Open Source Vulnerabilities

    Dashboard / Open Source Vulnerabilities

    CLSA-2023-1688678532
    Fix available
    Packages

    openssh-client, openssh-server, openssh-sftp-server, ssh, ssh-askpass-gnome

    Summary

    Fix CVE(s): CVE-2021-41617

    Published
    6 Jul 2023
    CLSA-2023-1688678407
    Fix available
    Packages

    ldap-utils, libldap-2.4-2, libldap-common, libldap2-dev, slapd, slapd-smbk5pwd

    Summary

    Fix CVE(s): CVE-2023-2953

    Published
    6 Jul 2023
    CLSA-2023-1688678245
    Fix available
    Packages

    libcap-dev, libcap2, libcap2-bin, libpam-cap

    Summary

    Fix CVE(s): CVE-2023-2603

    Published
    6 Jul 2023
    CLSA-2023-1688678110
    Fix available
    Packages

    cyrus-admin, cyrus-caldav, cyrus-clients, cyrus-common, cyrus-dev, cyrus-doc, cyrus-imapd, cyrus-murder, cyrus-nntpd, cyrus-pop3d, cyrus-replication, libcyrus-imap-perl

    Summary

    Fix CVE(s): CVE-2021-33582

    Published
    6 Jul 2023
    DEBIAN-CVE-2023-29824
    Fix available
    Packages

    scipy, scipy, scipy

    Summary

    Published
    6 Jul 2023
    GHSA-9hxf-ppjv-w6rq
    Fix available
    Packages

    io.grpc:grpc-protobuf, grpcio, grpc, io.grpc:grpc-protobuf, grpcio, grpc

    Summary

    gRPC connection termination issue

    Published
    6 Jul 2023
    GHSA-6628-q6j9-w8vg
    Fix available
    Packages

    io.grpc:grpc-protobuf, grpcio, grpc

    Summary

    gRPC Reachable Assertion issue

    Published
    6 Jul 2023
    GHSA-m9p2-j4hg-g373
    Fix available
    Packages

    org.apache.cassandra:cassandra-all, org.apache.cassandra:cassandra-all

    Summary

    Apache Cassandra: Privilege escalation when enabling FQL/Audit logs

    Published
    6 Jul 2023
    GHSA-2rx4-9f5h-9gjf
    Fix available
    Packages

    apache-airflow-providers-cncf-kubernetes

    Summary

    Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration

    Published
    6 Jul 2023
    GHSA-x3cq-8f32-5f63
    Fix available
    Packages

    org.apache.rocketmq:rocketmq-broker, org.apache.rocketmq:rocketmq-namesrv, org.apache.rocketmq:rocketmq-controller, org.apache.rocketmq:rocketmq-namesrv

    Summary

    Apache RocketMQ may have remote code execution vulnerability when using update configuration function

    Published
    6 Jul 2023
    PYSEC-2023-114
    Fix available
    Packages

    scipy

    Summary

    Published
    6 Jul 2023
    GHSA-w3wr-gmwf-r333
    Fix available
    Packages

    org.apache.inlong:manager-pojo

    Summary

    Apache InLong has Weak Password Requirements in Apache InLong

    Published
    6 Jul 2023
    GHSA-3p9p-59qf-mqwh
    Fix available
    Packages

    org.apache.inlong:manager-workflow

    Summary

    Apache InLong has Files or Directories Accessible to External Parties

    Published
    6 Jul 2023
    GHSA-757p-7hp5-pqmr
    Fix available
    Packages

    org.apache.inlong:manager-pojo, org.apache.inlong:manager-dao, org.apache.inlong:manager-web, org.apache.inlong:manager-service

    Summary

    Apache InLong Insufficient Session Expiration vulnerability

    Published
    6 Jul 2023
    GHSA-7mhc-76hf-3jp9
    Fix available
    Packages

    org.apache.inlong:manager-pojo, org.apache.inlong:manager-dao, org.apache.inlong:manager-service, org.apache.inlong:manager-test, org.apache.inlong:manager-web

