oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2025/01

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹	²	³ 3	⁴	⁵ 2
⁶ 3	⁷ 1	⁸ 3	⁹	¹⁰	¹¹ 1	¹²
¹³ 1	¹⁴ 7	¹⁵ 2	¹⁶ 5	¹⁷ 1	¹⁸ 2	¹⁹
²⁰ 4	²¹ 10	²² 12	²³ 8	²⁴ 6	²⁵ 6	²⁶ 3
²⁷ 6	²⁸ 4	²⁹ 2	³⁰	³¹

Messages by day:

January 3 (3 messages)

Another fdroidserver AllowedAPKSigningKeys certificate pinning bypass (Fay Stegerman <flx@...usk.net>)
iTerm2 < 3.5.11 logs input/ouput to /tmp/framer.txt on remote host (Jan Schaumann <jschauma@...meister.org>)
Re: GStreamer 1.24.10 stable security bug-fix release (Alan Coopersmith <alan.coopersmith@...cle.com>)

January 5 (2 messages)

Re: Xen Security Advisory 466 v3 (CVE-2024-53241) - Xen hypercall page unsafe against speculative attacks (Jürgen Groß <jgross@...e.com>)
Re: Xen Security Advisory 466 v3 (CVE-2024-53241) - Xen hypercall page unsafe against speculative attacks (Solar Designer <solar@...nwall.com>)

January 6 (3 messages)

Linux: general protection fault in __vmx_vcpu_run with nested virtualization (Linfeng Sun <slf@....edu.cn>)
Re: Linux: general protection fault in __vmx_vcpu_run with nested virtualization (Greg KH <greg@...ah.com>)
Re: Linux: general protection fault in __vmx_vcpu_run with nested virtualization (Demi Marie Obenour <demi@...isiblethingslab.com>)

January 7 (1 message)

Re: Linux: general protection fault in __vmx_vcpu_run with nested virtualization (Solar Designer <solar@...nwall.com>)

January 8 (3 messages)

CVE-2024-54676: Apache OpenMeetings: Deserialisation of untrusted data in cluster mode (Maxim Solodovnik <solomax@...che.org>)
CVE-2024-45033: Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli (Elad Kalif <eladkal@...che.org>)
"/bin/sh: The Biggest Unix Security Loophole" paper from 1984 (Alan Coopersmith <alan.coopersmith@...cle.com>)

January 11 (1 message)

[vim-security] heap-buffer-overflow in Vim < 9.1.1003 (Christian Brabandt <cb@...bit.org>)

January 13 (1 message)

CVE-2025-22828: Apache CloudStack: Unauthorised access to annotations (Nux <nux@...che.org>)

January 14 (7 messages)

CVE-2024-45627: Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability (Heping Wang <peacewong@...che.org>)
CVE-2024-56374: Django: Potential denial-of-service vulnerability in IPv6 validation (Natalia Bidart <nataliabidart@...ngoproject.com>)
RSYNC: 6 vulnerabilities (Nick Tait <ntait@...hat.com>)
git: 2 vulnerabilities fixed (Johannes Schindelin <Johannes.Schindelin@....de>)
Fwd: Node.js security updates for all active release lines, January 2025 (Rafael Gonzaga <work@...aelgss.dev>)
Re: RSYNC: 6 vulnerabilities (Jan Schaumann <jschauma@...meister.org>)
Re: RSYNC: 6 vulnerabilities (Alan Coopersmith <alan.coopersmith@...cle.com>)

January 15 (2 messages)

pam-u2f: problematic PAM_IGNORE return values in pam_sm_authenticate() (CVE-2025-23013) (Matthias Gerstner <mgerstner@...e.de>)
Session (a fork of the Signal private messaging app) is sus (Soatok Dreamseeker <soatok.dhole@...il.com>)

January 16 (5 messages)

[kubernetes] CVE-2024-9042: Command Injection affecting Windows nodes via nodes/*/logs/query API ("Vellore Rajakumar, Sri Saran Balaji" <srajakum@...zon.com>)
Re: pam-u2f: problematic PAM_IGNORE return values in pam_sm_authenticate() (CVE-2025-23013) (Jacob Bachmeyer <jcb62281@...il.com>)
Re: pam-u2f: problematic PAM_IGNORE return values in pam_sm_authenticate() (CVE-2025-23013) (Matthias Gerstner <mgerstner@...e.de>)
Re: pam-u2f: problematic PAM_IGNORE return values in pam_sm_authenticate() (CVE-2025-23013) (Steffen Nurpmeso <steffen@...oden.eu>)
Re: Re: pam-u2f: problematic PAM_IGNORE return values in pam_sm_authenticate() (CVE-2025-23013) (Russ Allbery <eagle@...ie.org>)

