oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2023/07

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹	² 2
³ 1	⁴ 1	⁵ 3	⁶ 7	⁷ 4	⁸	⁹ 1
¹⁰ 3	¹¹ 11	¹² 3	¹³ 1	¹⁴ 2	¹⁵ 2	¹⁶
¹⁷	¹⁸	¹⁹ 9	²⁰ 3	²¹ 6	²²	²³
²⁴ 4	²⁵ 17	²⁶ 2	²⁷ 1	²⁸ 1	²⁹ 1	³⁰
³¹ 2

Messages by day:

July 2 (2 messages)

CVE-2023-3439: Linux MCTP use-after-free in mctp_sendmsg ("Lin Ma" <linma@....edu.cn>)
CVE-2023-35797: Apache Airflow Hive Provider Beeline RCE with Principal (Elad Kalif <eladkal@...che.org>)

July 3 (1 message)

Django: CVE-2023-36053: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator (Mariusz Felisiak <felisiak.mariusz@...il.c…)

July 4 (1 message)

CVE-2023-34150: Apache Any23: Possible excessive allocation of resources reading input. (Arnout Engelen <engelen@...che.org>)

July 5 (3 messages)

StackRot (CVE-2023-3269): Linux kernel privilege escalation vulnerability (Ruihan Li <lrh2000@....edu.cn>)
CVE-2023-31248 - Linux kernel nf_tables UAF when using nft_chain_lookup_byid (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)
CVE-2023-35001 - Linux kernel nf_tables nft_byteorder_eval OOB read/write (Thadeu Lima de Souza Cascardo <cascardo@...onical.com>)

July 6 (7 messages)

CVE-2023-33008: Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale ("Jean-Louis Monteiro" <jlmonteiro@...che.org>)
[kubernetes] CVE-2023-2727: Bypassing policies imposed by the ImagePolicyWebhook admission plugin (Rita Zhang <rita.z.zhang@...il.com>)
[kubernetes] CVE-2023-2728: Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin Rita … (Rita Zhang <rita.z.zhang@...il.com>)
CVE-2023-36460: mastodon: Arbitrary file creation through media attachments (Jan Schaumann <jschauma@...meister.org>)
CVE-2023-36459: mastodon: XSS through oEmbed preview cards (Jan Schaumann <jschauma@...meister.org>)
CVE-2023-28853: mastodon: Blind LDAP injection in login (Jan Schaumann <jschauma@...meister.org>)
CVE-2023-36461: mastodon: Denial of Service through slow HTTP responses (Jan Schaumann <jschauma@...meister.org>)

July 7 (4 messages)

manjaro pamac vulnerability (Tavis Ormandy <taviso@...il.com>)
CVE-2023-34442: Apache Camel JIRA: Temporary file information disclosure in Camel-Jira (Andrea Cosentino <ancosen@...il.com>)
CVE-2023-35887: Apache MINA SSHD: Information disclosure bugs with RootedFilesystem (Guillaume Nodet <gnodet@...che.org>)
Re: StackRot (CVE-2023-3269): Linux kernel privilege escalation vulnerability (Solar Designer <solar@...nwall.com>)

July 9 (1 message)

Re: manjaro pamac vulnerability (Barnabás Pőcze <pobrn@...tonmail.com>)

July 10 (3 messages)

CVE-2022-42009: Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the… (Brahma Reddy Battula <brahma@...che.org…)
CVE-2022-45855: Apache Ambari: Allows authenticated metrics consumers to perform RCE (Brahma Reddy Battula <brahma@...che.org>)
Re: CVE-2022-42009: Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of… (Brandon Perry <bperry.volatile@...il.co…)

July 11 (11 messages)

CVE-2023-35908: Apache Airflow: Access to DAGs without relevant permission (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2023-22887: Apache Airflow path traversal by authenticated user (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2022-46651: Apache Airflow: Security vulnerability on AirFlow Connections (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2023-36543: Apache Airflow: ReDoS via dags function (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2023-22888: Apache Airflow: Scheduler remote DoS (Ephraim Anierobi <ephraimanierobi@...che.org>)
Re: CVE-2022-42009: Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the … (Solar Designer <solar@...nwall.com>)
CVE-2023-30428: Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer (Dave Fisher <wave@...che.org>)
CVE-2023-30429: Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy (Dave Fisher <wave@...che.org>)
CVE-2023-31007: Apache Pulsar: Broker does not always disconnect client when authentication data expires (Dave Fisher <wave@...che.org>)
CVE-2023-37579: Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials (Dave Fisher <wave@...che.org>)
CVE-2023-32200: Apache Jena: Exposure of execution in script engine expressions. (Andy Seaborne <andy@...che.org>)

July 12 (3 messages)

CVE-2023-37582: Apache RocketMQ: Possible remote code execution when using the update configuration function (Rongtong Jin <jinrongtong@...che.org>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
CVE-2023-37415: Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user (Elad Kalif <eladkal@...che.org>)

July 13 (1 message)

Re: RCE in acme.sh < 3.0.6 (Jan Schaumann <jschauma@...meister.org>)

July 14 (2 messages)

