oss-security mailing list - 2022/02

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2022/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 4	²	³ 4	⁴ 1	⁵ 1	⁶
⁷ 3	⁸	⁹ 2	¹⁰ 1	¹¹ 5	¹² 1	¹³ 1
¹⁴ 2	¹⁵ 2	¹⁶	¹⁷ 2	¹⁸ 6	¹⁹ 1	²⁰
²¹ 2	²² 1	²³ 4	²⁴ 4	²⁵ 3	²⁶	²⁷
²⁸

Messages by day:

February 1 (4 messages)

Samba 4.15.5, 4.14.12, 4.13.17 Security Releases (John Helmert III <jchelmert3@...teo.net>)
Django: CVE-2022-22818: Possible XSS via {% debug %} template tag (Mariusz Felisiak <felisiak.mariusz@...il.com>)
Django: CVE-2022-23833: Denial-of-service possibility in file uploads (Mariusz Felisiak <felisiak.mariusz@...il.com>)
CVE-2021-44451: Apache Superset: API sensitive information leak (Daniel Gaspar <dpgaspar@...che.org>)

February 3 (4 messages)

Re: CVE-2022-22942: Linux kernel: wrong file descriptor handling in the vmwgfx driver (Mathias Krause <minipli@...ecurity.net>)
CVE-2021-36152: Apache Gobblin: Insecure TrustManager used in LDAP connections (Abhishek Tiwari <abti@...che.org>)
CVE-2021-36151: Apache Gobblin: Local Credentials Disclosure Vulnerability (Abhishek Tiwari <abti@...che.org>)
ARTEMIS-3593: CVE-2022-23913: Apache ActiveMQ Artemis DoS (Justin Bertram <jbertram@...che.org>)

February 4 (1 message)

CVE-2022-0492: Linux kernel cgroups v1 missing capabilities check when setting release_agent (Tabitha Sable <tabitha.c.sable@...il.com>)

February 5 (1 message)

CVE-2022-23206: Apache Traffic Control: Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth (Zach Hoffman <zrhoffman@...che.org>)

February 7 (3 messages)

CVE-2022-22931: Path traversal in Apache James (Benoit Tellier <btellier@...che.org>)
[CVE-2022-24450] nats-server unconstrained account assumption by authenticated clients (Phil Pennock <oss-security-phil@...dhuis.org>)
Browser-mediated attacks on WebDriver servers (Gabriel Corona <gabriel.corona@...t-bretagne.fr>)

February 9 (2 messages)

Vulnerability in Jenkins (Daniel Beck <ml@...kweb.net>)
WebKitGTK and WPE WebKit Security Advisory WSA-2022-0002 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

February 10 (1 message)

CVE-2022-0435: Remote Stack Overflow in Linux Kernel TIPC Module since 4.8 (net/tipc) (Samuel Page <samuel.page@...gate.com>)

February 11 (5 messages)

CVE-2022-24289: Apache Cayenne: Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with o… (Aristedes Maniatis <amaniatis@...che.or…)
Linux kernel: Fix for KVM on s390, insufficient checks for ioctl (Christian Borntraeger <borntraeger@...ux.ibm.com>)
CVE-2022-24112: Apache APISIX: apisix/batch-requests plugin allows overwriting the X-REAL-IP header (Zexuan Luo <spacewander@...che.org>)
CVE-2021-44521: Apache Cassandra: Remote code execution for scripted UDFs (Marcus Eriksson <marcuse@...che.org>)
[CVE-2022-23633] Possible exposure of information vulnerability in Action Pack (Aaron Patterson <aaron.patterson@...il.com>)

February 12 (1 message)

CVE-2021-44879: kernel:NULL pointer dereference in fs/f2fs/gc.c:move_data_page (Wenqing Liu <liu@...fsu.edu>)

February 13 (1 message)

Linux kernel: potential net namespace bug in IPv6 flow label management ("Liu, Congyu" <liu3101@...due.edu>)

February 14 (2 messages)

Re: Linux kernel: potential net namespace bug in IPv6 flow label management (Willem de Bruijn <willemdebruijn.kernel@...il.com>)
Re: Linux kernel: potential net namespace bug in IPv6 flow label management (Willem de Bruijn <willemdebruijn.kernel@...il.com>)

February 15 (2 messages)

CVE-2022-21698: HTTP method DOS; Prometheus client_golang <1.11.1 affected; Other web servers might be affected too (Bartek Plotka <bartek@...metheus.io>)
Multiple vulnerabilities in Jenkins plugins (Wadeck Follonier <wfollonier@...udbees.com>)

February 17 (2 messages)

WebKitGTK and WPE WebKit Security Advisory WSA-2022-0003 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
CVE-2021-44731: Race condition in snap-confine's setup_private_mount() (Qualys Security Advisory <qsa@...lys.com>)

February 18 (6 messages)

CVE-2021-4115: polkit: file descriptor leak allows an unprivileged user to cause a crash. (Devon Thompson <devthomp@...hat.com>)
CVE-2021-4120: Insufficient validation of snap content interface and layout paths (Alex Murray <alex.murray@...onical.com>)
Multiple vulnerabilities affecting cobbler (Paolo Perego <pperego@...e.de>)
Re: CVE-2021-3997: Uncontrolled recursion in systemd's systemd-tmpfiles (Solar Designer <solar@...nwall.com>)
Re: CVE-2021-4115: polkit: file descriptor leak allows an unprivileged user to cause a crash. (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2021-4115: polkit: file descriptor leak allows an unprivileged user to cause a crash. (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 19 (1 message)

Expat 2.4.5 released, includes 5 security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 21 (2 messages)

CVE-2022-25375 : Linux RNDIS USB Gadget memory extraction via packet filter (Szymon Heidrich <szymon.heidrich@...il.com>)
Linux kernel: heap out of bounds write in nf_dup_netdev.c since 5.4 (Nick Gregory <Nick.Gregory@...hos.com>)

February 22 (1 message)

Re: Linux kernel: heap out of bounds write in nf_dup_netdev.c since 5.4 (Salvatore Bonaccorso <carnil@...ian.org>)

February 23 (4 messages)

Re: CVE-2021-44731: Race condition in snap-confine's setup_private_mount() (Wire Snark <wsnark@...a.io>)
Re: CVE-2021-44731: Race condition in snap-confine's setup_private_mount() (Simon McVittie <smcv@...ian.org>)
Announce: OpenSSH 8.9 released (Damien Miller <djm@....openbsd.org>)
Fwd: Cyrus-SASL 2.1.28 released [fixes CVE-2022-24407 & CVE-2019-19906] (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 24 (4 messages)

fscrypt: Multiple File System Related Security Issues (CVE-2022-25326, CVE-2022-25327, CVE-2022-25328) (Matthias Gerstner <mgerstner@...e.de>)
CVE-2021-45229: Apache Airflow: Reflected XSS via Origin Query Argument in URL (Jedidiah Cunningham <jedcunningham@...che.org>)
CVE-2022-24288: Apache Airflow: RCE in example DAGs (Jedidiah Cunningham <jedcunningham@...che.org>)
Re: fscrypt: Multiple File System Related Security Issues (CVE-2022-25326, CVE-2022-25327, CVE-2022-25328) (Eric Biggers <ebiggers@...nel.org>)

February 25 (3 messages)

[CVE-2022-24947] Apache JSPWiki CSRF Account Takeover (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
[CVE-2022-24948] Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen (Juan Pablo Santos Rodríguez <juanpablo@...che.org>)
CVE-2022-24986: KCron: Insecure temporary file handling (Carlos López <clopez@...e.de>)

50 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.