January 17 (1 message)

Go 1.23.5 and Go 1.22.11 are released with 2 security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

January 18 (2 messages)

WriteFreely exposes database credentials though insecure file permissions (Fay Stegerman <flx@...usk.net>)
Re: git: 2 vulnerabilities fixed (Salvatore Bonaccorso <carnil@...ian.org>)

January 20 (4 messages)

fdroidserver AllowedAPKSigningKeys certificate pinning fundamentally unreliable (Fay Stegerman <flx@...usk.net>)
CVE-2024-13176: OpenSSL: Timing side-channel in ECDSA signature computation (Tomas Mraz <tomas@...nssl.org>)
CVE-2025-23184: Apache CXF: Denial of Service vulnerability with temporary files (Colm O hEigeartaigh <coheigea@...che.org>)
Subject: [vim-security] segmentation fault in win_line() in Vim < 9.1.1043 (Christian Brabandt <cb@...bit.org>)

January 21 (10 messages)

Re: Subject: [vim-security] segmentation fault in win_line() in Vim < 9.1.1043 (Eli Schwartz <eschwartz@...too.org>)
Re: Subject: [vim-security] segmentation fault in win_line() in Vim < 9.1.1043 (Christian Brabandt <cb@...bit.org>)
CVE-2024-45478: Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input (Velmurugan Periasamy <vel@...che.org>)
CVE-2024-45479: Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost (Velmurugan Periasamy <vel@...che.org>)
Node.js security updates: CVE-2025-23083, CVE-2025-23084, CVE-2025-23085 (Jan Schaumann <jschauma@...meister.org>)
Fwd: Node.js security updates for all active release lines, January 2025 (Rafael Gonzaga <work@...aelgss.dev>)
CVE-2025-23195: Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie (Viraj Jasani <vjasani@...che.org>)
CVE-2025-23196: Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition (Viraj Jasani <vjasani@...che.org>)
CVE-2024-51941: Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts (Viraj Jasani <vjasani@...che.org>)
CERT/CC VU#199397 - Insecure Implementation of Tunneling Protocols (GRE/IPIP/4in6/6in4) (Alan Coopersmith <alan.coopersmith@...cle.com>)

January 22 (12 messages)

AMD Microcode Signature Verification Vulnerability (Tavis Ormandy <taviso@...il.com>)
issue with stuck Mitre CVE requests (Matthias Gerstner <mgerstner@...e.de>)
Re: issue with stuck Mitre CVE requests (Greg KH <greg@...ah.com>)
CVE-2025-0395: Buffer overflow in the GNU C Library's assert() (Qualys Security Advisory <qsa@...lys.com>)
Open Virtual Network egress access control list bypass. (Mark Michelson <mmichels@...hat.com>)
Re: AMD Microcode Signature Verification Vulnerability (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: issue with stuck Mitre CVE requests (Johannes Segitz <jsegitz@...e.de>)
Re: issue with stuck Mitre CVE requests (Pedro Sampaio <psampaio@...hat.com>)
Re: AMD Microcode Signature Verification Vulnerability (Tavis Ormandy <taviso@...il.com>)
Multiple vulnerabilities in Jenkins plugins (Kevin Guerroudj <kguerroudj@...udbees.com>)
Re: Open Virtual Network egress access control list bypass. (Mark Michelson <mmichels@...hat.com>)
CVE-2024-53299: Apache Wicket: An attacker can intentionally trigger a memory leak (Pedro Henrique Oliveira dos Santos <pedro@...che.org>)

January 23 (8 messages)

Oracle January 2025 Critical Patch Update (Solar Designer <solar@...nwall.com>)
Re: CVE-2025-0395: Buffer overflow in the GNU C Library's assert() (Qualys Security Advisory <qsa@...lys.com>)
Re: issue with stuck Mitre CVE requests (Matthias Gerstner <mgerstner@...e.de>)
Re: Oracle January 2025 Critical Patch Update (John Haxby <john.haxby@...cle.com>)
Re: [External] : Fwd: Oracle January 2025 Critical Patch Update (Bruce Lowenthal <bruce.lowenthal@...cle.com>)
Re: Oracle January 2025 Critical Patch Update (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: issue with stuck Mitre CVE requests (Pete Allor <pallor@...hat.com>)
Re: [External] : Fwd: Oracle January 2025 Critical Patch Update (Solar Designer <solar@...nwall.com>)

