oss-security mailing list - 2023/10

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2023/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹ 7
² 10	³ 16	⁴ 9	⁵ 14	⁶ 6	⁷ 1	⁸ 4
⁹ 3	¹⁰ 10	¹¹ 5	¹² 2	¹³ 11	¹⁴ 8	¹⁵ 3
¹⁶ 23	¹⁷ 5	¹⁸ 9	¹⁹ 13	²⁰ 11	²¹ 1	²² 6
²³ 2	²⁴ 2	²⁵ 5	²⁶ 2	²⁷ 5	²⁸ 2	²⁹ 1
³⁰ 1	³¹ 1

Messages by day:

October 1 (7 messages)

Re: Rust programs in distrbutions (Was: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx) (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: Haskell programs in distributions (was: Rust programs in distrbutions (Was: CVE-2023-5217: Heap buffer overflow in … (Erik Auerswald <auerswal@...x-ag.uni-kl…)
linux-distros list membership application - CIQ Rocky Linux Security Team (Solar Designer <solar@...nwall.com>)
Re: Exim4 MTA CVEs assigned from ZDI (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Re: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx (Ken Moffat <zarniwhoop@...world.com>)
"Linux Kernel security demistified" (Solar Designer <solar@...nwall.com>)
Re: Exim4 MTA CVEs assigned from ZDI (Heiko Schlittermann <hs@...marc.schlittermann.de>)

October 2 (10 messages)

Re: "Linux Kernel security demistified" (Jan Engelhardt <jengelh@...i.de>)
Re: "Linux Kernel security demistified" (Greg KH <greg@...ah.com>)
Re: Exim4 MTA CVEs assigned from ZDI (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Re: "Linux Kernel security demistified" (Loganaden Velvindron <loganaden@...il.com>)
Re: "Linux Kernel security demistified" (Greg KH <greg@...ah.com>)
Re: Rust programs in distrbutions (Was: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx) (Michael Orlitzky <michael@...itzky.com>)
Re: Exim4 MTA CVEs assigned from ZDI (Heiko Schlittermann <hs@...marc.schlittermann.de>)
[CVE-2023-42754] null pointer dereference in Linux kernel ipv4 stack (Kyle Zeng <zengyhkyle@...il.com>)
Re: [CVE-2023-42754] null pointer dereference in Linux kernel ipv4 stack (Solar Designer <solar@...nwall.com>)
Re: [CVE-2023-42754] null pointer dereference in Linux kernel ipv4 stack (Kyle Zeng <zengyhkyle@...il.com>)

October 3 (16 messages)

Fwd: X.Org Security Advisory: Issues in libX11 prior to 1.8.7 & libXpm prior to 3.5.17 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2023-4911: Local Privilege Escalation in the glibc's ld.so (Qualys Security Advisory <qsa@...lys.com>)
Re: CVE-2023-4911: Local Privilege Escalation in the glibc's ld.so (Solar Designer <solar@...nwall.com>)
CVE-2023-4806, CVE-2023-5156: glibc: potential use-after-free in getaddrinfo() (Solar Designer <solar@...nwall.com>)
Re: CVE-2023-4806, CVE-2023-5156: glibc: potential use-after-free in getaddrinfo() (Rodrigo Freire <rfreire@...hat.com>)
Re: CVE-2023-4806, CVE-2023-5156: glibc: potential use-after-free in getaddrinfo() (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
Re: administrative tasks (was: illumos (or at least danmcd) membership in the distros list) (Solar Designer <solar@...nwall.com>)
Re: CVE-2023-4806, CVE-2023-5156: glibc: potential use-after-free in getaddrinfo() (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Solar Designer <solar@...nwall.com>)
Re: Fwd: X.Org Security Advisory: Issues in libX11 prior to 1.8.7 & libXpm prior to 3.5.17 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Wuffs (was: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx) (Solar Designer <solar@...nwall.com>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Solar Designer <solar@...nwall.com>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Jeremy Stanley <fungi@...goth.org>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Jean Luc Picard <atari2600a@...il.com>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Solar Designer <solar@...nwall.com>)

October 4 (9 messages)

Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Jean Luc Picard <atari2600a@...il.com>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Solar Designer <solar@...nwall.com>)
Re: Xen Security Advisory 439 v1 (CVE-2023-20588) - x86/AMD: Divide speculative information leak (Solar Designer <solar@...nwall.com>)
CVE-2023-4692, CVE-2023-4693: grub2: OOB write, read via specially crafted NTFS filesystem (Solar Designer <solar@...nwall.com>)
Django: CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator (Natalia Bidart <nataliabidart@...il.com>)
Re: Exim4 MTA CVEs assigned from ZDI (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2023-4692, CVE-2023-4693: grub2: OOB write, read via specially crafted NTFS filesystem (Daniel Kiper <daniel.kiper@...cle.com>)
RE: Exim4 MTA CVEs assigned from ZDI ("zdi@...ndmicro.com" <zdi@...ndmicro.com>)

October 5 (14 messages)

Re: CVE-2023-4911: Local Privilege Escalation in the glibc's ld.so (Solar Designer <solar@...nwall.com>)
Re: Exim4 MTA CVEs assigned from ZDI (Fabian Keil <freebsd-listen@...iankeil.de>)
Re: "Linux Kernel security demistified" (Willy Tarreau <w@....eu>)
Cadence: Fixed /tmp path issues; no longer maintained by upstream (CVE-2023-43782, CVE-2023-43783) (Matthias Gerstner <mgerstner@...e.de>)
Re: Exim4 MTA CVEs assigned from ZDI (Heiko Schlittermann <hs@...marc.schlittermann.de>)
There is a curl "severity HIGH security problem" pre-announcement on GitHub (Erik Auerswald <auerswal@...x-ag.uni-kl.de>)
Re: There is a curl "severity HIGH security problem" pre-announcement on GitHub (Shawn Webb <shawn.webb@...denedbsd.org>)
European Union Cyber Resilience Act (CRA) ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: European Union Cyber Resilience Act (CRA) (Katherine Mcmillan <kmcmi046@...tawa.ca>)
Re: Exim4 MTA CVEs assigned from ZDI (Solar Designer <solar@...nwall.com>)
Re: There is a curl "severity HIGH security problem" pre-announcement on GitHub (Fabian Keil <freebsd-listen@...iankeil.de>)
RE: Exim4 MTA CVEs assigned from ZDI ("zdi@...ndmicro.com" <zdi@...ndmicro.com>)
Re: Exim4 MTA CVEs assigned from ZDI (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Exim4 MTA CVEs assigned from ZDI (Cory McIntire <cory.mcintire@...pros.com>)

October 6 (6 messages)

Re: "Linux Kernel security demistified" (Jean Luc Picard <atari2600a@...il.com>)
Meltdown-US / Meltdown 3a Remaining Leakage (Daniel Weber <daniel.weber@...pa.de>)
Re: "Linux Kernel security demistified" (Solar Designer <solar@...nwall.com>)
CVEs assigned for reachable assertions in avahi (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2023-45322: Use-after-free in libxml2 through 2.11.5 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Meltdown-US / Meltdown 3a Remaining Leakage (Solar Designer <solar@...nwall.com>)

October 7 (1 message)

How can I join the linux-distros mailing list and become a representative? (public1020 <public1020@...ton.me>)

October 8 (4 messages)

Re: European Union Cyber Resilience Act (CRA) (Fabian Keil <freebsd-listen@...iankeil.de>)
Re: Meltdown-US / Meltdown 3a Remaining Leakage (Michael Schwarz <michael.schwarz@...pa.de>)
Re: European Union Cyber Resilience Act (CRA) (Jean Luc Picard <atari2600a@...il.com>)
Re: European Union Cyber Resilience Act (CRA) (Solar Designer <solar@...nwall.com>)

October 9 (3 messages)

Re: European Union Cyber Resilience Act (CRA) (Dirk-Willem van Gulik <dirkx@...weaving.org>)
Re: How can I join the linux-distros mailing list and become a representative? (Solar Designer <solar@...nwall.com>)
CVE-2023-43641: out-of-bounds array access in libcue 2.2.1 (Kevin Backhouse <kevinbackhouse@...hub.com>)

October 10 (10 messages)

Xen Security Advisory 440 v3 (CVE-2023-34323) - xenstored: A transaction conflict can crash C Xenstored (Xen.org security team <security@....org>)
Xen Security Advisory 441 v4 (CVE-2023-34324) - Possible deadlock in Linux kernel event handling (Xen.org security team <security@....org>)
Xen Security Advisory 442 v2 (CVE-2023-34326) - x86/AMD: missing IOMMU TLB flushing (Xen.org security team <security@....org>)
Xen Security Advisory 444 v3 (CVE-2023-34327,CVE-2023-34328) - x86/AMD: Debug Mask handling (Xen.org security team <security@....org>)
Xen Security Advisory 443 v3 (CVE-2023-34325) - Multiple vulnerabilities in libfsimage disk handling (Xen.org security team <security@....org>)
CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations (Moritz Muehlenhoff <jmm@...til.org>)
CVE-2023-42794: Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (Mark Thomas <markt@...che.org>)
CVE-2023-42795: Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests (Mark Thomas <markt@...che.org>)
CVE-2023-45648: Apache Tomcat: Trailer header parsing too lenient (Mark Thomas <markt@...che.org>)