Xen Security Notice 1 v1 - winpvdrvbuild.xenproject.org potentially compromised (Xen.org security team <security@....org>)
Re: Our learnings from 42 Linux kernel exploits, we are limiting io_uring (Solar Designer <solar@...nwall.com>)

July 15 (2 messages)

OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.org>)
CVE-2023-26512: Apache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted data (Xue Weiming <mikexue@...che.org>)

July 19 (9 messages)

curl: fopen race condition: CVE-2023-32001 (Daniel Stenberg <daniel@...x.se>)
Re: Our learnings from 42 Linux kernel exploits, we are limiting io_uring (Marcus Meissner <meissner@...e.de>)
CVE-2023-28754: ShardingSphere-Agent: Deserialization vulnerability in ShardingSphere Agent (Weijie Wu <wuweijie@...che.org>)
OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.org>)
Re: OpenSSL Security Advisory (Sandipan Roy <saroy@...hat.com>)
Re: OpenSSL Security Advisory (Jeffrey Walton <noloader@...il.com>)
Re: Our learnings from 42 Linux kernel exploits, we are limiting io_uring (Tamás Koczka <poprdi@...omium.org>)
Announce: OpenSSH 9.3p2 released (Damien Miller <djm@....openbsd.org>)
CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent (Qualys Security Advisory <qsa@...lys.com>)

July 20 (3 messages)

Re: CVE-2023-38408: Remote Code Execution in OpenSSH's forwarded ssh-agent (Ramon de C Valle <rcvalle@...e.com>)
Re: Announce: OpenSSH 9.3p2 released (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: Announce: OpenSSH 9.3p2 released (Sevan Janiyan <venture37@...klan.co.uk>)

July 21 (6 messages)

Re: Announce: OpenSSH 9.3p2 released (Matthew Fernandez <matthew.fernandez@...il.com>)
Re: Announce: OpenSSH 9.3p2 released (Marcus Meissner <meissner@...e.de>)
Re: Announce: OpenSSH 9.3p2 released (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: Announce: OpenSSH 9.3p2 released (Sevan Janiyan <venture37@...klan.co.uk>)
Re: Announce: OpenSSH 9.3p2 released (Qualys Security Advisory <qsa@...lys.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2023-0006 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

July 24 (4 messages)

CVE-2023-20593: A use-after-free in AMD Zen2 Processors (Tavis Ormandy <taviso@...il.com>)
Xen Security Advisory 433 v1 - x86/AMD: Zenbleed (Xen.org security team <security@....org>)
Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors (Marc Deslauriers <marc.deslauriers@...onical.com>)
CVE-2023-34478: Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used togethe… (Brian Demers <bdemers@...che.org>)

July 25 (17 messages)

Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors (Jonathan Gray <jsg@....id.au>)
CVE-2023-34189: Apache InLong: General user can delete and update process (Charles Zhang <dockerzhang@...che.org>)
CVE-2023-34434: Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param (Charles Zhang <dockerzhang@...che.org>)
CVE-2023-35088: Apache InLong: SQL injection in audit endpoint (Charles Zhang <dockerzhang@...che.org>)
Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors ("alice" <alice@...ya.dev>)
Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors (Solar Designer <solar@...nwall.com>)
Re: Our learnings from 42 Linux kernel exploits, we are limiting io_uring (Marcus Meissner <meissner@...e.de>)
CVE-2023-37895: Apache Jackrabbit RMI access can lead to RCE (Julian Reschke <reschke@...che.org>)
Re: Our learnings from 42 Linux kernel exploits, we are limiting io_uring (Solar Designer <solar@...nwall.com>)
CVE-2023-38435: Apache Felix Healthcheck Webconsole Plugin: XSS in healthcheck webconsole plugin (Carsten Ziegeler <cziegeler@...che.org>)
CVE-2023-38647: Apache Helix: Deserialization vulnerability in Helix workflow and REST (Junkai Xue <jxue@...che.org>)
Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors ("Eddie Chapman" <eddie@...k.net>)
Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors (Matthias Schmidt <oss-sec@...c.org>)
Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors (Lucas Rolff <lucas@...oding.com>)
Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors (Jeffrey Walton <noloader@...il.com>)
Re: CVE-2023-20593: A use-after-free in AMD Zen2 Processors ("alice" <alice@...ya.dev>)

July 26 (2 messages)

Xen Security Advisory 433 v2 (CVE-2023-20593) - x86/AMD: Zenbleed (Xen.org security team <security@....org>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)

July 27 (1 message)

CVE-2023-38633 in librsvg: Arbitrary file read when xinclude href has special characters (Alan Coopersmith <alan.coopersmith@...cle.com>)

July 28 (1 message)

Re: StackRot (CVE-2023-3269): Linux kernel privilege escalation vulnerability (Ruihan Li <lrh2000@....edu.cn>)

July 29 (1 message)

CVE-2023-36542: Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources (David Handermann <exceptionfactory@...che.org>)

July 31 (2 messages)

OpenSSL Security Advisory (Matt Caswell <matt@...nssl.org>)
Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed (Xen.org security team <security@....org>)

87 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.