    Summary

    Apache InLong Exposure of Resource to Wrong Sphere vulnerability

    Published
    6 Jul 2023
    GHSA-8rjh-3mhm-966q
    Fix available
    Packages

    org.apache.inlong:manager-service, org.apache.inlong:manager-web

    Summary

    Apache InLong Incorrect Permission Assignment for Critical Resource Vulnerability

    Published
    6 Jul 2023
    GHSA-c3rh-f2w5-fghm
    Fix available
    Packages

    org.apache.inlong:manager-pojo, org.apache.inlong:manager-common

    Summary

    Apache InLong Deserialization of Untrusted Data Vulnerability

    Published
    6 Jul 2023
    GHSA-cx6h-86xw-9x34
    Fix available
    Packages

    org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote

    Summary

    Apache Tomcat - Fix for CVE-2023-24998 was incomplete

    Published
    6 Jul 2023
    GHSA-f475-jgg3-3jwc
    Fix available
    Packages

    org.apache.inlong:manager-pojo, org.apache.inlong:manager-dao, org.apache.inlong:manager-service, org.apache.inlong:manager-test, org.apache.inlong:manager-web

    Summary

    Apache InLong Exposure of Resource to Wrong Sphere vulnerability

    Published
    6 Jul 2023
    GHSA-q5p5-xg93-2jqc
    Fix available
    Packages

    org.apache.inlong:manager-pojo, org.apache.inlong:manager-dao, org.apache.inlong:manager-service, org.apache.inlong:manager-web

    Summary

    Apache InLong Improper Privilege Management vulnerability

    Published
    6 Jul 2023
    GHSA-rf76-whgp-fp56
    Fix available
    Packages

    org.apache.inlong:manager-service

    Summary

    Apache InLong vulnerable to Incorrect Permission Assignment for Critical Resource

    Published
    6 Jul 2023
    GHSA-wx79-r3q8-fq9h
    Fix available
    Packages

    org.apache.inlong:manager-service, org.apache.inlong:manager-web

    Summary

    Apache InLong has Files or Directories Accessible to External Parties in Apache InLong

    Published
    6 Jul 2023
    GHSA-v93h-rwj8-78qh
    Fix available
    Packages

    org.apache.openmeetings:openmeetings-db

    Summary

    Apache OpenMeetings insufficient authorization vulnerability

    Published
    6 Jul 2023
    GHSA-89gw-cffj-mqg9
    Fix available
    Packages

    org.apache.ranger:ranger

    Summary

    Apache Ranger code execution vulnerability in policy expressions

    Published
    6 Jul 2023
    CLSA-2023-1688677908
    Fix available
    Packages

    binutils, binutils-aarch64-linux-gnu, binutils-alpha-linux-gnu, binutils-arm-linux-gnueabi, binutils-arm-linux-gnueabihf, binutils-common, binutils-dev, binutils-doc, binutils-for-build, binutils-for-host, binutils-hppa-linux-gnu, binutils-hppa64-linux-gnu, binutils-i686-gnu, binutils-i686-kfreebsd-gnu, binutils-i686-linux-gnu, binutils-ia64-linux-gnu, binutils-m68k-linux-gnu, binutils-mips-linux-gnu, binutils-mips64-linux-gnuabi64, binutils-mips64-linux-gnuabin32, binutils-mips64el-linux-gnuabi64, binutils-mips64el-linux-gnuabin32, binutils-mipsel-linux-gnu, binutils-mipsisa32r6-linux-gnu, binutils-mipsisa32r6el-linux-gnu, binutils-mipsisa64r6-linux-gnuabi64, binutils-mipsisa64r6-linux-gnuabin32, binutils-mipsisa64r6el-linux-gnuabi64, binutils-mipsisa64r6el-linux-gnuabin32, binutils-multiarch, binutils-multiarch-dev, binutils-powerpc-linux-gnu, binutils-powerpc-linux-gnuspe, binutils-powerpc64-linux-gnu, binutils-powerpc64le-linux-gnu, binutils-riscv64-linux-gnu, binutils-s390x-linux-gnu, binutils-sh4-linux-gnu, binutils-source, binutils-sparc64-linux-gnu, binutils-x86-64-kfreebsd-gnu, binutils-x86-64-linux-gnu, binutils-x86-64-linux-gnux32, libbinutils

