oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2022/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 5	² 12	³ 1	⁴
⁵ 2	⁶ 9	⁷ 4	⁸ 2	⁹ 2	¹⁰	¹¹ 2
¹²	¹³ 1	¹⁴ 2	¹⁵ 2	¹⁶ 1	¹⁷	¹⁸
¹⁹ 3	²⁰ 4	²¹ 5	²² 10	²³ 4	²⁴ 2	²⁵
²⁶	²⁷ 2	²⁸ 1	²⁹	³⁰

Messages by day:

September 1 (5 messages)

Re: CVE-2022-31790 CVE-2022-31789: Watchguard XTM/Firebox firewalls: Multiple vulnerabilities (Roxana Bradescu <roxxbee@...il.com>)
Re: CVE-2022-2663: Linux netfilter: nf_conntrack_irc message handling (David Leadbeater <dgl@....cx>)
CVE-2022-37435: Apache ShenYu Admin Improper Privilege Management (Zhang Yonglun <zhangyonglun@...che.org>)
ClusterLabs/PCS: [CVE-2022-2735] Obtaining an authentication token for hacluster user leads to privilege escalation. (Tej Rathi <trathi@...hat.com>)
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

September 2 (12 messages)

CVE-2022-38054: Apache Airflow: Session Fixation (Jedidiah Cunningham <jedcunningham@...che.org>)
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 (Demi Marie Obenour <demi@...isiblethingslab.com>)
CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons (Jedidiah Cunningham <jedcunningham@...che.org>)
Apache OFBiz - Server-Side Template Injection (CVE-2022-25813) (Jacques Le Roux <jleroux@...che.org>)
Apache OFBiz - Regular Expression Denial of Service (ReDoS) (CVE-2022-29158) (Jacques Le Roux <jleroux@...che.org>)
Apache OFBiz - Java Deserialization via RMI Connection (CVE-2022-29063) (Jacques Le Roux <jleroux@...che.org>)
Apache OFBiz - Unauth Path Traversal with file corruption (CVE-2022-25371) (Jacques Le Roux <jleroux@...che.org>)
Apache OFBiz - Unauth Stored XSS (CVE-2022-25370) (Jacques Le Roux <jleroux@...che.org>)
Re: Linux Kernel use-after-free write in netfilter (Solar Designer <solar@...nwall.com>)
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
JBIG2 integer overflow fixed in Xpdf 4.04, Poppler 22.09.0 (Art Manion <zmanion@...tonmail.com>)
Re: CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons (Seth Arnold <seth.arnold@...onical.com>)

September 3 (1 message)

Re: Apache OFBiz - Unauth Path Traversal with file corruption (CVE-2022-25371) (Jacques Le Roux <jleroux@...che.org>)

September 5 (2 messages)

CVE-2022-38369: Apache IoTDB: Login check vulnerability by session Id (Haonan Hou <haonan@...che.org>)
CVE-2022-38370: Apache IoTDB: No authorization of DatabaseConnectController in grafana-connector. (Haonan Hou <haonan@...che.org>)

September 6 (9 messages)

sagemath denial of service with abort() in gmp: overflow in mpz type (Georgi Guninski <gguninski@...il.com>)
Re: CVE-2022-28199: DPDK mlx5 driver error recovery handling vulnerability (Joey <joey@...e.io>)
Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Jeremy Stanley <fungi@...goth.org>)
Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Michael Orlitzky <michael@...itzky.com>)
Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Jeffrey Walton <noloader@...il.com>)
Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Georgi Guninski <gguninski@...il.com>)
Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Jeremy Stanley <fungi@...goth.org>)
Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Georgi Guninski <gguninski@...il.com>)
Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Russ Allbery <eagle@...ie.org>)

September 7 (4 messages)

Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Seth Arnold <seth.arnold@...onical.com>)
Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Georgi Guninski <gguninski@...il.com>)
Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Jeremy Stanley <fungi@...goth.org>)
Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Russ Allbery <eagle@...ie.org>)

September 8 (2 messages)

Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Georgi Guninski <gguninski@...il.com>)
Apache OFBiz - Unauth Path Traversal with file corruption (CVE-2022-25371) (Jacques Le Roux <jleroux@...che.org>)

September 9 (2 messages)

Linux kernel: information disclosure in stex_queuecommand_lck (Xingyuan Mo <hdthky0@...il.com>)
Vulnerability in Jenkins (Daniel Beck <ml@...kweb.net>)

September 11 (2 messages)

CVE-2022-39135: Apache Calcite: potential XEE attacks (Ruben Q L <rubenql@...che.org>)
Re: CVE-2019-18960: Firecracker v0.18.0 and v0.19.0 vsock buffer overflow (Solar Designer <solar@...nwall.com>)

