Open Source Vulnerabilities

curl

Important: curl security update

nghttp2

Important: nghttp2 security update

dotnet7.0

Important: .NET 7.0 security update

dotnet6.0

Important: dotnet6.0 security update

nodejs

Important: nodejs security update

varnish

Important: varnish security update

nodejs, nodejs-nodemon, nodejs-packaging

Important: nodejs:16 security update

java-11-openjdk

Moderate: java-11-openjdk security and bug fix update

python3

Important: python3 security update

varnish, varnish-modules

Important: varnish security update

tomcat

Important: tomcat security update

libzip, php, php-pear, php-pecl-apcu, php-pecl-rrd, php-pecl-xdebug3, php-pecl-zip

Important: php:8.0 security update

grafana

Moderate: grafana security update

delve, golang, go-toolset

Important: go-toolset:rhel8 security update

redis

Updated redis package fixes a security vulnerability

github.com/gofiber/fiber/v2

CSRF token validation vulnerability in github.com/gofiber/fiber/v2

github.com/gofiber/fiber/v2

CSRF token reuse vulnerability in github.com/gofiber/fiber/v2

github.com/crewjam/saml

Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml

openssl

openssl vulnerabilities

Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem

mysql-5.7, mysql-5.7

mysql-5.7 vulnerability

Incorrect cipher key & IV length processing

poppler

Security update for poppler

xen, xen, xen

Security update for xen

xen, xen, xen

Security update for xen

xen, xen, xen

Security update for xen

Exposure of hashed user passwords via REST API in Nautobot

linux-starfive-6.2

linux-starfive-6.2 vulnerabilities

ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5, ruby2.5

Security update for ruby2.5

linux-gcp-5.15, linux-gkeop-5.15

linux-gcp-5.15, linux-gkeop-5.15 vulnerabilities

kernel-livepatch-SLE15-SP5-RT_Update_1

Security update for the Linux Kernel RT (Live Patch 1 for SLE 15 SP5)

linux-intel-iotg-5.15

linux-intel-iotg-5.15 vulnerabilities

lucene

Out-of-memory in IndexSearchFuzzer

WordPress WP ULike Plugin <= 4.6.8 is vulnerable to Cross Site Scripting (XSS)

xen, xen, xen, xen, xen, xen, xen, xen, xen

Security update for xen

ffmpeg, ffmpeg, ffmpeg

ffmpeg vulnerabilities

ring

ring vulnerabilities

kernel-livepatch-SLE15-SP4-RT_Update_7, kernel-livepatch-SLE15-SP5-RT_Update_0

Security update for the Linux Kernel RT (Live Patch 0 for SLE 15 SP5)

kernel-livepatch-SLE15-SP4-RT_Update_11, kernel-livepatch-SLE15-SP5-RT_Update_3

Security update for the Linux Kernel RT (Live Patch 3 for SLE 15 SP5)

kernel-livepatch-SLE15-SP4-RT_Update_13, kernel-livepatch-SLE15-SP5-RT_Update_5

Security update for the Linux Kernel RT (Live Patch 5 for SLE 15 SP5)

netty-tcnative, netty-tcnative, netty, netty-tcnative, netty-tcnative, netty-tcnative, netty-tcnative, netty-tcnative, netty-tcnative, netty-tcnative, netty-tcnative, netty, netty-tcnative, netty, netty-tcnative

Security update for netty, netty-tcnative

sofia-sip, sofia-sip, sofia-sip, sofia-sip

sofia-sip vulnerability

ethyca-fides

Fides JavaScript Injection Vulnerability in Privacy Center URL

ethyca-fides

Fides Information Disclosure Vulnerability in Config API Endpoint

ethyca-fides

Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload

encoded_id-rails

encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs

org.scala-sbt:sbt, org.scala-sbt:io_2.12, org.scala-sbt:io_2.13, org.scala-sbt:io_3

sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)

com.rabbitmq:amqp-client

RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack

parse-server, parse-server

Parse Server may crash when uploading file without extension

concrete5/concrete5

Concrete CMS Cross-site Scripting vulnerability