oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2022/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	²
³ 3	⁴ 3	⁵ 1	⁶ 5	⁷	⁸	⁹
¹⁰	¹¹ 5	¹² 2	¹³ 8	¹⁴	¹⁵	¹⁶
¹⁷	¹⁸ 5	¹⁹ 4	²⁰	²¹	²²	²³ 2
²⁴ 3	²⁵ 6	²⁶ 8	²⁷ 3	²⁸ 2	²⁹ 4	³⁰ 1
³¹ 5

Messages by day:

October 3 (3 messages)

MySQL Cluster 8.0.30 overflow (Evgeny Legerov <admin@...ndisco.cc>)
Re: MySQL Cluster 8.0.30 overflow (Alex Gaynor <alex.gaynor@...il.com>)
CreativeDream software arbitrary file upload (Larry Cashdollar <larry0@...com>)

October 4 (3 messages)

Announce: OpenSSH 9.1 released (Damien Miller <djm@....openbsd.org>)
Django CVE-2022-41323: Potential denial-of-service vulnerability in internationalized URLs (Carlton Gibson <carlton.gibson@...il.com>)
CVE-2022-41672: Apache Airflow: Session still funtional after user is deactivated (Jedidiah Cunningham <jedcunningham@...che.org>)

October 5 (1 message)

ISC has disclosed two vulnerabilities in ISC DHCP (CVE-2022-2928, CVE-2022-2929) (Peter Davies <peterd@....org>)

October 6 (5 messages)

dbus denial of service: CVE-2022-42010, -42011, -42012 (Simon McVittie <smcv@...ian.org>)
Re: dbus denial of service: CVE-2022-42010, -42011, -42012 (Simon McVittie <smcv@...ian.org>)
Re: dbus denial of service: CVE-2022-42010, -42011, -42012 (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: dbus denial of service: CVE-2022-42010, -42011, -42012 (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: dbus denial of service: CVE-2022-42010, -42011, -42012 (Simon McVittie <smcv@...ian.org>)

October 11 (5 messages)

CVE-2022-24697: Apache Kylin: Command injection exists when the configuration overwrites function overwrites system parameters (Xiaoxiang Yu <xxyu@...che.org>)
Xen Security Advisory 411 v3 (CVE-2022-33748) - lock order inversion in transitive grant copy handling (Xen.org security team <security@....org>)
Xen Security Advisory 410 v3 (CVE-2022-33746) - P2M pool freeing may take excessively long (Xen.org security team <security@....org>)
Xen Security Advisory 413 v2 (CVE-2022-33749) - XAPI open file limit DoS (Xen.org security team <security@....org>)
Xen Security Advisory 409 v3 (CVE-2022-33747) - Arm: unbounded memory consumption for 2nd-level page tables (Xen.org security team <security@....org>)

October 12 (2 messages)

CVE-2022-40664: Apache Shiro: Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher (Brian Demers <bdemers@...che.org>)
Re: CVE-2022-40664: Apache Shiro: Authentication Bypass Vulnerability in Shiro when forwarding or including via Reques… (Alan Coopersmith <alan.coopersmith@...c…)

October 13 (8 messages)

Re: CVE-2022-40664: Apache Shiro: Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispat… (Brian Demers <bdemers@...che.org>)
Various Linux Kernel WLAN security issues (RCE/DOS) found (Marcus Meissner <meissner@...e.de>)
Re: sagemath denial of service with abort() in gmp: overflow in mpz type (Georgi Guninski <gguninski@...il.com>)
CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpol… ("Gary D. Gregory" <ggregory@...che.org>)
Re: Various Linux Kernel WLAN security issues (RCE/DOS) found (Sönke Huster <shuster@...moo.tu-darmstadt.de>)
Re: Various Linux Kernel WLAN security issues (RCE/DOS) found (Sönke Huster <shuster@...moo.tu-darmstadt.de>)
Re: Various Linux Kernel WLAN security issues (RCE/DOS) found (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: Various Linux Kernel WLAN security issues (RCE/DOS) found (Chris Down <chris@...isdown.name>)

October 18 (5 messages)

Re: CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure int… (Alan Coopersmith <alan.coopersmith@...c…)
Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT… (Markus Koschany <apo@...ian.org>)
CVE-2022-39198: Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass (Albumen Kevin <albumenj@...che.org>)
CVE-2022-2602 - Linux kernel io_uring UAF (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
Git 2.38.1 and others for CVE-2022-39253, and CVE-2022-39260 (Taylor Blau <me@...ylorr.com>)

October 19 (4 messages)

