oss-security mailing list - 2023/04

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2023/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	²
³	⁴ 1	⁵	⁶ 2	⁷ 3	⁸	⁹
¹⁰ 6	¹¹ 3	¹² 5	¹³ 5	¹⁴ 1	¹⁵ 3	¹⁶ 4
¹⁷ 4	¹⁸ 24	¹⁹ 13	²⁰ 22	²¹ 3	²²	²³
²⁴ 4	²⁵ 2	²⁶ 1	²⁷	²⁸	²⁹ 1	³⁰

Messages by day:

April 4 (1 message)

PowerDNS Security Advisory 2023-02: Deterred spoofing attempts can lead to authoritative servers being marked unavailab… (Otto Moerbeek <otto.moerbeek@...erdns.c…)

April 6 (2 messages)

[ADVISORY] CVE-2023-1668: Open vSwitch: Remote traffic denial of service via crafted packets with IP proto 0 (Ilya Maximets <i.maximets@....org>)
Re: [ADVISORY] CVE-2023-1668: Open vSwitch: Remote traffic denial of service via crafted packets with IP proto 0 (Ilya Maximets <i.maximets@....org>)

April 7 (3 messages)

CVE-2023-28707: Airflow Apache Drill Provider Arbitrary File Read Vulnerability (Jarek Potiuk <potiuk@...che.org>)
CVE-2023-28706: Apache Airflow Hive Provider Beeline Remote Command Execution (Jarek Potiuk <potiuk@...che.org>)
CVE-2023-28710: Apache Airflow Spark Provider Arbitrary File Read via JDBC (Jarek Potiuk <potiuk@...che.org>)

April 10 (6 messages)

CVE-2023-27602: Apache Linkis publicsercice module unrestricted upload of file (Heping Wang <peacewong@...che.org>)
CVE-2023-27603: Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue (Heping Wang <peacewong@...che.org>)
CVE-2023-27987: Apache Linkis gateway module token authentication bypass (Heping Wang <peacewong@...che.org>)
CVE-2023-29215: Apache Linkis JDBC EngineCon has a deserialization command execution (Heping Wang <peacewong@...che.org>)
CVE-2023-29216: Apache Linkis DatasourceManager module has a deserialization command execution (Heping Wang <peacewong@...che.org>)
CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability (Jacques Le Roux <jleroux@...che.org>)

April 11 (3 messages)

CVE-2017-11164 - stack exhaustion in PCRE (Sevan Janiyan <venture37@...klan.co.uk>)
CVE-2023-30465: Apache InLong: SQL injection in apache inLong 1.5.0 (Charles Zhang <dockerzhang@...che.org>)
CVE-2023-1281, CVE-2023-1829: Linux kernel: Vulnerabilities in the tcindex classifier (valis <sec@...is.email>)

April 12 (5 messages)

Re: CVE-2017-11164 - stack exhaustion in PCRE (Matthew Vernon <matthew@...ian.org>)
CVE-2022-45064: Apache Sling Engine: Include-based XSS (Angela Schreiber <angela@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Ghostscript CVE-2023-28879: "Shell in the Ghost" (Alan Coopersmith <alan.coopersmith@...cle.com>)
ncurses fixes upstream ("Jonathan Bar Or (JBO)" <jobaror@...rosoft.com>)

April 13 (5 messages)

Re: ncurses fixes upstream (Sam James <sam@...too.org>)
Re: ncurses fixes upstream ("alice" <alice@...ya.dev>)
Re: Multiple vulnerabilities in Jenkins plugins (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: ncurses fixes upstream (Mark Esler <mark.esler@...onical.com>)
Re: Multiple vulnerabilities in Jenkins plugins (Henri Salo <henri@...v.fi>)

April 14 (1 message)

Re: ncurses fixes upstream (Tavis Ormandy <taviso@...il.com>)

April 15 (3 messages)

Re: ncurses fixes upstream (Georgi Guninski <gguninski@...il.com>)
Re: ncurses fixes upstream (Solar Designer <solar@...nwall.com>)
CVE-2023-22946: Apache Spark proxy-user privilege escalation from malicious configuration class ("Sean R. Owen" <srowen@...che.org>)

April 16 (4 messages)

CVE-2023-30771: Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench (Jialin Qiao <qiaojialin@...che.org>)
CVE-2023-24831: Apache IoTDB grafana-connector Login Bypass Vulnerability (Jialin Qiao <qiaojialin@...che.org>)
CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Ruihan Li <lrh2000@....edu.cn>)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Steffen Nurpmeso <steffen@...oden.eu>)

April 17 (4 messages)

Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Jakub Wilk <jwilk@...lk.net>)
CVE-2023-25504: Apache Superset: Possible SSRF on import datasets (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2023-27525: Apache Superset: Incorrect default permissions for Gamma role (Daniel Gaspar <dpgaspar@...che.org>)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Steffen Nurpmeso <steffen@...oden.eu>)

April 18 (24 messages)

Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Solar Designer <solar@...nwall.com>)
Re: CVE-2023-28158: Apache Archiva privilege escalation (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE-2023-26269: Apache James server: Privilege escalation through unauthenticated JMX (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE-2023-27602: Apache Linkis publicsercice module unrestricted upload of file (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE-2022-45064: Apache Sling Engine: Include-based XSS (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE-2023-30771: Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE-2023-25504: Apache Superset: Possible SSRF on import datasets (Seth Arnold <seth.arnold@...onical.com>)
Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability (Jacques Le Roux <jleroux@...che.org>)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Ruihan Li <lrh2000@....edu.cn>)
Checking existence of firewalled web servers in Firefox via iframe.onload (Georgi Guninski <gguninski@...il.com>)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution ("Todd C. Miller" <Todd.Miller@...o.ws>)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Solar Designer <solar@...nwall.com>)
Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules (Stig Palmquist <stig@...g.io>)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (0xef967c36@...il.com)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Ruihan Li <lrh2000@....edu.cn>)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Ruihan Li <lrh2000@....edu.cn>)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution ("Todd C. Miller" <Todd.Miller@...o.ws>)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Solar Designer <solar@...nwall.com>)
Re: Checking existence of firewalled web servers in Firefox via iframe.onload (Jan Fader <oss-security@...erweb.de>)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (0xef967c36@...il.com)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Steffen Nurpmeso <steffen@...oden.eu>)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (0xef967c36@...il.com)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Steffen Nurpmeso <steffen@...oden.eu>)

April 19 (13 messages)

Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability (Seth Arnold <seth.arnold@...onical.com>)
CVE-2023-2124: OOB access in the Linux kernel's XFS subsystem (Kyle Zeng <yzeng56@....edu>)
Re: CVE-2023-27602: Apache Linkis publicsercice module unrestricted upload of file (peacewong <peacewong@...che.org>)
[kubernetes] CVE-2023-1174, CVE-2023-1944: Network port exposure and ssh access using default password ("Vellore Rajakumar, Sri Saran Balaji" <srajakum@...zon.…)
Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (nightmare.yeah27@...ecat.org)
Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability (Jacques Le Roux <jacques.le.roux@...7arts.com>)
Checking existence of firewalled URLs via javascript's script.onload (Georgi Guninski <gguninski@...il.com>)
Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: Checking existence of firewalled URLs via javascript's script.onload (Peter Philip Pettersson <philip.pettersson@...il.com>)
Re: ncurses fixes upstream (Carlos López <clopez@...e.de>)
RE: [EXTERNAL] Re: ncurses fixes upstream ("Jonathan Bar Or (JBO)" <jobaror@...rosoft.com>)
Re: ncurses fixes upstream (Solar Designer <solar@...nwall.com>)
Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules (Steffen Nurpmeso <steffen@...oden.eu>)

April 20 (22 messages)

Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules (Hanno Böck <hanno@...eck.de>)
Re: Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution (Steffen Nurpmeso <steffen@...oden.eu>)
Re: ncurses fixes upstream (Tavis Ormandy <taviso@...il.com>)
Re: Checking existence of firewalled URLs via javascript's script.onload (Georgi Guninski <gguninski@...il.com>)
Re: Checking existence of firewalled web servers in Firefox via iframe.onload (Stefano Di Paola <stefano.dipaola@...ec.it>)
Re: Checking existence of firewalled web servers in Firefox via iframe.onload (Jan Klopper <janklopper@...erheight.com>)
Re: Checking existence of firewalled URLs via javascript's script.onload (Jeremy Stanley <fungi@...goth.org>)
Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules (Steffen Nurpmeso <steffen@...oden.eu>)
Re: Checking existence of firewalled web servers in Firefox via iframe.onload (Stefano Di Paola <stefano.dipaola@...ec.it>)
CVE-2023-25601: Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication (Arnout Engelen <engelen@...che.org>)
Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules (Jeffrey Walton <noloader@...il.com>)
OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.org>)
CVE-2022-45801: Apache StreamPark (incubating): LDAP Injection Vulnerability (Huajie Wang <benjobs@...che.org>)
CVE-2022-45802: Apache StreamPark (incubating): Upload any file to any directory (Huajie Wang <benjobs@...che.org>)
CVE-2022-46365: Apache StreamPark (incubating): Logic error causing any account reset (Huajie Wang <benjobs@...che.org>)
PostgreSQL and CREATEROLE permission (Jeffrey Walton <noloader@...il.com>)
Re: PostgreSQL and CREATEROLE permission (Bernd Zeimetz <bernd@...d.de>)
Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules (Steffen Nurpmeso <steffen@...oden.eu>)
Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules (Steffen Nurpmeso <steffen@...oden.eu>)
Re: PostgreSQL and CREATEROLE permission (Jeffrey Walton <noloader@...il.com>)
Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules (Matthew Fernandez <matthew.fernandez@...il.com>)

April 21 (3 messages)

Re: ncurses fixes upstream (Sevan Janiyan <venture37@...klan.co.uk>)
Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules (Christian Heinrich <christian.heinrich@...h.id.au>)
WebKitGTK and WPE WebKit Security Advisory WSA-2023-0003 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

April 24 (4 messages)

Real world vulnerabilities of CWE-1077: Floating Point Comparison with Incorrect Operator? (Georgi Guninski <gguninski@...il.com>)
CVE-2023-27524: Apache Superset: Session validation vulnerability when using provided default SECRET_KEY (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2023-30776: Apache Superset: Database connection password leak (Daniel Gaspar <dpgaspar@...che.org>)
CVE-2023-22665: Apache Jena: Exposure of arbitrary execution in script engine expressions. (Andy Seaborne <andy@...che.org>)

April 25 (2 messages)

Xen Security Advisory 430 v2 (CVE-2022-42335) - x86 shadow paging arbitrary pointer dereference (Xen.org security team <security@....org>)
[ANNOUNCE] Git v2.40.1 and friends (Junio C Hamano <gitster@...ox.com>)

April 26 (1 message)

Warpinator: Remote file deletion vulnerability (CVE-2023-29380) (Matthias Gerstner <mgerstner@...e.de>)

April 29 (1 message)

Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules (Stig Palmquist <stig@...g.io>)

107 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.