October 11 (5 messages)

[SECURITY ADVISORY] curl: CVE-2023-38545: SOCKS5 heap buffer overflow (Daniel Stenberg <daniel@...x.se>)
[SECURITY ADVISORY] curl: CVE-2023-38546 (Daniel Stenberg <daniel@...x.se>)
Squid Caching Proxy Security Audit: 55 Vulnerabilities, 35 0days. (Joshua Rogers <megamansec@...il.com>)
CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication (Andor Molnar <andor@...che.org>)
Re: linux-distros list membership application - CIQ Rocky Linux Security Team (Solar Designer <solar@...nwall.com>)

October 12 (2 messages)

Fwd: Node.js security updates for all active release lines, October 2023 (midawson <midawson@...hat.com>)
Re: linux-distros list membership application - CIQ Rocky Linux Security Team (Vegard Nossum <vegard.nossum@...cle.com>)

October 13 (11 messages)

Re: Squid Caching Proxy Security Audit: 55 Vulnerabilities, 35 0days. (Amos Jeffries <squid3@...enet.co.nz>)
NATS: 2023-01: Adding accounts for just the system account adds auth bypass (Phil Pennock <oss-security-phil@...dhuis.org>)
Re: linux-distros list membership application - CIQ Rocky Linux Security Team (Neal Gompa <ngompa13@...il.com>)
Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations (Jonathan Wright <jonathan@...alinux.org>)
CVE-2023-42780: Apache Airflow: Improper access control vulnerability in the "List dag warnings" feature (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2023-45348: Apache Airflow: Configuration information leakage vulnerability (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2023-42792: Apache Airflow: Improper access control to DAG resources (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2023-42663: Apache Airflow: Bypass permission verification to view task instances of other dags (Ephraim Anierobi <ephraimanierobi@...che.org>)
Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations (Steffen Nurpmeso <steffen@...oden.eu>)
Re: Squid Caching Proxy Security Audit: 55 Vulnerabilities, 35 0days. (Joshua Rogers <megamansec@...il.com>)
Re: linux-distros list membership application - CIQ Rocky Linux Security Team (Martin Hecht <martin.hecht@...s.de>)

October 14 (8 messages)

Samba 4.19.1, 4.18.8 and 4.17.12 Security Releases are available for Download (Alan Coopersmith <alan.coopersmith@...cle.com>)
sandboxing,of upstream programs by distros (Matthew Fernandez <matthew.fernandez@...il.com>)
Re: linux-distros list membership application - CIQ Rocky Linux Security Team (Neal Gompa <ngompa13@...il.com>)
Re: linux-distros list membership application - CIQ Rocky Linux Security Team (Jeremy Stanley <fungi@...goth.org>)
Re: linux-distros list membership application - CIQ Rocky Linux Security Team (Solar Designer <solar@...nwall.com>)
Re: linux-distros list membership application - CIQ Rocky Linux Security Team (Solar Designer <solar@...nwall.com>)
Re: sandboxing,of upstream programs by distros (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: sandboxing,of upstream programs by distros (Matthew Fernandez <matthew.fernandez@...il.com>)

October 15 (3 messages)

CVE-2023-5178: Linux NVMe-oF/TCP Driver - UAF in `nvmet_tcp_free_crypto` (Alon Zahavi <zahavi.alon@...il.com>)
New Exim security release 4.96.2 (was: Exim4 MTA CVEs assigned from ZDI) (Heiko Schlittermann <hs@...marc.schlittermann.de>)
Re: distros list archive (Solar Designer <solar@...nwall.com>)