ISIS-3128: CVE-2022-42467: Apache Isis: h2 webconsole (available only in prototype mode) should nevertheless be disabled by… (Dan Haywood <danhaywood@...che.org>)
CVE-2022-42466: Apache Isis: XSS vulnerability, eg for String properties. (Dan Haywood <danhaywood@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: CVE-2022-2602 - Linux kernel io_uring UAF (David Bouman <dbouman03@...il.com>)

October 23 (2 messages)

Linux kernel: net: mctp: A Use-After-Free bug in mctp_sk_unhash in net/mctp/af_mctp.c (butt3rflyh4ck <butterflyhuangxx@...il.com>)
CVE-2021-42010: Apache Heron (Incubating): CRLF log injection (Josh Fischer <joshfischer@...che.org>)

October 24 (3 messages)

Warpinator remote file creation / overwrite security issue (CVE-2022-42725) (Matthias Gerstner <mgerstner@...e.de>)
Authorization bypass and symlink attack in multipathd (CVE-2022-41974 and CVE-2022-41973) (Qualys Security Advisory <qsa@...lys.com>)
CVE-2022-34870: Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application (Dan Smith <dasmith@...are.com>)

October 25 (6 messages)

ceph: ceph-crash.service allows local ceph user to root exploit (CVE-2022-3650) (Matthias Gerstner <mgerstner@...e.de>)
[CVE-2022-41704] Apache Batik information disclosure vulnerability ("Simon Steiner" <simonsteiner1984@...il.com>)
[CVE-2022-42890] Apache Batik information disclosure vulnerability ("Simon Steiner" <simonsteiner1984@...il.com>)
Forthcoming OpenSSL Releases ("Ing. Martin Koci, MBA" <mkoci@...nssl.org>)
android debug bridge (adb) reverse connection and directory traversal (Imre Rad <radimre83@...il.com>)
Forthcoming OpenSSL Bug Fix Release ("Ing. Martin Koci, MBA" <mkoci@...nssl.org>)

October 26 (8 messages)

[SECURITY ADVISORY] CVE-2022-32221: POST following PUT confusion (curl) (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] CVE-2022-35260: .netrc parser out-of-bounds access (curl) (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] CVE-2022-42915: HTTP proxy double-free (curl) (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] CVE-2022-42916: HSTS bypass via IDN (curl) (Daniel Stenberg <daniel@...x.se>)
CVE-2022-39944: The Apache Linkis JDBC EngineConn module has a RCE Vulnerability (peacewong <peacewong@...che.org>)
CVE-2022-43766: Apache IoTDB: ReDoS Vulnerability by REGEXP (Haonan Hou <haonan@...che.org>)
RE: Forthcoming OpenSSL Bug Fix Release (Matan Giladi <matangi@...ckpoint.com>)
Re: Forthcoming OpenSSL Releases (Shawn Webb <shawn.webb@...denedbsd.org>)

October 27 (3 messages)

Re: Forthcoming OpenSSL Bug Fix Release (Dr Paul Dale <pauli@...nssl.org>)
Re: Forthcoming OpenSSL Releases (Georgi Guninski <gguninski@...il.com>)
Re: CVE-2022-2602 - Linux kernel io_uring UAF (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)

October 28 (2 messages)

Re: Forthcoming OpenSSL Releases (Roxana Bradescu <roxabee@...omium.org>)
CVE-2022-26884: Apache DolphinScheduler exposes files without authentication (ShunFeng Cai <caishunfeng@...che.org>)

October 29 (4 messages)

CVE-2022-3628: A USB-accessible buffer overflow in Linux kernel driver (Dokyung Song <dokyungs@...sei.ac.kr>)
Re: Forthcoming OpenSSL Releases (Bob Beck <beck@...use.com>)
Re: CVE-2022-3628: A USB-accessible buffer overflow in Linux kernel driver (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: Forthcoming OpenSSL Releases (Demi Marie Obenour <demi@...isiblethingslab.com>)

October 30 (1 message)

Re: Forthcoming OpenSSL Releases (Christian Heinrich <christian.heinrich@...h.id.au>)

October 31 (5 messages)

Is third party javascript on a login page considered dangerous? (Georgi Guninski <gguninski@...il.com>)
OPEN SOURCE NTFS-3G SECURITY ADVISORY NTFS3G-SA-2022-0003 (Rakesh Pandit <rakesh@...era.com>)
Re: Is third party javascript on a login page considered dangerous? (Brandon Perry <bperry.volatile@...il.com>)
Re: Forthcoming OpenSSL Releases (Bob Beck <bbe@...omium.org>)
CVE-2022-42252: Apache Tomcat - Request Smuggling (Mark Thomas <markt@...che.org>)

70 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.