    Summary

    Fix CVE(s): CVE-2021-45078

    Published
    6 Jul 2023
    CLSA-2023-1688677755
    Fix available
    Packages

    bind9, bind9-doc, bind9-host, bind9utils, dnsutils, libbind-dev, libbind-export-dev, libbind9-160, libdns-export1100, libdns1100, libirs-export160, libirs160, libisc-export169, libisc169, libisccc-export160, libisccc160, libisccfg-export160, libisccfg160, liblwres160

    Summary

    Fix CVE(s): CVE-2023-2828

    Published
    6 Jul 2023
    GHSA-wj7q-gjg8-3cpm
    Fix available
    Packages

    league/oauth2-server, league/oauth2-server

    Summary

    league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase

    Published
    6 Jul 2023
    CLSA-2023-1688677606
    Fix available
    Packages

    libcap-dev, libcap2, libcap2-bin, libpam-cap

    Summary

    Fix CVE(s): CVE-2023-2603

    Published
    6 Jul 2023
    GHSA-jqhc-m2j3-fjrx
    Fix available
    Packages

    sqlfluff

    Summary

    SQLFluff users with access to config file, using `libary_path` may call arbitrary python code

    Published
    6 Jul 2023
    CLSA-2023-1688677355
    Fix available
    Packages

    java-1.8.0-openjdk, java-1.8.0-openjdk-debug, java-1.8.0-openjdk-demo, java-1.8.0-openjdk-demo-debug, java-1.8.0-openjdk-devel, java-1.8.0-openjdk-devel-debug, java-1.8.0-openjdk-headless, java-1.8.0-openjdk-headless-debug, java-1.8.0-openjdk-javadoc, java-1.8.0-openjdk-javadoc-debug, java-1.8.0-openjdk-src, java-1.8.0-openjdk-src-debug

    Summary

    java-1.8.0-openjdk: Fix of 7 CVEs

    Published
    6 Jul 2023
    CLSA-2023-1688677210
    Fix available
    Packages

    tzdata, tzdata-java

    Summary

    Update of tzdata

    Published
    6 Jul 2023
    GHSA-6r5g-cq4q-327g
    Fix available
    Packages

    statamic/cms

    Summary

    Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG

    Published
    6 Jul 2023
    GHSA-2q4p-f6gf-mqr5
    Fix available
    Packages

    org.graylog2:graylog2-server

    Summary

    Graylog server has partial path traversal vulnerability in Support Bundle feature

    Published
    6 Jul 2023
    GHSA-g96c-x7rh-99r3
    Fix available
    Packages

    org.graylog2:graylog2-server, org.graylog2:graylog2-server

    Summary

    Graylog vulnerable to insecure source port usage for DNS queries

    Published
    6 Jul 2023
    CLSA-2023-1688676697
    Fix available
    Packages

    mysql, mysql-common, mysql-devel, mysql-errmsg, mysql-libs, mysql-server, mysql-test

    Summary

    mysql: Fix of 21 CVEs

    Published
    6 Jul 2023
    GHSA-3fqm-frhg-7c85
    Fix available
    Packages

    org.graylog2:graylog2-server, org.graylog2:graylog2-server

    Summary

    Graylog user session is still usable after logout

    Published
    6 Jul 2023
    CLSA-2023-1688676098
    Fix available
    Packages

    java-1.8.0-openjdk, java-1.8.0-openjdk-accessibility, java-1.8.0-openjdk-accessibility-fastdebug, java-1.8.0-openjdk-accessibility-slowdebug, java-1.8.0-openjdk-demo, java-1.8.0-openjdk-demo-fastdebug, java-1.8.0-openjdk-demo-slowdebug, java-1.8.0-openjdk-devel, java-1.8.0-openjdk-devel-fastdebug, java-1.8.0-openjdk-devel-slowdebug, java-1.8.0-openjdk-fastdebug, java-1.8.0-openjdk-headless, java-1.8.0-openjdk-headless-fastdebug, java-1.8.0-openjdk-headless-slowdebug, java-1.8.0-openjdk-javadoc, java-1.8.0-openjdk-javadoc-zip, java-1.8.0-openjdk-slowdebug, java-1.8.0-openjdk-src, java-1.8.0-openjdk-src-fastdebug, java-1.8.0-openjdk-src-slowdebug

