messages)

Linux kernel: powerpc: KVM guest to host memory corruption (Michael Ellerman <mpe@...erman.id.au>)
security advisory 2021-01 for PowerDNS Authoritative Server 4.5.0 (Peter van Dijk <peter.van.dijk@...erdns.com>)
Re: Potential symlink attack in python3 __pycache__ (Georgi Guninski <gguninski@...il.com>)
Re: Potential symlink attack in python3 __pycache__ (Santiago Torres <torresariass@...il.com>)
Re: Potential symlink attack in python3 __pycache__ (Jakub Wilk <jwilk@...lk.net>)

July 27 (3 messages)

replay-sorcery: CVE-2021-36983: kms service in version 0.6.0 allows local root exploit and other local attack vectors (Matthias Gerstner <mgerstner@...e.de>)
Re: Linux kernel: powerpc: KVM guest to host memory corruption (Michael Ellerman <mpe@...erman.id.au>)
Re: Pop!_OS Membership to linux-distros list (Solar Designer <solar@...nwall.com>)

July 28 (5 messages)

Re: Prosody XMPP server advisory 2021-07-22 (Remote Information Disclosure) (CVE Request) (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Polipo: denial-of-service using range ("Alexandr Savca (chinarulezzz)" <alexandr.savca89@...il.com>)
Re: Prosody XMPP server advisory 2021-07-22 (Remote Information Disclosure) (CVE Request) (Jonas Schäfer <jonas@...licki.name>)
Re: Prosody XMPP server advisory 2021-07-22 (Remote Information Disclosure) (CVE-2021-37601) (Jonas Schäfer <jonas@...licki.name>)
ANNOUNCE: fetchmail <= 6.4.19 security announcement 2021-01 (CVE-2021-36386) - fetchmail 6.4.20 released. DoS or inform… (Matthias Andree <matthias.andree@....de…)

July 29 (2 messages)

[SECURITY] CVE-2021-37578 Apache jUDDI Remote code execution ("Alex O'Ree" <alexoree@...che.org>)
[OSSA-2021-002] Nova: Open Redirect in noVNC proxy (CVE-2021-3654) (Jeremy Stanley <fungi@...goth.org>)

July 30 (2 messages)

Node.js: Security updates for all active release lines, 30 July 2021 (Daniel Bevenius <dbeveniu@...hat.com>)
Re: Pop!_OS Membership to linux-distros list (Tyler Hicks <code@...icks.com>)

61 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.