CVE-2022-25881

http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

CVSS 3.1 · 5.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Http-cache-semantics Project Redhat

Products

Http-cache-semantics Acm Enterprise Linux and 5 more

CVE-2024-1442

User with permissions to create a data source can CRUD all data sources

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana Redhat

Products

Grafana Acm Ceph Storage

CVE-2023-45142

OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Opentelemetry Redhat

Products

Opentelemetry Acm Ceph Storage and 4 more

CVE-2023-39325

HTTP/2 rapid reset can cause excessive work in net/http

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Fedoraproject Golang Netapp and 1 more

Products

Fedora Go Http2 and 50 more

CVE-2023-39322

Memory exhaustion in QUIC connection handling in crypto/tls

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Go Standard Library Golang Redhat

Products

Crypto Tls Go Acm and 15 more

CVE-2023-39321

Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Ansible Automation Platform and 14 more

CVE-2023-39319

Improper handling of special tags within script contexts in html/template

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Enterprise Linux and 12 more

CVE-2023-39318

Improper handling of HTML-like comments in script contexts in html/template

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Enterprise Linux and 12 more

CVE-2023-28856

`HINCRBYFLOAT` can be used to crash a redis-server process

Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Acm and 2 more

CVE-2023-22467

luxon.js inefficient regular expression complexity vulnerability

Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed

Vendors

Momentjs Redhat

Products

Luxon Acm

CVE-2022-41717

Excessive memory growth in net/http and golang.org/x/net/http2

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

CVSS 3.1 · 5.3 Medium EPSS 6.2% KEV · Not listed

Vendors

Fedoraproject Golang Redhat

Products

Fedora Go Http2 and 22 more

CVE-2022-41715

Memory exhaustion when compiling regular expressions in regexp/syntax

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Ceph Storage and 21 more

CVE-2022-2880

Incorrect sanitization of forwarded query parameters in net/http/httputil

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Ceph Storage and 17 more

CVE-2023-29017

vm2 Sandbox Escape vulnerability

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.

CVSS 3.1 · 10 Critical EPSS 63.2% KEV · Not listed

Vendors

Redhat Vm2 Project

Products

Acm Multicluster Engine Vm2

CVE-2023-29199

vm2 Sandbox escape vulnerability

There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.16` of `vm2`.

CVSS 3.1 · 9.8 Critical EPSS 3.9% KEV · Not listed

Vendors

Redhat Vm2 Project

Products

Acm Multicluster Engine Vm2

CVE-2023-30547

Sandbox Escape in vm2

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.

CVSS 3.1 · 9.8 Critical EPSS 73.0% KEV · Not listed

Vendors

Redhat Vm2 Project

Products

Acm Multicluster Engine Vm2

CVE-2023-29400

Improper handling of empty HTML attributes in html/template

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Advanced Cluster Security and 19 more

CVE-2023-24539

Improper sanitization of CSS values in html/template

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.

CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Advanced Cluster Security and 19 more

CVE-2023-32313

Inspect method manipulation in vm2

vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Vm2 Project

Products

Acm Multicluster Engine Vm2

CVE-2023-32314

Sandbox Escape

vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 8.1% KEV · Not listed

Vendors

Redhat Vm2 Project

Products

Acm Multicluster Engine Vm2