CVE-2019-3868

keycloak: session hijack using the user access token

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.

CVSS 3.0 · 3.8 Low EPSS 1.0% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Openshift Application Runtimes and 1 more

CVE-2019-3867

quay: insufficient session expiration

A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could use it to control or delete a user's container repository. Red Hat Quay 2 and 3 are vulnerable to this issue.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Quay

CVE-2019-3866

openstack-mistral: information disclosure in mistral log

An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openstack Openstack-mistral Quay

CVE-2019-3865

quay: Stored XSS in super user function

A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Quay

CVE-2019-3864

quay: CSRF token does not expire and is leaked in query string

A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a CSRF token. The token is not refreshed for every request or when a user logged out and in again. An attacker could use a leaked token to gain access to the system using the user's account.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Quay

CVE-2019-3846

kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c

A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network.

CVSS 3.1 · 8.8 High EPSS 5.9% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 14 more

CVE-2019-3845

katello-installer-base: QMF methods exposed to goferd via qdrouterd

A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before Satellite 6.2, Satellite 6.1 optional and Satellite Capsule 6.1. A malicious user authenticated to a host registered to Satellite (or Capsule) can use this flaw to access QMF methods to any host also registered to Satellite (or Capsule) and execute privileged commands.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Satellite Tools Satellite and 1 more

CVE-2019-3840

libvirt: NULL pointer dereference after running qemuAgentCommand in qemuAgentGetInterfaces function

A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in a guest VM can use this flaw to crash libvirtd and cause a denial of service.

CVSS 3.0 · 5.8 Medium EPSS 1.5% KEV · Not listed

Vendors

Opensuse Redhat

Products

Leap Enterprise Linux Libvirt

CVE-2019-3839

ghostscript: missing attack vector protections for CVE-2019-6116

It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Ghostscript versions before 9.27 are vulnerable.

CVSS 3.1 · 7.8 High EPSS 1.7% KEV · Not listed

Vendors

Artifex Canonical Debian and 3 more

Products

Ghostscript Ubuntu Linux Debian Linux and 3 more

CVE-2019-3838

ghostscript: forceput in DefineResource is still accessible (700576)

It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Artifex Debian Fedoraproject and 2 more

Products

Ghostscript Debian Linux Fedora and 9 more

CVE-2019-3837

kernel: memory leak in tcp_recvmsg() with NET_DMA

It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2019-3836

gnutls: invalid pointer access upon receiving async handshake messages

It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.

CVSS 3.0 · 5.9 Medium EPSS 3.4% KEV · Not listed

Vendors

Fedoraproject Gnu Opensuse and 1 more

Products

Fedora Gnutls Leap and 1 more

CVE-2019-3835

ghostscript: superexec operator is available (700585)

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Artifex Debian Fedoraproject and 2 more

Products

Ghostscript Debian Linux Fedora and 9 more

CVE-2019-3834

JON: struts1 reversion of fix for CVE-2014-0114

It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.

CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed

Vendors

Redhat

Products

Jboss Operations Network

CVE-2019-3833

openwsman: Infinite loop in process_connection() allows denial of service

Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending malicious HTTP request to cause denial of service to openwsman server.

CVSS 3.1 · 7.5 High EPSS 15.2% KEV · Not listed

Vendors

Fedoraproject Opensuse Openwsman Project and 1 more

Products

Fedora Leap Openwsman and 1 more

CVE-2019-3831

vdsm: privilege escalation to root via systemd_run

A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to the vdsm system user could be abused to execute arbitrary commands as root.

CVSS 3.1 · 6.7 Medium EPSS 1.0% KEV · Not listed

Vendors

Ovirt Redhat

Products

Vdsm Enterprise Linux Gluster Storage and 1 more

CVE-2019-3830

openstack-ceilometer: ceilometer-agent prints sensitive data from config files through log files

A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Openstack Redhat

Products

Ceilometer Openstack

CVE-2019-3829

gnutls: use-after-free/double-free in certificate verification

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.

CVSS 3.0 · 5.3 Medium EPSS 59.2% KEV · Not listed

Vendors

Fedoraproject Gnu Redhat

Products

Fedora Gnutls Enterprise Linux

CVE-2019-3828

Ansible: path traversal in the fetch module

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Ansible Engine Openstack

CVE-2019-3827

gvfs: Incorrect authorization in admin backend allows privileged users to read and modify arbitrary files without prompting for password

An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Gvfs Enterprise Linux