oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2024/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
			¹ 3	² 10	³ 1	⁴ 2
⁵ 1	⁶ 13	⁷ 14	⁸ 10	⁹ 7	¹⁰	¹¹ 1
¹² 2	¹³	¹⁴ 8	¹⁵ 6	¹⁶ 8	¹⁷ 3	¹⁸ 1
¹⁹ 2	²⁰ 3	²¹ 3	²² 4	²³ 2	²⁴	²⁵ 1
²⁶ 1	²⁷	²⁸	²⁹	³⁰	³¹ 1

Messages by day:

August 1 (3 messages)

[vim-security] use-after-free in tagstack_clear_entry() in Vim < v9.1.0647 (Christian Brabandt <cb@...bit.org>)
[vim-security] double-free in dialog_changed() in Vim < v9.1.0648 (Christian Brabandt <cb@...bit.org>)
CPython CVE-2024-6923: Email header injection due to unquoted newlines (Alan Coopersmith <alan.coopersmith@...cle.com>)

August 2 (10 messages)

Neat VNC Security Vulnerability (Andri Yngvason <andri@...vason.is>)
Re: CPython CVE-2024-6923: Email header injection due to unquoted newlines (Hanno Böck <hanno@...eck.de>)
CVE-2024-27181: Apache Linkis Basic management services: Privilege Escalation Attack vulnerability (Heping Wang <peacewong@...che.org>)
CVE-2024-27182: Apache Linkis Basic management services: Engine material management Arbitrary file deletion vulnerability (Heping Wang <peacewong@...che.org>)
CVE-2024-36268: Apache InLong TubeMQ Client: Remote Code Execution vulnerability (Charles Zhang <dockerzhang@...che.org>)
Re: Neat VNC Security Vulnerability (Solar Designer <solar@...nwall.com>)
RE: Neat VNC Security Vulnerability (Dane Bouchie <dbouchie@...dimed.com>)
RE: Neat VNC Security Vulnerability (Dane Bouchie <dbouchie@...dimed.com>)
Re: Neat VNC Security Vulnerability (Solar Designer <solar@...nwall.com>)
Re: Neat VNC Security Vulnerability (Andri Yngvason <andri@...vason.is>)

August 3 (1 message)

Re: Neat VNC Security Vulnerability (Salvatore Bonaccorso <carnil@...ian.org>)

August 4 (2 messages)

CVE-2024-38856: Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code (Jacques Le Roux <jleroux@...che.org>)
CVE-2024-42447: Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow (Jarek Potiuk <potiuk@...che.org>)

August 5 (1 message)

CVE-2024-36448: Apache IoTDB Workbench: SSRF Vulnerability (EOL) (Haonan Hou <haonan@...che.org>)

August 6 (13 messages)

feedback requested regarding deprecation of TLS 1.0/1.1 (Neil Horman <nhorman@...nssl.org>)
Django CVE-2024-41989, CVE-2024-41990, CVE-2024-41991, and CVE-2024-42005 (Sarah Boyce <sarahboyce@...ngoproject.com>)
Tracking down a lost CVE request (MITRE) (Michael Orlitzky <michael@...itzky.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Marco Moock <mm@...fdsl.de>)
CVE-2024-42062: Apache CloudStack: User Key Exposure to Domain Admins (Rohit Yadav <rohit@...che.org>)
CVE-2024-42222: Apache CloudStack: Unauthorised Network List Access (Rohit Yadav <rohit@...che.org>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Stuart Henderson <stu@...cehopper.org>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Neil Horman <nhorman@...nssl.org>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Clemens Lang <cllang@...hat.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Marco Moock <mm@...fdsl.de>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Alex Gaynor <alex.gaynor@...il.com>)

August 7 (14 messages)

Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jan Engelhardt <jengelh@...i.de>)
Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Bob Friesenhahn <bobjfriesenhahn@...il.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Neil Horman <nhorman@...nssl.org>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Chad Sheridan <chadapsheridan@...il.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jeffrey Walton <noloader@...il.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Steffen Nurpmeso <steffen@...oden.eu>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Dan Kegel <dank@...el.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (niekt0 <niekt0@...eria.cz>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Solar Designer <solar@...nwall.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Pat Gunn <pgunn01@...il.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Marco Moock <mm@...fdsl.de>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Steffen Nurpmeso <steffen@...oden.eu>)

August 8 (10 messages)

Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jeffrey Walton <noloader@...il.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Duncan Grisby <duncan@...sby.org>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Clemens Lang <cllang@...hat.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Clemens Lang <cllang@...hat.com>)
KL-001-2024-005: Open WebUI Stored Cross-Site Scripting (KoreLogic Disclosures <disclosures@...elogic.com>)
KL-001-2024-006: Open WebUI Arbitrary File Upload + Path Traversal (KoreLogic Disclosures <disclosures@...elogic.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Steffen Nurpmeso <steffen@...oden.eu>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Steffen Nurpmeso <steffen@...oden.eu>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (steffen <steffen@...oden.eu>)

August 9 (7 messages)

Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jacob Bachmeyer <jcb62281@...il.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jens Timmerman <jens@...et.be>)
CVE-2024-41890: Apache Answer: The link to reset the user's password will remain valid after sending a new link (Enxin Xie <linkinstar@...che.org>)
CVE-2024-41888: Apache Answer: The link for resetting user password is not Single-Use (Enxin Xie <linkinstar@...che.org>)
CVE-2024-29831: Apache DolphinScheduler: RCE by arbitrary js execution (ShunFeng Cai <caishunfeng@...che.org>)
CVE-2024-30188: Apache DolphinScheduler: Resource File Read And Write Vulnerability (ShunFeng Cai <caishunfeng@...che.org>)

August 11 (1 message)

CVE-2024-7348: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (Solar Designer <solar@...nwall.com>)

August 12 (2 messages)

CVE-2024-42008 and more: XSS vulnerabilities in Roundcube webmail (Valtteri Vuorikoski <vuori@...com.org>)
CVE-2024-41909: Apache MINA SSHD: integrity check bypass (Arnout Engelen <engelen@...che.org>)

August 14 (8 messages)

Re: feedback requested regarding deprecation of TLS 1.0/1.1 ("Mike O'Connor" <mjo@...o.mi.org>)
Xen Security Advisory 460 v2 (CVE-2024-31145) - error handling in x86 IOMMU identity mapping (Xen.org security team <security@....org>)
Xen Security Advisory 461 v2 (CVE-2024-31146) - PCI device pass-through with shared resources (Xen.org security team <security@....org>)
CVE-2024-7347: nginx: ngx_http_mp4_module: Worker process crash by using a specially crafted mp4 file (Solar Designer <solar@...nwall.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Pat Gunn <pgunn01@...il.com>)
flatpak CVE-2024-42472: Access to files outside sandbox for apps using persistent= (--persist) (Simon McVittie <smcv@...labora.com>)
Re: Tracking down a lost CVE request (MITRE) (Mark Esler <mark.esler@...onical.com>)
Re: Tracking down a lost CVE request (MITRE) (Michael Orlitzky <michael@...itzky.com>)

August 15 (6 messages)

Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Hanno Böck <hanno@...eck.de>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jacob Bachmeyer <jcb62281@...il.com>)
Dovecot CVE-2024-23184: Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive (Aki Tuomi <aki.tuomi@...ecot.fi>)
Dovecot CVE-2024-23185: Very large headers can cause resource exhaustion when parsing message (Aki Tuomi <aki.tuomi@...ecot.fi>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Peter Gutmann <pgut001@...auckland.ac.nz>)
[vim-security] use-after-free in alist_add() in Vim < v9.1.0678 (Christian Brabandt <cb@...bit.org>)