October 16 (23 messages)

linux-distros membership application of openEuler (Aron Xu <happyaron.xu@...il.com>)
CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module (Solar Designer <solar@...nwall.com>)
CVE-2023-43666: Apache InLong: General user Unauthorized access User Management (Charles Zhang <dockerzhang@...che.org>)
CVE-2023-43667: Apache InLong: Log Injection in Global functions (Charles Zhang <dockerzhang@...che.org>)
CVE-2023-43668: Apache InLong: Jdbc Connection Security Bypass in InLong (Charles Zhang <dockerzhang@...che.org>)
Re: linux-distros membership application of openEuler (Marcus Meissner <meissner@...e.de>)
Re: linux-distros membership application of openEuler (Greg KH <greg@...ah.com>)
CVE-2023-45757: Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability (Wang Weibing <wwbmmm@...che.org>)
Re: linux-distros membership application of openEuler (Heiko Schlittermann <hs@...littermann.de>)
Re: linux-distros membership application of openEuler (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: linux-distros membership application of openEuler (Greg KH <greg@...ah.com>)
Re: linux-distros membership application of openEuler (Greg KH <greg@...ah.com>)
Re: linux-distros membership application of openEuler (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: linux-distros membership application of openEuler (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: linux-distros membership application of openEuler (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: linux-distros membership application of openEuler (Aron Xu <happyaron.xu@...il.com>)
Re: linux-distros membership application of openEuler (Greg KH <greg@...ah.com>)
Re: linux-distros membership application of openEuler (Igor Seletskiy <i@...udlinux.com>)
Re: linux-distros membership application of openEuler (Aron Xu <happyaron.xu@...il.com>)
Re: linux-distros membership application of openEuler (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: linux-distros membership application of openEuler (Tianyu Chen <billchenchina2001@...il.com>)
Re: linux-distros membership application of openEuler (Steffen Nurpmeso <steffen@...oden.eu>)

October 17 (5 messages)

with firefox on X11, any page can pastejack you anytime (turistu <turistu@...il.com>)
Re: linux-distros list membership application - CIQ Rocky Linux Security Team (Morten Linderud <foxboron@...hlinux.org>)
Re: linux-distros membership application of openEuler ("W. Wadepohl" <w.wadepohl@...teo.de>)
Re: linux-distros list membership application - CIQ Rocky Linux Security Team (Solar Designer <solar@...nwall.com>)
upcoming release of OpenSSL 3.1.4 and 3.0.12 (Solar Designer <solar@...nwall.com>)

October 18 (9 messages)

Re: upcoming release of OpenSSL 3.1.4 and 3.0.12 (Matt Caswell <matt@...nssl.org>)
Re: upcoming release of OpenSSL 3.1.4 and 3.0.12 (Solar Designer <solar@...nwall.com>)
Re: with firefox on X11, any page can pastejack you anytime (Michael Orlitzky <michael@...itzky.com>)
Vulnerability in Jenkins (Daniel Beck <ml@...kweb.net>)
Re: with firefox on X11, any page can pastejack you anytime (Grant Taylor <gtaylor@...tconsulting.net>)
Re: with firefox on X11, any page can pastejack you anytime (Michael Orlitzky <michael@...itzky.com>)
Re: with firefox on X11, any page can pastejack you anytime (Grant Taylor <gtaylor@...tconsulting.net>)
Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: with firefox on X11, any page can pastejack you anytime (Michael Orlitzky <michael@...itzky.com>)

October 19 (13 messages)

Re: with firefox on X11, any page can pastejack you anytime (Jan Engelhardt <jengelh@...i.de>)
CVE-2023-46227: Apache inlong has an Arbitrary File Read Vulnerability (Charles Zhang <dockerzhang@...che.org>)
CVE-2023-25753: Server-Side Request Forgery in Apache ShenYu (Zhang Yonglun <zhangyonglun@...che.org>)
CVE-2023-31122: Apache HTTP Server: mod_macro buffer over-read (Stefan Eissing <icing@...che.org>)
CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0 (Stefan Eissing <icing@...che.org>)
CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST (Stefan Eissing <icing@...che.org>)
Re: with firefox on X11, any page can pastejack you anytime (Sam Bull <9m199i@...bull.org>)
Re: with firefox on X11, any page can pastejack you anytime (Steffen Nurpmeso <steffen@...oden.eu>)
Re: with firefox on X11, any page can pastejack you anytime (Jeremy Stanley <fungi@...goth.org>)
Re: with firefox on X11, any page can pastejack you anytime (Sam Bull <9m199i@...bull.org>)
Re: with firefox on X11, any page can pastejack you anytime (niekt0 <niekt0@...eria.cz>)
Re: with firefox on X11, any page can pastejack you anytime (Jeffrey Walton <noloader@...il.com>)
Re: with firefox on X11, any page can pastejack you anytime (Turistu <turistu@...il.com>)

