CVE-2019-9636

python: Information Disclosure due to urlsplit improper NFKC normalization

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVSS 3.1 · 5.3 Medium EPSS 7.7% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 18 more

CVE-2019-6111

openssh: Improper validation of object names allows malicious server to overwrite files via scp client

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

CVSS 3.1 · 5.9 Medium EPSS 58.2% KEV · Not listed

Vendors

Apache Canonical Debian and 7 more

Products

Mina Sshd Ubuntu Linux Debian Linux and 24 more

CVE-2019-6109

openssh: Missing character encoding in progress display allows for spoofing of scp client output

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.

CVSS 3.1 · 6.8 Medium EPSS 3.8% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 6 more

Products

Ubuntu Linux Debian Linux Fedora and 25 more

CVE-2019-3863

libssh2: Integer overflow in user authenticate keyboard interactive allows out-of-bounds writes

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.

CVSS 3.0 · 7.5 High EPSS 3.4% KEV · Not listed

Vendors

Debian Libssh2 Netapp and 2 more

Products

Debian Linux Libssh2 Ontap Select Deploy Administration Utility and 12 more

CVE-2019-3857

libssh2: Integer overflow in SSH packet processing channel resulting in out of bounds write

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 6.1% KEV · Not listed

Vendors

Debian Fedoraproject Libssh2 and 4 more

Products

Debian Linux Fedora Libssh2 and 14 more

CVE-2019-3856

libssh2: Integer overflow in keyboard interactive handling resulting in out of bounds write

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 6.1% KEV · Not listed

Vendors

Debian Fedoraproject Libssh2 and 4 more

Products

Debian Linux Fedora Libssh2 and 14 more

CVE-2019-3855

libssh2: Integer overflow in transport read resulting in out of bounds write

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 9.3% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 5 more

Products

Xcode Debian Linux Fedora and 15 more

CVE-2019-10160

python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

CVSS 3.1 · 9.8 Critical EPSS 5.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 13 more

CVE-2018-0495

ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Gnupg and 2 more

Products

Ubuntu Linux Debian Linux Libgcrypt and 11 more

CVE-2017-15422

chromium-browser: integer overflow in icu

Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Canonical Debian Google and 2 more

Products

Ubuntu Linux Debian Linux Chrome and 5 more

CVE-2016-5131

libxml2: Use after free triggered by XPointer paths beginning with range-to

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Apple Canonical Debian and 5 more

Products

Iphone Os Mac Os X Tvos and 15 more

CVE-2024-12085

Rsync: info leak via uninitialized stack contents

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

CVSS 3.1 · 7.5 High EPSS 8.6% KEV · Not listed

Vendors

Almalinux Archlinux Gentoo and 5 more

Products

Almalinux Arch Linux Linux and 26 more

CVE-2011-3389

HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

CVSS 2.0 · 4.3 Medium EPSS 73.3% KEV · Not listed

Vendors

Canonical Debian Google and 6 more

Products

Ubuntu Linux Debian Linux Chrome and 18 more

CVE-2019-10086

apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CVSS 3.1 · 7.3 High EPSS 29.1% KEV · Not listed

Vendors

Apache Debian Fedoraproject and 3 more

Products

Commons Beanutils Nifi Debian Linux and 70 more

CVE-2018-5968

jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

CVSS 3.1 · 8.1 High EPSS 7.2% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 1 more

Products

Debian Linux Jackson-databind E-series Santricity Os Controller and 9 more

CVE-2018-5407

openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

CVSS 3.1 · 4.7 Medium EPSS 3.4% KEV · Not listed

Vendors

Canonical Debian Nodejs and 4 more

Products

Ubuntu Linux Debian Linux Node.js and 20 more

CVE-2018-12121

nodejs: Denial of Service with large HTTP headers

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.

CVSS 3.1 · 7.5 High EPSS 10.2% KEV · Not listed

Vendors

Nodejs Redhat

Products

Node.js Enterprise Linux Enterprise Linux Desktop and 6 more

CVE-2017-7525

jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

CVSS 3.1 · 9.8 Critical EPSS 37.7% KEV · Not listed

Vendors

Debian Fasterxml Netapp and 2 more

Products

Debian Linux Jackson-databind Oncommand Balance and 27 more

CVE-2017-5645

log4j: Socket receiver deserialization vulnerability

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS 89.4% KEV · Not listed

Vendors

Apache Netapp Oracle and 1 more

Products

Log4j Oncommand Api Services Oncommand Insight and 83 more

CVE-2016-9841

zlib: Out-of-bounds pointer arithmetic in inffast.c

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

CVSS 3.1 · 9.8 Critical EPSS 7.5% KEV · Not listed

Vendors

Apple Canonical Debian and 6 more

Products

Iphone Os Mac Os X Tvos and 39 more