    Summary

    java-1.8.0-openjdk: Fix of 7 CVEs

    Published
    6 Jul 2023
    GHSA-r25m-cr6v-p9hq
    Fix available
    Packages

    ethyca-fides

    Summary

    ethyca-fides Webserver API Path Traversal vulnerability

    Published
    6 Jul 2023
    USN-6208-1
    Fix available
    Packages

    golang-websocket, golang-websocket

    Summary

    golang-websocket vulnerability

    Published
    6 Jul 2023
    CLSA-2023-1688675879
    Fix available
    Packages

    tzdata, tzdata-java

    Summary

    Update of tzdata

    Published
    6 Jul 2023
    CLSA-2023-1688675103
    Fix available
    Packages

    git, git-all, git-core, git-core-doc, git-credential-libsecret, git-daemon, git-email, git-gui, git-instaweb, git-subtree, git-svn, gitk, gitweb, perl-Git, perl-Git-SVN

    Summary

    git: Fix of CVE-2023-25815

    Published
    6 Jul 2023
    CLSA-2023-1688674589
    Fix available
    Packages

    mysql, mysql-common, mysql-devel, mysql-errmsg, mysql-libs, mysql-server, mysql-test

    Summary

    mysql: Fix of 21 CVEs

    Published
    6 Jul 2023
    DEBIAN-CVE-2023-35934
    Fix available
    Packages

    youtube-dl, yt-dlp, yt-dlp, yt-dlp

    Summary

    Published
    6 Jul 2023
    CVE-2023-30195
    No fix available
    Packages

    Summary

    Published
    6 Jul 2023
    UBUNTU-CVE-2023-35934
    No fix available
    Packages

    yt-dlp, yt-dlp, yt-dlp, yt-dlp

    Summary

    Published
    6 Jul 2023
    GO-2023-1882
    Fix available
    Packages

    github.com/cometbft/cometbft

    Summary

    Deadlock in github.com/cometbft/cometbft/consensus

    Published
    6 Jul 2023
    GO-2023-1881
    No fix available
    Packages

    github.com/cosmos/cosmos-sdk

    Summary

    The x/crisis package does not charge ConstantFee in github.com/cosmos/cosmos-sdk

    Published
    6 Jul 2023
    CLSA-2023-1688674204
    Fix available
    Packages

    java-1.8.0-openjdk, java-1.8.0-openjdk-accessibility, java-1.8.0-openjdk-accessibility-fastdebug, java-1.8.0-openjdk-accessibility-slowdebug, java-1.8.0-openjdk-demo, java-1.8.0-openjdk-demo-fastdebug, java-1.8.0-openjdk-demo-slowdebug, java-1.8.0-openjdk-devel, java-1.8.0-openjdk-devel-fastdebug, java-1.8.0-openjdk-devel-slowdebug, java-1.8.0-openjdk-fastdebug, java-1.8.0-openjdk-headless, java-1.8.0-openjdk-headless-fastdebug, java-1.8.0-openjdk-headless-slowdebug, java-1.8.0-openjdk-javadoc, java-1.8.0-openjdk-javadoc-zip, java-1.8.0-openjdk-slowdebug, java-1.8.0-openjdk-src, java-1.8.0-openjdk-src-fastdebug, java-1.8.0-openjdk-src-slowdebug

    Summary

    java-1.8.0-openjdk: Fix of 7 CVEs

    Published
    6 Jul 2023
    CLSA-2023-1688673886
    Fix available
    Packages

    tzdata, tzdata-java

    Summary

    Update of tzdata

    Published
    6 Jul 2023
    CLSA-2023-1688673526
    Fix available
    Packages

    git, git-all, git-core, git-core-doc, git-credential-libsecret, git-daemon, git-email, git-gui, git-instaweb, git-subtree, git-svn, gitk, gitweb, perl-Git, perl-Git-SVN

    Summary

    git: Fix of CVE-2023-25815

    Published
    6 Jul 2023