September 13 (1 message)

Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 (John Helmert III <ajak@...too.org>)

September 14 (2 messages)

insufficiently protected D-Bus interface in KDiskMark 3.0.0 (CVE-2022-40673) (Matthias Gerstner <mgerstner@...e.de>)
Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Georgi Guninski <gguninski@...il.com>)

September 15 (2 messages)

Fwd: Node.js security updates for all active release lines, Month Year (Vladimir de Turckheim <vdeturckheim@...il.com>)
[kubernetes] CVE-2021-25749: runAsNonRoot logic bypass for Windows containers (Pushkar Joglekar <pushkarj.at.work@...il.com>)

September 16 (1 message)

[kubernetes] CVE-2022-3172: Aggregated API server can cause clients to be redirected (SSRF) (Monis Khan <i@...is.app>)

September 19 (3 messages)

Re: Linux kernel: information disclosure in stex_queuecommand_lck (Xingyuan Mo <hdthky0@...il.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2022-0009 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
CVE-2022-34917: Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers (Manikumar <manikumar@...che.org>)

September 20 (4 messages)

CVE-2022-28220: STARTTLS command injection in Apache JAMES (Benoit Tellier <btellier@...che.org>)
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0009 (Carlos Alberto Lopez Perez <clopez@...lia.com>)
CVE-2022-40604: Apache Airflow: Format String Vulnerability (Jedidiah Cunningham <jedcunningham@...che.org>)
CVE-2022-40754: Apache Airflow: Open Redirect (Jedidiah Cunningham <jedcunningham@...che.org>)

September 21 (5 messages)

big ints in python: CVE-2020-10735 (Georgi Guninski <gguninski@...il.com>)
Re: CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons (Jed Cunningham <jedcunningham@...che.org>)
ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CV… (Michał Kępień <michal@....org>)
Re: big ints in python: CVE-2020-10735 (Demi Marie Obenour <demi@...isiblethingslab.com>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)

September 22 (10 messages)

CVE-2022-40705: Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via H… (Arnout Engelen <engelen@...che.org>)
[CVE-2022-38398] Apache Batik information disclosure vulnerability ("Simon Steiner" <simonsteiner1984@...il.com>)
[CVE-2022-40146] Apache Batik information disclosure vulnerability ("Simon Steiner" <simonsteiner1984@...il.com>)
[CVE-2022-38648] Apache Batik information disclosure vulnerability ("Simon Steiner" <simonsteiner1984@...il.com>)
CVE-2022-40955: Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC (Arnout Engelen <engelen@...che.org>)
CVE-2022-24280: Apache Pulsar Proxy target broker address isn't validated (Lari Hotari <lhotari@...che.org>)
CVE-2022-33681: Apache Pulsar: Improper Hostname Verification in Java Client and Proxy can expose authentication data v… (Michael Marshall <mmarshall@...che.org>)
CVE-2022-33682: Apache Pulsar: Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack (Michael Marshall <mmarshall@...che.org>)
CVE-2022-33683: Apache Pulsar: Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM att… (Michael Marshall <mmarshall@...che.org>)
Fwd: [Postponed] Node.js security updates for all active release lines, September 2022 (Vladimir de Turckheim <vdeturckheim@...il.com>)

September 23 (4 messages)

Fwd: [ADVISORY] SQUID-2022:1 Exposure of Sensitive Information in Cache Manager (Amos Jeffries <squid3@...enet.co.nz>)
Fwd: [ADVISORY] SQUID-2022:2 Buffer Over Read in SSPI and SMB Authentication (Amos Jeffries <squid3@...enet.co.nz>)
Fwd: Node.js security updates for all active release lines, September 2022 (Vladimir de Turckheim <vdeturckheim@...il.com>)
CVE-2022-41218: Linux dvb-core: UAF in dvb-core/dmxdev (Hyunwoo Kim <imv4bel@...il.com>)

September 24 (2 messages)

[Report v2] CVE-2022-41218: Linux dvb-core: UAF in dvb-core/dmxdev (Hyunwoo Kim <imv4bel@...il.com>)
Re: [Report v2] CVE-2022-41218: Linux dvb-core: UAF in dvb-core/dmxdev (Hyunwoo Kim <imv4bel@...il.com>)

September 27 (2 messages)

CVE-2022-1941: Protobuf C++, Python DoS (Ana Oprea <anaoprea@...gle.com>)
[SBA-ADV-20220328-01] CVE-2022-38335: Vtiger CRM 7.4.0 or below Stored Cross-Site Scripting (SBA - Advisory <advisory@...-research.org>)

September 28 (1 message)

CVE-2021-43980: Apache Tomcat: Information disclosure (Mark Thomas <markt@...che.org>)

76 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.