CVE-2021-45115

django: Denial-of-service possibility in UserAttributeSimilarityValidator

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed

Vendors

Djangoproject Fedoraproject Redhat

Products

Django Fedora Satellite and 1 more

CVE-2021-44568

libsolv: heap-overflows in resolve_dependencies function

Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at src/solver.c (line 1940 & line 1995), which could cause a remote Denial of Service.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Opensuse Redhat

Products

Libsolv Satellite Satellite Capsule

CVE-2021-44420

django: potential bypass of an upstream access control based on URL paths

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

CVSS 3.1 · 7.3 High EPSS 2.4% KEV · Not listed

Vendors

Canonical Debian Djangoproject and 2 more

Products

Ubuntu Linux Debian Linux Django and 4 more

CVE-2021-42550

RCE from attacker with configuration edit priviledges through JNDI lookup

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

CVSS 3.1 · 6.6 Medium EPSS 4.8% KEV · Not listed

Vendors

Netapp Qos Redhat and 1 more

Products

Cloud Manager Service Level Manager Snap Creator Framework and 6 more

CVE-2021-3590

foreman: azure compute profile credential leak to authenticated users

A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat Theforeman

Products

Satellite Foreman

CVE-2021-3589

foreman_ansible: authenticated user can access host through job_template

An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.0 High EPSS 1.0% KEV · Not listed

Vendors

Redhat Theforeman

Products

Satellite Foreman Ansible

CVE-2021-3584

foreman: Authenticate remote code execution through Sendmail configuration

A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0.

CVSS 3.1 · 7.2 High EPSS 4.0% KEV · Not listed

Vendors

Redhat Theforeman

Products

Satellite Satellite Capsule Satellite Utils and 1 more

CVE-2021-3494

foreman: possible man-in-the-middle in smart_proxy realm_freeipa

A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Theforeman

Products

Satellite Satellite Capsule Foreman

CVE-2021-3414

satellite: granular permissions related to organizations with other permissions may lead to confidentiality and integrity breach

A flaw was found in satellite. When giving granular permission related to the organization, other permissions allowing a user to view and manage other organizations are also granted. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Satellite

CVE-2021-3413

Satellite: Azure compute resource secret_key leak to authenticated users

A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was identified which will expose Azure Resource Manager's secret key through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Theforeman

Products

Satellite Satellite Capsule Foreman Azurerm

CVE-2021-3200

libsolv: heap-based buffer overflow in testcase_read() in src/testcase.c

Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resultp, int *resultflagsp function at src/testcase.c: line 2334, which could cause a denial of service

CVSS 3.1 · 3.3 Low EPSS 1.3% KEV · Not listed

Vendors

Opensuse Oracle Redhat

Products

Libsolv Communications Cloud Native Core Policy Enterprise Linux and 2 more

CVE-2021-33938

libsolv: heap-based buffer overflow in prune_to_recommended() in src/policy.c

Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial of Service.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Opensuse Redhat

Products

Libsolv Enterprise Linux Satellite and 1 more

CVE-2021-33930

libsolv: heap-based buffer overflow in pool_installable_whatprovides() in src/repo.h

Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Opensuse Redhat

Products

Libsolv Enterprise Linux Satellite and 1 more

CVE-2021-33929

libsolv: heap-based buffer overflow in pool_disabled_solvable() in src/repo.h

Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Opensuse Redhat

Products

Libsolv Enterprise Linux Satellite and 1 more

CVE-2021-33928

libsolv: heap-based buffer overflow in pool_installable() in src/repo.h

Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Opensuse Redhat

Products

Libsolv Enterprise Linux Satellite and 1 more

CVE-2021-33571

django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed

Vendors

Djangoproject Fedoraproject Redhat

Products

Django Fedora Openstack and 2 more

CVE-2021-33503

python-urllib3: ReDoS in the parsing of authority part of URL

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed

Vendors

Fedoraproject Oracle Python and 1 more

Products

Fedora Enterprise Manager Ops Center Instantis Enterprisetrack and 7 more

CVE-2021-33203

django: Potential directory traversal via ``admindocs``

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.

CVSS 3.1 · 4.9 Medium EPSS 2.7% KEV · Not listed

Vendors

Djangoproject Fedoraproject Redhat

Products

Django Fedora Openstack and 2 more

CVE-2021-32740

Regular Expression Denial of Service in Addressable templates

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Addressable Project Fedoraproject Redhat

Products

Addressable Fedora Logging and 1 more

CVE-2021-31542

django: Potential directory-traversal via uploaded files

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed

Vendors

Debian Djangoproject Fedoraproject and 1 more

Products

Debian Linux Django Fedora and 3 more