CVE-2019-10202

codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.

CVSS 3.1 · 9.8 Critical EPSS 5.2% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Enterprise Application Platform Jboss Fuse

CVE-2019-10201

keycloak: SAML broker does not check existence of signature on document allowing any user impersonation

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Openshift Application Runtimes and 1 more

CVE-2019-10200

openshift: Users with permission to schedule pods on master nodes can access credentials for AWS IAM roles

A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS IAM role, allowing management access to AWS resources. With access to the security credentials, the user then has access to the entire infrastructure. Impact to data and system availability is high.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Openshift Container Platform

CVE-2019-10199

keycloak: CSRF check missing in My Resources functionality in the Account Console

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Openshift Application Runtimes

CVE-2019-10198

foreman: authorization bypasses in foreman-tasks leading to information disclosure

An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, if they can discover or guess the UUID of the task.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Redhat Theforeman

Products

Satellite Satellite Capsule Foreman-tasks

CVE-2019-10197

samba: Combination of parameters and permissions can allow user to escape from the share path definition

A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.

CVSS 3.0 · 6.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Canonical Debian Redhat and 1 more

Products

Ubuntu Linux Debian Linux Enterprise Linux and 2 more

CVE-2019-10196

nodejs-http-proxy-agent: Denial of Service and data leak due to improper buffer sanitization

A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Fedoraproject Http-proxy-agent Project Redhat

Products

Fedora Http-proxy-agent Enterprise Linux and 1 more

CVE-2019-10195

ipa: Batch API logging user passwords to /var/log/httpd/error_log

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Fedoraproject Freeipa Redhat

Products

Fedora Freeipa Enterprise Linux and 1 more

CVE-2019-10194

ovirt-engine-metrics: disclosure of sensitive passwords in log files and ansible playbooks

Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files (if playbooks are run with -v) or in playbooks stored on Metrics or Bastion hosts.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ovirt Redhat

Products

Ovirt Rhev Manager Virtualization Manager

CVE-2019-10193

redis: Stack buffer overflow in HyperLogLog triggered by malicious client

A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer.

CVSS 3.1 · 7.2 High EPSS 23.3% KEV · Not listed

Vendors

Canonical Debian Oracle and 2 more

Products

Ubuntu Linux Debian Linux Communications Operations Monitor and 7 more

CVE-2019-10192

redis: Heap buffer overflow in HyperLogLog triggered by malicious client

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.

CVSS 3.1 · 7.2 High EPSS 25.6% KEV · Not listed

Vendors

Canonical Debian Oracle and 2 more

Products

Ubuntu Linux Debian Linux Communications Operations Monitor and 9 more

CVE-2019-10185

icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite

It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.

CVSS 3.1 · 8.6 High EPSS 4.0% KEV · Not listed

Vendors

Debian Icedtea-web Project Opensuse and 1 more

Products

Debian Linux Icedtea-web Leap and 1 more

CVE-2019-10184

undertow: Information leak in requests for directories without trailing slashes

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed

Vendors

Netapp Redhat

Products

Active Iq Unified Manager Enterprise Linux Jboss Data Grid and 7 more

CVE-2019-10183

virt-install: unattended option leaks password via command line argument

Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.

CVSS 3.0 · 3.2 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Virt-manager

CVE-2019-10182

icedtea-web: path traversal while processing <jar/> elements of JNLP files results in arbitrary file overwrite

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user.

CVSS 3.0 · 8.2 High EPSS 2.7% KEV · Not listed

Vendors

Icedtea-web Project Redhat

Products

Icedtea-web Enterprise Linux Enterprise Linux Desktop and 4 more

CVE-2019-10181

icedtea-web: unsigned code injection in a signed JAR file

It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed

Vendors

Debian Icedtea-web Project Opensuse and 1 more

Products

Debian Linux Icedtea-web Leap and 1 more

CVE-2019-10180

pki-core: unsanitized token parameters in TPS resulting in stored XSS

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Dogtagpki Redhat

Products

Dogtagpki Certificate System Certificate System Eus

CVE-2019-10179

pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab

A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dogtagpki Redhat

Products

Dogtagpki Enterprise Linux Rhel Eus

CVE-2019-10178

pki-core: stored Cross-site scripting (XSS) in the pki-tps web Activity tab

It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would execute arbitrary JavaScript code when viewed in a browser. All versions of pki-core are believed to be vulnerable.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Dogtagpki Redhat

Products

Dogtagpki Certificate System Certificate System Eus

CVE-2019-10177

CloudForms: Store XSS in PDF exports feature allows code execution of Javascript and HTML input

A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Cloudforms Management Engine