October 20 (11 messages)

Re: with firefox on X11, any page can pastejack you anytime (Turistu <turistu@...il.com>)
Re: with firefox on X11, any page can pastejack you anytime (David Leadbeater <dgl@....cx>)
Re: with firefox on X11, any page can pastejack you anytime (Donald Buczek <buczek@...gen.mpg.de>)
Re: with firefox on X11, any page can pastejack you anytime (David Leadbeater <dgl@....cx>)
CVE-2023-44483: Apache Santuario: Private Key disclosure in debug-log output (Colm O hEigeartaigh <coheigea@...che.org>)
Re: with firefox on X11, any page can pastejack you anytime (Solar Designer <solar@...nwall.com>)
Re: with firefox on X11, any page can pastejack you anytime (Turistu <turistu@...il.com>)
Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2023-45853: overflows in MiniZip in zlib through 1.3 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: with firefox on X11, any page can pastejack you anytime (nightmare.yeah27@...ecat.org)
Re: Re: with firefox on X11, any page can pastejack you anytime (Steffen Nurpmeso <steffen@...oden.eu>)

October 21 (1 message)

Re: Squid Caching Proxy Security Audit: 55 Vulnerabilities, 35 0days. (Joshua Rogers <megamansec@...il.com>)

October 22 (6 messages)

Re: sandboxing,of upstream programs by distros (Solar Designer <solar@...nwall.com>)
Re: sandboxing,of upstream programs by distros (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: sandboxing,of upstream programs by distros (Mickaël Salaün <mic@...ikod.net>)
Re: sandboxing,of upstream programs by distros (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)
Re: sandboxing,of upstream programs by distros (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: sandboxing,of upstream programs by distros (Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>)

October 23 (2 messages)

Re: sandboxing,of upstream programs by distros (Matthew Fernandez <matthew.fernandez@...il.com>)
CVE-2023-46288: Apache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is set (Jarek Potiuk <potiuk@...che.org>)

October 24 (2 messages)

OpenSSL Security Advisory (OpenSSL <openssl@...nssl.org>)
Re: with firefox on X11, any page can pastejack you anytime (Martin Hecht <martin.hecht@...s.de>)

October 25 (5 messages)

FW: X.Org Security Advisory: Issues in X.Org X server prior to 21.1.9 and Xwayland prior to 23.2.2 (Peter Hutterer <peter.hutterer@...-t.net>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
[kubernetes] CVE-2023-5044: Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation (CJ Cullen <cjcullen@...gle.com>)
[kubernetes] CVE-2023-5043: Ingress nginx annotation injection causes arbitrary command execution (CJ Cullen <cjcullen@...gle.com>)
[kubernetes] CVE-2022-4886: Ingress-nginx `path` sanitization can be bypassed with `log_format` directive (CJ Cullen <cjcullen@...gle.com>)

October 26 (2 messages)

[vim-security] integer overflow in :history command in Vim < 9.0.2068 (Christian Brabandt <cb@...bit.org>)
Re: with firefox on X11, any page can pastejack you anytime (Turistu <turistu@...il.com>)

October 27 (5 messages)

CVE-2023-34058 - SAML Token Signature Bypass in open-vm-tools (VMware Security Response Center <security@...are.com>)
CVE-2023-34059 - File Descriptor Hijack vulnerability in open-vm-tools (VMware Security Response Center <security@...are.com>)
Re: CVE-2023-34059 - File Descriptor Hijack vulnerability in open-vm-tools (Matthias Gerstner <mgerstner@...e.de>)
Security issues in passim local caching server (Matthias Gerstner <mgerstner@...e.de>)
CVE-2023-46604: Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to b… ("Christopher L. Shannon" <cshannon@...c…)

October 28 (2 messages)

CVE-2023-46215: Apache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, r… (Elad Kalif <eladkal@...che.org>)
Re: NATS: 2023-01: Adding accounts for just the system account adds auth bypass (Salvatore Bonaccorso <carnil@...ian.org>)

October 29 (1 message)

Re: NATS: 2023-01: Adding accounts for just the system account adds auth bypass (Phil Pennock <oss-security-phil@...dhuis.org>)

October 30 (1 message)

Re: NATS: 2023-01: Adding accounts for just the system account adds auth bypass (Phil Pennock <oss-security-phil@...dhuis.org>)

October 31 (1 message)

NATS: 2023-02: nkeys: xkeys Seal encryption used fixed key for all encryption (Byron Ruth <byron@...adia.com>)

198 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.