oss-security mailing list - 2021/11

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2021/11

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 9	² 12	³ 1	⁴ 3	⁵ 1	⁶	⁷
⁸	⁹ 1	¹⁰ 3	¹¹ 4	¹² 1	¹³	¹⁴
¹⁵ 1	¹⁶ 1	¹⁷ 2	¹⁸	¹⁹ 10	²⁰	²¹
²² 2	²³ 7	²⁴	²⁵ 1	²⁶	²⁷	²⁸
²⁹	³⁰ 1

Messages by day:

November 1 (9 messages)

CVE-2021-42574: rustc 1.56.0 and bidirectional-override codepoints in source code (Pietro Albini <pietro@...troalbini.org>)
[ANNOUNCE] Apache MINA 2.0.22 & 2.1.5 released (Emmanuel Lecharny <elecharny@...che.org>)
CVE-2021-27644: Apache DolphinScheduler: DolphinScheduler mysql jdbc connector parameters deserialize remote code execution (Calvin Kirs <kirs@...che.org>)
Re: CVE-2021-42574: rustc 1.56.0 and bidirectional-override codepoints in source code (Jakub Wilk <jwilk@...lk.net>)
Re: CVE-2021-42574: rustc 1.56.0 and bidirectional-override codepoints in source code (Dave Horsfall <dave@...sfall.org>)
Trojan Source Attacks (Nicholas Boucher <nicholas.boucher@...cam.ac.uk>)
Re: Trojan Source Attacks (Jan Engelhardt <jengelh@...i.de>)
CVE-2021-41973: Apache MINA HTTP listener DOS (Emmanuel Lecharny <elecharny@...che.org>)
Re: Trojan Source Attacks ("Perry E. Metzger" <perry@...rmont.com>)

November 2 (12 messages)

Re: Trojan Source Attacks (Santiago Torres <torresariass@...il.com>)
Re: Trojan Source Attacks (Jan Engelhardt <jengelh@...i.de>)
Re: Trojan Source Attacks (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
Barrier "software KVM switch" multiple remote security issues (Matthias Gerstner <mgerstner@...e.de>)
Re: Trojan Source Attacks ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Trojan Source Attacks (Josh Bressers <josh@...ss.net>)
Re: Trojan Source Attacks ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Trojan Source Attacks (Michael Orlitzky <michael@...itzky.com>)
Re: Trojan Source Attacks (Stuart D Gathman <stuart@...hman.org>)
Re: Trojan Source Attacks (Stuart D Gathman <stuart@...hman.org>)
Apache Traffic Server is vulnerable to various smuggle, DOS, and validation attacks (Bryan Call <bcall@...che.org>)
Re: Trojan Source Attacks (Seth Arnold <seth.arnold@...onical.com>)

November 3 (1 message)

CVE-2021-41174 Grafana XSS vulnerability (Daniel Lee <daniel@...fana.com>)

November 4 (3 messages)

Re: Trojan Source Attacks (Georgi Guninski <gguninski@...il.com>)
Re: Trojan Source Attacks ("Leonid Isaev (ifax)" <leonid.isaev@...x.com>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)

November 5 (1 message)

Re: Linux kernel: isdn: cpai: array-index-out-of-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c (butt3rflyh4ck <butterflyhuangxx@...il.com>)

November 9 (1 message)

[CVE-2021-43523] Incorrect handling of special characters in domain names in uclibc and uclibc-ng ("Philipp Jeitner (SIT)" <philipp.jeitner@....fraunhofer.de>)

November 10 (3 messages)

Trovent Security Advisory 2105-02 / CVE-2021-33618: Stored cross-site scripting in Dolibarr ERP & CRM (Stefan Pietsch <s.pietsch@...vent.io>)
Trovent Security Advisory 2106-01 / CVE-2021-33816: Authenticated remote code execution in Dolibarr ERP & CRM (Stefan Pietsch <s.pietsch@...vent.io>)
Fwd: Samba 4.15.2, 4.14.10, 4.13.14 Security Releases are available for Download (Solar Designer <solar@...nwall.com>)

November 11 (4 messages)