January 24 (6 messages)

Re: Oracle January 2025 Critical Patch Update (Solar Designer <solar@...nwall.com>)
Re: Re: [External] : Fwd: Oracle January 2025 Critical Patch Update ("Douglas R. Reno" <renodr@...uxfromscratch.org>)
dde-api-proxy: Authentication Bypass in Deepin D-Bus Proxy Service (CVE-2025-23222) (Matthias Gerstner <mgerstner@...e.de>)
Re: [External] : Fwd: Oracle January 2025 Critical Patch Update (Bruce Lowenthal <bruce.lowenthal@...cle.com>)
Node.js EOL CVEs: CVE-2025-23087, CVE-2025-23088, CVE-2025-23089 (Alan Coopersmith <alan.coopersmith@...cle.com>)
7-Zip Mark-of-the-Web Bypass Vulnerability on Windows platforms (Alan Coopersmith <alan.coopersmith@...cle.com>)

January 25 (6 messages)

Re: issue with stuck Mitre CVE requests (Mark Esler <mark.esler@...onical.com>)
Re: Re: [External] : Fwd: Oracle January 2025 Critical Patch Update (Solar Designer <solar@...nwall.com>)
Re: Node.js EOL CVEs: CVE-2025-23087, CVE-2025-23088, CVE-2025-23089 (Greg KH <greg@...ah.com>)
Re: Node.js EOL CVEs: CVE-2025-23087, CVE-2025-23088, CVE-2025-23089 (Pete Allor <pallor@...hat.com>)
Re: Re: [External] : Fwd: Oracle January 2025 Critical Patch Update ("Douglas R. Reno" <renodr@...uxfromscratch.org>)
Re: Oracle January 2025 Critical Patch Update (Sam James <sam@...too.org>)

January 26 (3 messages)

CVE-2025-24814: Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files (Jason Gerlowski <gerlowskija@...che.org>)
CVE-2024-52012: Apache Solr: Configset upload on Windows allows arbitrary path write-access (Jason Gerlowski <gerlowskija@...che.org>)
Re: dde-api-proxy: Authentication Bypass in Deepin D-Bus Proxy Service (CVE-2025-23222) ("U.Mutlu" <um4711@...luit.com>)

January 27 (6 messages)

Re: Node.js EOL CVEs: CVE-2025-23087, CVE-2025-23088, CVE-2025-23089 (Florian Weimer <fweimer@...hat.com>)
Re: issue with stuck Mitre CVE requests (Johannes Segitz <jsegitz@...e.de>)
CVE-2025-24783: Apache Cocoon: continuations may not be private (Arnout Engelen <engelen@...che.org>)
Re: Re: [External] : Fwd: Oracle January 2025 Critical Patch Update (Bruce Lowenthal <bruce.lowenthal@...cle.com>)
Re: issue with stuck Mitre CVE requests (Pete Allor <pallor@...hat.com>)
Re: Node.js EOL CVEs: CVE-2025-23087, CVE-2025-23088, CVE-2025-23089 (Pete Allor <pallor@...hat.com>)

January 28 (4 messages)

Re: Node.js EOL CVEs: CVE-2025-23087, CVE-2025-23088, CVE-2025-23089 (Florian Weimer <fweimer@...hat.com>)
Re: Node.js EOL CVEs: CVE-2025-23087, CVE-2025-23088, CVE-2025-23089 (Pete Allor <pallor@...hat.com>)
CVE-2024-23953: Apache Hive: Timing Attack Against Signature in LLAP util (Ayush Saxena <ayushsaxena@...che.org>)
CVE-2024-29869: Apache Hive: Credentials file created with non restrictive permissions (Ayush Saxena <ayushsaxena@...che.org>)

January 29 (2 messages)

ISC has disclosed two vulnerabilities in BIND 9 (CVE-2024-11187, CVE-2024-12705) (Matthijs Mekking <matthijs@....org>)
Re: Oracle January 2025 Critical Patch Update (John Haxby <john.haxby@...cle.com>)

92 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.