CVE-2017-7512

AMP: validation bypass in oauth

Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512 maps to an OpenVPN vulnerability. The proper CVE ID for that OpenVPN vulnerability is CVE-2017-7521. Specifically, CVE-2017-7521 is the correct CVE ID for TWO closely related findings in OpenVPN. Any source that lists BOTH CVE-2017-7512 and CVE-2017-7521 for OpenVPN should have listed ONLY CVE-2017-7521.

CVSS 3.0 · 9.8 Critical EPSS 2.2% KEV · Not listed

Vendors

Redhat

Products

3scale Amp 3scale Api Management Platform

CVE-2021-3814

3scale: missing validation of access token

It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Redhat

Products

3scale 3scale Amp

CVE-2021-3442

RHOAM: XSS in 3scale at various places

A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an authenticated user to inject scripts into some text boxes leading to a XSS attack. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale Amp Openshift Api Management

CVE-2021-23017

nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

CVSS 3.1 · 7.7 High EPSS 53.5% KEV · Not listed

Vendors

F5 Fedoraproject Netapp and 3 more

Products

Nginx Fedora Ontap Select Deploy Administration Utility and 16 more

CVE-2020-9283

golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

CVSS 3.1 · 7.5 High EPSS 21.1% KEV · Not listed

Vendors

Debian Golang Redhat

Products

Debian Linux Package Ssh 3scale Amp and 4 more

CVE-2020-8912

In-band key negotiation issue in AWS S3 Crypto SDK for GoLang

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. It is recommended to update your SDK to V2 or later, and re-encrypt your files.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Amazon Redhat

Products

Aws S3 Crypto Sdk 3scale Amp

CVE-2020-8911

CBC padding oracle in AWS S3 Crypto SDK for GoLang

A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Amazon Redhat

Products

Aws S3 Crypto Sdk 3scale Amp

CVE-2020-26247

XXE in Nokogiri

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.

CVSS 3.1 · 2.6 Low EPSS 1.2% KEV · Not listed

Vendors

Debian Nokogiri Redhat

Products

Debian Linux Nokogiri 3scale Amp and 2 more

CVE-2020-14040

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed

Vendors

Fedoraproject Golang Redhat

Products

Fedora Text 3scale Amp and 13 more

CVE-2019-14849

3scale: user session cookie does not set HTTPOnly

A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie. An attacker could use this to conduct cross site scripting attacks and gain access to unauthorized information.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale 3scale Amp

CVE-2019-14836

3scale: dev portal missing protection against login CSRF

A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An attacker could use this flaw to access unauthorized information or conduct further attacks.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

3scale 3scale Amp

CVE-2019-14817

ghostscript: Safer mode bypass by .forceput exposure in .pdfexectoken and other procedures (701450)

A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Artifex Debian Fedoraproject and 2 more

Products

Ghostscript Debian Linux Fedora and 4 more

CVE-2019-14813

ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)

A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 9.8 Critical EPSS 11.0% KEV · Not listed

Vendors

Artifex Debian Fedoraproject and 2 more

Products

Ghostscript Debian Linux Fedora and 10 more

CVE-2019-14812

ghostscript: Safer mode bypass by .forceput exposure in setuserparams (701444)

A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 7.8 High EPSS 2.5% KEV · Not listed

Vendors

Artifex Fedoraproject Redhat

Products

Ghostscript Fedora 3scale Amp and 1 more

CVE-2019-14811

ghostscript: Safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator (701445)

A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 7.8 High EPSS 3.7% KEV · Not listed

Vendors

Artifex Debian Fedoraproject and 2 more

Products

Ghostscript Debian Linux Fedora and 4 more

CVE-2019-10216

ghostscript: -dSAFER escape via .buildfont1 (701394)

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

CVSS 3.1 · 7.8 High EPSS 2.3% KEV · Not listed

Vendors

Artifex Redhat

Products

Ghostscript 3scale Amp 3scale Api Management and 7 more