CVE-2020-25713

raptor2: malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common

A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed

Vendors

Debian Fedoraproject Librdf and 1 more

Products

Debian Linux Fedora Raptor Rdf Syntax Library and 1 more

CVE-2020-25660

ceph: CEPHX_V2 replay attack protection lost

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph service via a packet sniffer and perform actions allowed by the Ceph service. This issue is a reintroduction of CVE-2018-1128, affecting the msgr2 protocol. The msgr 2 protocol is used for all communication except older clients that do not support the msgr2 protocol. The msgr1 protocol is not affected. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Ceph Ceph Storage and 2 more

CVE-2020-25658

python-rsa: bleichenbacher timing oracle attack against RSA decryption

It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Fedoraproject Python-rsa Project Redhat

Products

Fedora Python-rsa Ceph Storage and 2 more

CVE-2020-25657

m2crypto: bleichenbacher timing attacks in the RSA decryption API

A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS#1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.9 Medium EPSS 1.8% KEV · Not listed

Vendors

Fedoraproject M2crypto Project Redhat

Products

Fedora M2crypto Enterprise Linux and 2 more

CVE-2020-25653

spice-vdagent: UNIX domain socket peer PID retrieved via SO_PEERCRED is subject to race condition

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2020-25652

spice-vdagent: possibility to exhaust file descriptors in vdagentd

A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in `/run/spice-vdagentd/spice-vdagent-sock`. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to the spice-vdagentd daemon, resulting in a denial of service. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and prior.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2020-25651

spice-vdagent: possible file transfer DoS and information leak via active_xfers hash map

A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate local user in the VM system. Active file transfers from other users could also be interrupted, resulting in a denial of service. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2020-25650

spice-vdagent: memory DoS via arbitrary entries in active_xfers hash table

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2020-25648

nss: TLS 1.3 CCS flood remote DoS Attack

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed

Vendors

Fedoraproject Mozilla Oracle and 1 more

Products

Fedora Network Security Services Communications Offline Mediation Controller and 4 more

CVE-2020-25647

grub2: Out-of-bounds write in grub_usb_device_initialize()

A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing sane values. If properly exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Grub2 Ontap Select Deploy Administration Utility and 9 more

CVE-2020-25632

grub2: Use-after-free in rmmod command

A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module is still loaded leading to a use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot protections. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.2 High EPSS 1.2% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp and 1 more

Products

Fedora Grub2 Ontap Select Deploy Administration Utility and 9 more

CVE-2020-25613

ruby: Potential HTTP request smuggling in WEBrick

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Fedoraproject Redhat Ruby-lang

Products

Fedora Enterprise Linux Rhel E4s and 4 more

CVE-2020-25275

dovecot: Denial of service via mail MIME parsing

Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed

Vendors

Debian Dovecot Fedoraproject and 1 more

Products

Debian Linux Dovecot Fedora and 1 more

CVE-2020-25219

libproxy: uncontrolled recursion via an infinite stream response leading to stack exhaustion

url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2020-25211

kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c

In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 1 more

Products

Debian Linux Fedora Linux Kernel and 6 more

CVE-2020-25097

squid: improper input validation may allow a trusted client to perform HTTP request smuggling

An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.

CVSS 3.1 · 8.6 High EPSS 7.3% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 2 more

Products

Debian Linux Fedora Cloud Manager and 3 more

CVE-2020-24606

squid: Improper input validation could result in a DoS

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.

CVSS 3.1 · 8.6 High EPSS 4.6% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 3 more

CVE-2020-24553

golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

CVSS 3.1 · 6.1 Medium EPSS 3.6% KEV · Not listed

Vendors

Fedoraproject Golang Opensuse and 2 more

Products

Fedora Go Leap and 3 more

CVE-2020-24386

dovecot: IMAP hibernation function allows mail access

An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).

CVSS 3.1 · 6.8 Medium EPSS 2.8% KEV · Not listed

Vendors

Debian Dovecot Fedoraproject and 1 more

Products

Debian Linux Dovecot Fedora and 1 more

CVE-2020-24332

trousers: tss user can be used to create or corrupt existing files, this could lead to DoS

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat Trustedcomputinggroup

Products

Fedora Enterprise Linux Trousers