Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,139

Export CSV
CVE-2021-4048

lapack: Out-of-bounds read in *larrv

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Julialang Lapack Project and 2 more
Products
Fedora Julia Lapack and 5 more
CVE-2021-4047

haproxy: Incomplete fix for CVE-2021-39242 in OpenShift 4.9

The release of OpenShift 4.9.6 included four CVE fixes for the haproxy package, however the patch for CVE-2021-39242 was missing. This issue only affects Red Hat OpenShift 4.9.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2021-44717

golang: syscall: don't close fd 0 on ForkExec error

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

CVSS 3.1 · 4.8 Medium EPSS 2.0% KEV · Not listed
Vendors
Debian Golang Opengroup and 1 more
Products
Debian Linux Go Unix and 7 more
CVE-2021-44716

golang: net/http: limit growth of header canonicalization cache

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

CVSS 3.1 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Cloud Insights Telegraf and 13 more
CVE-2021-43998

vault: incorrect policy enforcement

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Hashicorp Redhat
Products
Vault Openshift Openshift Data Foundation
CVE-2021-43813

Directory Traversal in Grafana

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.

CVSS 3.1 · 4.3 Medium EPSS 56.6% KEV · Not listed
Vendors
Grafana Redhat
Products
Grafana Ceph Storage Enterprise Linux and 1 more
CVE-2021-43565

golang.org/x/crypto: empty plaintext packet causes panic

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Golang Redhat
Products
Ssh Acm Advanced Cluster Security and 6 more
CVE-2021-42340

DoS via memory leak with WebSocket connections

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

CVSS 3.1 · 7.5 High EPSS 11.8% KEV · Not listed
Vendors
Apache Debian Netapp and 2 more
Products
Tomcat Debian Linux Hci and 19 more
CVE-2021-41772

golang: archive/zip: Reader.Open panics on empty string

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Fedoraproject Golang Oracle and 1 more
Products
Fedora Go Timesten In-memory Database and 5 more
CVE-2021-41269

Unauthenticated remote code injection in cron-utils

cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.

CVSS 3.1 · 10 Critical EPSS 4.3% KEV · Not listed
Vendors
Cron-utils Project Redhat
Products
Cron-utils Camel Quarkus Openshift Application Runtimes and 1 more
CVE-2021-41190

Clarify Content-Type handling in OCI spec

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.

CVSS 3.1 · 3 Low EPSS 2.2% KEV · Not listed
Vendors
Fedoraproject Linuxfoundation Redhat
Products
Fedora Open Container Initiative Distribution Specification Open Container Initiative Image Format Specification and 7 more
CVE-2021-40346

haproxy: request smuggling attack or response splitting via duplicate content-length header

An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.

CVSS 3.1 · 7.5 High EPSS 58.8% KEV · Not listed
Vendors
Debian Fedoraproject Haproxy and 1 more
Products
Debian Linux Fedora Haproxy and 1 more
CVE-2021-3917

coreos-installer: restrict access permissions on /boot/ignition{,/config.ign}

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Coreos-installer Openshift
CVE-2021-3914

smallrye-health-ui: persistent cross-site scripting in endpoint

It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Of Quarkus Openshift Application Runtimes Quarkus and 1 more
CVE-2021-3827

keycloak-server-spi-private: ECP SAML binding bypasses authentication flows

A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.

CVSS 3.1 · 6.8 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Keycloak Openshift Container Platform and 3 more
CVE-2021-3749

Inefficient Regular Expression Complexity in axios/axios

axios is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1 · 7.5 High EPSS 8.5% KEV · Not listed
Vendors
Axios Oracle Redhat and 1 more
Products
Axios Goldengate Acm and 6 more
CVE-2021-3703

serverless: incomplete fix for CVE-2021-27918 / CVE-2021-31525 / CVE-2021-33196

It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless 1.16.0 and Serverless client kn 1.16.0. These have been fixed with Serverless 1.17.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Serverless Serverless
CVE-2021-3697

grub2: Crafted JPEG image can lead to buffer underflow write in the heap

A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be performed the attacker needs to perform some triage over the heap layout and craft an image with a malicious format and payload. This vulnerability can lead to data corruption and eventual code execution or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Grub2 Codeready Linux Builder Developer Tools and 11 more