CVE-2019-10174

infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

CVSS 3.1 · 8.8 High EPSS 3.1% KEV · Not listed

Vendors

Infinispan Netapp Redhat

Products

Infinispan Active Iq Unified Manager Enterprise Linux and 9 more

CVE-2019-10171

389-ds-base: Insufficient fix for CVE-2018-14648 denial of service in RHEL-7.5

It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be able to provoke excessive CPU consumption leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

389 Directory Server Enterprise Linux Server Eus Rhel Eus

CVE-2019-10168

libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Advanced Virtualization Enterprise Linux Enterprise Linux Desktop and 7 more

CVE-2019-10167

libvirt: arbitrary command execution via virConnectGetDomainCapabilities API

The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Advanced Virtualization Enterprise Linux Enterprise Linux Desktop and 7 more

CVE-2019-10166

libvirt: virDomainManagedSaveDefineXML API exposed to readonly clients

It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Advanced Virtualization Enterprise Linux Enterprise Linux Desktop and 7 more

CVE-2019-10164

postgresql: Stack-based buffer overflow via setting a password

PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.

CVSS 3.1 · 8.8 High EPSS 3.6% KEV · Not listed

Vendors

Fedoraproject Opensuse Postgresql and 1 more

Products

Fedora Leap Postgresql and 4 more

CVE-2019-10161

libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API

It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Redhat

Products

Ubuntu Linux Advanced Virtualization Enterprise Linux and 3 more

CVE-2019-10155

libreswan: vulnerability in the processing of IKEv1 informational packets due to missing integrity check

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Libreswan Redhat and 2 more

Products

Fedora Libreswan Enterprise Linux and 2 more

CVE-2019-10153

fence-agents: mis-handling of non-ASCII characters in guest comment fields

A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying service to clusters of which that VM is a member.

CVSS 3.1 · 5.0 Medium EPSS 2.2% KEV · Not listed

Vendors

Clusterlabs Redhat

Products

Fence-agents Enterprise Linux Enterprise Linux Server and 1 more

CVE-2019-10146

pki-core: Reflected XSS in 'path length' constraint field in CA's Agent page

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Dogtagpki Redhat

Products

Dogtagpki Enterprise Linux Rhel Eus

CVE-2019-10143

freeradius: privilege escalation due to insecure logrotate configuration

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Freeradius Redhat

Products

Fedora Freeradius Enterprise Linux

CVE-2019-10141

openstack-ironic-inspector: SQL Injection vulnerability when receiving introspection data

A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.

CVSS 3.0 · 8.3 High EPSS 2.5% KEV · Not listed

Vendors

Openstack Redhat

Products

Ironic-inspector Enterprise Linux Openstack and 1 more

CVE-2019-10140

kernel: overlayfs: NULL pointer dereference in ovl_posix_acl_create function in fs/overlayfs/dir.c

A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local access can create a denial of service situation via NULL pointer dereference in ovl_posix_acl_create function in fs/overlayfs/dir.c. This can allow attackers with ability to create directories on overlayfs to crash the kernel creating a denial of service (DOS).

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Extras Rt

CVE-2019-10139

cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment

During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Ovirt Redhat

Products

Cockpit-ovirt Enterprise Linux

CVE-2019-10132

libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter

A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.

CVSS 3.0 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Advanced Virtualization Enterprise Linux and 1 more

CVE-2019-10131

ImageMagick: off-by-one read in formatIPTCfromBuffer function in coders/meta.c

An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.

CVSS 3.1 · 7.1 High EPSS 1.3% KEV · Not listed

Vendors

Canonical Debian Imagemagick and 2 more

Products

Ubuntu Linux Debian Linux Imagemagick and 2 more

CVE-2019-10130

postgresql: Selectivity estimators bypass row security policies

A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Opensuse Postgresql Redhat

Products

Leap Postgresql Enterprise Linux and 3 more

CVE-2019-10126

kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c

A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences.

CVSS 3.1 · 9.8 Critical EPSS 6.8% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 26 more

CVE-2019-10098

httpd: mod_rewrite potential open redirect

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.

CVSS 3.1 · 6.1 Medium EPSS 74.0% KEV · Not listed

Vendors

Apache Redhat

Products

Http Server Enterprise Linux Jboss Core Services and 1 more

CVE-2019-10097

httpd: null-pointer dereference in mod_remoteip

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.

CVSS 3.1 · 7.2 High EPSS 52.9% KEV · Not listed

Vendors

Apache Oracle Redhat

Products

Http Server Communications Element Manager Communications Session Report Manager and 8 more