CVE-2018-1114

undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.

CVSS 3.0 · 6.5 Medium EPSS 2.3% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Enterprise Application Platform Jboss Fuse and 4 more

CVE-2018-1113

setup: nologin listed in /etc/shells violates security expectations

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Enterprise Linux Enterprise Linux Desktop and 3 more

CVE-2018-1112

glusterfs: auth.allow allows unauthenticated clients to mount gluster volumes (CVE-2018-1088 regression)

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

CVSS 3.0 · 8 High EPSS 2.3% KEV · Not listed

Vendors

Gluster Redhat

Products

Glusterfs Enterprise Linux Storage

CVE-2018-1111

dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.

CVSS 3.0 · 7.5 High EPSS 97.9% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Enterprise Linux Enterprise Linux Desktop and 8 more

CVE-2018-1107

nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Is-my-json-valid Project Redhat

Products

Is-my-json-valid Quay

CVE-2018-1106

PackageKit: authentication bypass allows to install signed packages without administrator privileges

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Packagekit Project and 1 more

Products

Ubuntu Linux Debian Linux Packagekit and 7 more

CVE-2018-1104

ansible-tower: Remote code execution by users with access to define variables in job templates

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

CVSS 3.0 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower Cloudforms Cloudforms Managementengine

CVE-2018-1103

source-to-image: Unsanitized paths in tar.go:ExtractTarStreamFromTarReader() allow malicious containers to overwrite files on the client machine

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command.

CVSS 3.0 · 6.1 Medium EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Source-to-image

CVE-2018-1102

source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go

A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.

CVSS 3.0 · 8.8 High EPSS 2.4% KEV · Not listed

Vendors

Redhat

Products

Openshift Rhel Software Collections

CVE-2018-1101

ansible-tower: Privilege escalation flaw allows for organization admins to obtain system privileges

Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.

CVSS 3.0 · 7.2 High EPSS 1.9% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower Cloudforms Cloudforms Managementengine

CVE-2018-1100

zsh: buffer overflow in utils.c:checkmailpath() can lead to local arbitrary code execution

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Redhat Zsh

Products

Ubuntu Linux Enterprise Linux Enterprise Linux Desktop and 3 more

CVE-2018-1099

etcd: DNS rebinding vulnerability in etcd server

DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Etcd

CVE-2018-1098

etcd: Cross-site request forgery via crafted local POST forms

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.

CVSS 3.0 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Etcd

CVE-2018-1097

foreman: Ovirt admin password exposed by foreman API

A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.

CVSS 3.0 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Redhat Theforeman

Products

Satellite Satellite Capsule Foreman

CVE-2018-1096

foreman: SQL injection due to improper handling of the widget id parameter

An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.

CVSS 3.0 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Redhat Theforeman

Products

Satellite Satellite Capsule Foreman

CVE-2018-1095

kernel: out-of-bound access in fs/posix_acl.c:get_acl() causes crash with crafted ext4 image

The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image.

CVSS 3.0 · 5.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2018-1094

kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image

The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.

CVSS 3.1 · 5.5 Medium EPSS 2.1% KEV · Not listed

Vendors

Canonical Linux Redhat

Products

Ubuntu Linux Linux Kernel Enterprise Linux and 4 more

CVE-2018-1092

kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4 image

The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_count, which allows attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image.

CVSS 3.0 · 5.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Extras Rt

CVE-2018-1091

kernel: guest kernel crash during core dump on POWER9 host

In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2018-1090

pulp: sensitive credentials revealed through the API

In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.

CVSS 3.0 · 5.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Fedoraproject Pulpproject Redhat

Products

Fedora Pulp Satellite and 1 more