August 16 (8 messages)

Re: collision confounders (was: feedback requested regarding deprecation of TLS 1.0/1.1) (Jacob Bachmeyer <jcb62281@...il.com>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jacob Bachmeyer <jcb62281@...il.com>)
Heads-up: there are two versions of Intel microcode update IPU 2024.3 (Samuel Verschelde <samuel.verschelde@...es.tech>)
Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jeffrey Walton <noloader@...il.com>)
[kubernetes] CVE-2024-7646: Ingress-nginx Annotation Validation Bypass (Craig Ingram <cjingram@...gle.com>)
Unbound 1.21.0 released with multiple security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
AI Cyber Challenge (AIxCC) semi-final results from DEF CON 32 (2024) ("David A. Wheeler" <dwheeler@...eeler.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2024-0004 (Adrian Perez de Castro <aperez@...lia.com>)

August 17 (3 messages)

Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jacob Bachmeyer <jcb62281@...il.com>)
Landlock Houdini fix: CVE-2024-42318 (Mickaël Salaün <mic@...ikod.net>)
Re: AI Cyber Challenge (AIxCC) semi-final results from DEF CON 32 (2024) (Alfredo Ortega <ortegaalfredo@...il.com>)

August 18 (1 message)

Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Peter Gutmann <pgut001@...auckland.ac.nz>)

August 19 (2 messages)

Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jacob Bachmeyer <jcb62281@...il.com>)
Re: AI Cyber Challenge (AIxCC) semi-final results from DEF CON 32 (2024) ("David A. Wheeler" <dwheeler@...eeler.com>)

August 20 (3 messages)

Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Steffen Nurpmeso <steffen@...oden.eu>)
CVE-2024-43202: Apache DolphinScheduler: Remote Code Execution Vulnerability (ShunFeng Cai <caishunfeng@...che.org>)
CVE-2024-22281: Apache Helix Front (UI): Helix front hard-coded secret in the express-session (Junkai Xue <jxue@...che.org>)

August 21 (3 messages)

Re: feedback requested regarding deprecation of TLS 1.0/1.1 (Jacob Bachmeyer <jcb62281@...il.com>)
CVE-2023-49198: Apache SeaTunnel Web: Arbitrary file read vulnerability (Jun Gao <gaojun2048@...che.org>)
CVE-2024-41937: Apache Airflow: Stored XSS Vulnerability on provider link (Ephraim Anierobi <ephraimanierobi@...che.org>)

August 22 (4 messages)

CPython: CVE-2024-8088: Infinite loop when iterating over zip archive entry names (Alan Coopersmith <alan.coopersmith@...cle.com>)
gh:facebook/rocksdb v9.5.2 - SupplyChainAttackPoC for Meta BB (Andreas Stieger <Andreas.Stieger@....de>)
[vim-security] heap-buffer-overflow in do_search() in Vim < 9.1.0689 (Christian Brabandt <cb@...bit.org>)
Re: CPython: CVE-2024-8088: Infinite loop when iterating over zip archive entry names (Fay Stegerman <flx@...usk.net>)

August 23 (2 messages)

Re: CPython: CVE-2024-8088: Infinite loop when iterating over zip archive entry names (Fay Stegerman <flx@...usk.net>)
Re: CPython: CVE-2024-8088: Infinite loop when iterating over zip archive entry names (Fay Stegerman <flx@...usk.net>)

August 25 (1 message)

[vim-security] heap-buffer-overflow in ins_typebuf() in Vim < 9.1.0697 (Christian Brabandt <cb@...bit.org>)

August 26 (1 message)

CVE-2023-49582: Apache Portable Runtime (APR): Unexpected lax shared memory permissions (Eric Covener <covener@...che.org>)

August 31 (1 message)

[vim-security] heap-buffer-overflow in Vim > 9.1.0038 && < 9.1.0707 (Christian Brabandt <cb@...bit.org>)

107 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.