CVE-2021-26558: Apache ShardingSphere-UI: Deserialization of Untrusted Data (Juan Pan <panjuan@...che.org>)
CVE-2021-41972: Apache Superset: Credentials leak (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2021-43350: Apache Traffic Control: LDAP filter injection vulnerability in Traffic Ops (Zach Hoffman <zrhoffman@...che.org>)
Re: CVE-2021-43350: Apache Traffic Control: LDAP filter injection vulnerability in Traffic Ops (Zach Hoffman <zrhoffman@...che.org>)

November 12 (1 message)

Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)

November 15 (1 message)

Grafana 8.2.4 released with security fixes (Vardan Torosyan <vardan.torosyan@...fana.com>)

November 16 (1 message)

CVE-2021-37580: Apache ShenYu Admin bypass JWT authentication (Liang Liu <midnight2104@...che.org>)

November 17 (2 messages)

Re: CVE-2021-43350: Apache Traffic Control: LDAP filter injection vulnerability in Traffic Ops (Zach Hoffman <zrhoffman@...che.org>)
CVE-2021-42250: Apache Superset: Possible log injection (Daniel Gaspar <dpgaspar@...che.org>)

November 19 (10 messages)

CVE-2021-36372: Apache Ozone: Original block tokens are persisted and can be retrieved (Siddharth Wagle <swagle@...che.org>)
CVE-2021-39231: Apache Ozone: Missing authentication/authorization on internal RPC endpoints (Siddharth Wagle <swagle@...che.org>)
CVE-2021-39232: Apache Ozone: Missing admin check for SCM related admin commands (Siddharth Wagle <swagle@...che.org>)
CVE-2021-39233: Apache Ozone: Container-related datanode operations can be called without authorization (Siddharth Wagle <swagle@...che.org>)
CVE-2021-39234: Apache Ozone: Raw block data can be read bypassing ACL/authorization (Siddharth Wagle <swagle@...che.org>)
CVE-2021-39235: Apache Ozone: Access mode of block tokens are not enforced (Siddharth Wagle <swagle@...che.org>)
CVE-2021-39236: Apache Ozone: Owners of the S3 tokens are not validated (Siddharth Wagle <swagle@...che.org>)
CVE-2021-41532: Apache Ozone: Unauthenticated access to Ozone Recon HTTP endpoints (Siddharth Wagle <swagle@...che.org>)
Xen Security Advisory 390 v1 (CVE-2021-28710) - certain VT-d IOMMUs may not work in shared page table mode (Xen.org security team <security@....org>)
CVE-2021-41190 OCI distribution and image spec: "content-type" confusion (Vincent Batts <vbatts@...hbangbash.com>)

November 22 (2 messages)

CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable (Zexuan Luo <spacewander@...che.org>)
Re: CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable (Marcin Niemiec <niemiec.marcin@...il.com>)

November 23 (7 messages)

Re: CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable (Zhiyuan Ju <juzhiyuan@...che.org>)
[CVE-2021-40369] Apache JSPWiki Cross-site scripting vulnerability on Denounce plugin (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
[CVE-2021-44140] Apache JSPWiki Arbitrary file deletion on logout (Juan Pablo Santos Rodríguez <juanpablo.santos@...il.com>)
Xen Security Advisory 385 v2 (CVE-2021-28706) - guests may exceed their designated memory limit (Xen.org security team <security@....org>)
Xen Security Advisory 389 v3 (CVE-2021-28705,CVE-2021-28709) - issues with partially successful P2M updates on x86 (Xen.org security team <security@....org>)
Xen Security Advisory 387 v2 (CVE-2021-28703) - grant table v2 status pages may remain accessible after de-allocation (… (Xen.org security team <security@....org…)
Xen Security Advisory 388 v3 (CVE-2021-28704,CVE-2021-28707,CVE-2021-28708) - PoD operations on misaligned GFNs (Xen.org security team <security@....org>)

November 25 (1 message)

CVE-2021-4002: Linux kernel: Missing TLB flush on hugetlbfs (Nadav Amit <namit@...are.com>)

November 30 (1 message)

IMA gadgets (Florian Weimer <fweimer@...hat.com>)

60 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.