CVE-2021-22890

curl: TLS 1.3 session ticket mix-up with HTTPS proxy host

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

CVSS 3.1 · 4.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Broadcom Debian Fedoraproject and 6 more

Products

Fabric Operating System Debian Linux Fedora and 9 more

CVE-2021-22876

curl: Leak of authentication credentials in URL via automatic Referer

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

CVSS 3.1 · 5.3 Medium EPSS 5.3% KEV · Not listed

Vendors

Broadcom Debian Fedoraproject and 6 more

Products

Fabric Operating System Debian Linux Fedora and 12 more

CVE-2021-20305

nettle: Out of bounds memory access in signature verification

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 2 more

Products

Debian Linux Fedora Active Iq Unified Manager and 7 more

CVE-2021-3999

glibc: Off-by-one buffer overflow/underflow in getcwd()

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Gnu Netapp and 1 more

Products

Debian Linux Glibc E-series Performance Analyzer and 13 more

CVE-2021-3759

kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks

A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux

CVE-2021-3580

nettle: Remote crash in RSA decryption via manipulated ciphertext

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Debian Netapp Nettle Project and 1 more

Products

Debian Linux Ontap Select Deploy Administration Utility Nettle and 1 more

CVE-2021-3537

libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.9 Medium EPSS 3.6% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 3 more

Products

Debian Linux Fedora Active Iq Unified Manager and 18 more

CVE-2021-3518

libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

CVSS 3.1 · 8.8 High EPSS 21.9% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 3 more

Products

Debian Linux Fedora Active Iq Unified Manager and 17 more

CVE-2021-3517

libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

CVSS 3.1 · 8.6 High EPSS 17.0% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 3 more

Products

Debian Linux Fedora Active Iq Unified Manager and 27 more

CVE-2021-3516

libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 3 more

Products

Debian Linux Fedora Clustered Data Ontap and 7 more

CVE-2021-3426

python: Information disclosure via pydoc

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.

CVSS 3.1 · 5.7 Medium EPSS 1.9% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 3 more

Products

Debian Linux Fedora Cloud Backup and 8 more

CVE-2021-3326

glibc: Assertion failure in ISO-2022-JP-3 gconv module related to combining characters

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Debian Fujitsu Gnu and 3 more

Products

Debian Linux M10-1 M10-1 Firmware and 15 more

CVE-2021-3177

python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

CVSS 3.1 · 9.8 Critical EPSS 24.0% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 3 more

Products

Debian Linux Fedora Active Iq Unified Manager and 9 more

CVE-2020-36230

openldap: Assertion failure in ber_next_element in decode.c

A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 12.1% KEV · Not listed

Vendors

Apache Apple Debian and 1 more

Products

Bookkeeper Mac Os X Macos and 2 more

CVE-2020-36229

openldap: Type confusion in ad_keystring in ad.c

A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Mac Os X Macos Debian Linux and 1 more

CVE-2020-36228

openldap: Integer underflow in issuerAndThisUpdateCheck in schema_init.c

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 85.0% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Macos Debian Linux Openldap

CVE-2020-36227

openldap: Infinite loop in slapd with the cancel_extop Cancel operation

A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 77.2% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Macos Debian Linux Openldap

CVE-2020-36226

openldap: Denial of service via length miscalculation in slap_parse_user

A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 4.2% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Mac Os X Macos Debian Linux and 1 more

CVE-2020-36225

openldap: Double free in the saslAuthzTo processing

A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Macos Debian Linux Openldap

CVE-2020-36224

openldap: Invalid pointer free in the saslAuthzTo processing

A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Apple Debian Openldap

Products

Mac Os X Macos Debian Linux and 1 more