CVE-2019-11287 – RabbitMQ Web Management Plugin DoS via heap overflow
https://notcve.org/view.php?id=CVE-2019-11287
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing. Pivotal RabbitMQ, versiones 3.7.x anteriores a 3.7.21 y versiones 3.8.x anteriores a 3.8.1, y RabbitMQ para Pivotal Platform, versiones 1.16.x anteriores a 1.16.7 y versiones 1.17.x versiones anteriores a 1.17.4, contienen un plugin de administración web que es vulnerable a un ataque de denegación de servicio. El encabezado "X-Reason" de HTTP puede ser aprovechado para insertar una cadena de formato Erlang maliciosa que expandirá y consumirá la pila, resultando en el bloqueo del servidor. A resource-consumption flaw was identified in the rabbitmq-server web management plugin. • https://access.redhat.com/errata/RHSA-2020:0078 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4 https://pivotal.io/security/cve-2 • CWE-20: Improper Input Validation CWE-134: Use of Externally-Controlled Format String CWE-400: Uncontrolled Resource Consumption •
CVE-2019-11291 – RabbitMQ XSS attack via federation and shovel endpoints
https://notcve.org/view.php?id=CVE-2019-11291
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information. Pivotal RabbitMQ, versiones 3.7 anteriores a v3.7.20 y versiones 3.8 anteriores a v3.8.1, y RabbitMQ para PCF, versiones 1.16.x anteriores a 1.16.7 y versiones 1.17.x anteriores a 1.17.4, contienen dos endpoints, federation y shovel, que no sanean apropiadamente la entrada de usuario. Un usuario malicioso autenticado remoto con acceso administrativo podría crear un ataque de tipo cross site scripting por medio de los campos vhost o node name, lo que podría otorgar acceso a los hosts virtuales e información de administración de políticas. A flaw was discovered in rabbitmq-server where two endpoints, federation and shovel, do not properly sanitize user input. • https://access.redhat.com/errata/RHSA-2020:0553 https://pivotal.io/security/cve-2019-11291 https://access.redhat.com/security/cve/CVE-2019-11291 https://bugzilla.redhat.com/show_bug.cgi?id=1783327 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVE-2015-5694
https://notcve.org/view.php?id=CVE-2015-5694
Designate does not enforce the DNS protocol limit concerning record set sizes Designate no aplica el límite del protocolo DNS con respecto a los tamaños del conjunto de registros. • http://www.openwall.com/lists/oss-security/2015/07/28/11 http://www.openwall.com/lists/oss-security/2015/07/29/6 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5694 https://security-tracker.debian.org/tracker/CVE-2015-5694 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVE-2019-14859 – python-ecdsa: DER encoding is not being verified in signatures
https://notcve.org/view.php?id=CVE-2019-14859
A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions. Se encontró un fallo en todas las versiones de python-ecdsa anteriores a la versión 0.13.3, donde no se comprobaba correctamente si las firmas usaban codificación DER. Sin esta comprobación, se podría aceptar una firma malformada, haciendo que la firma sea maleable. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14859 https://github.com/warner/python-ecdsa/issues/114 https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3 https://pypi.org/project/ecdsa/0.13.3 https://access.redhat.com/security/cve/CVE-2019-14859 https://bugzilla.redhat.com/show_bug.cgi?id=1760843 • CWE-347: Improper Verification of Cryptographic Signature •
CVE-2019-14818 – dpdk: possible memory leak leads to denial of service
https://notcve.org/view.php?id=CVE-2019-14818
A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition. Se encontró un fallo en todas las versiones de dpdk 17.xx anteriores a 17.11.8, versiones 16.xx anteriores a 16.11.10, versiones 18.xx anteriores a 18.11.4 y versiones 19.xx anteriores a 19.08.1, donde un maestro malicioso o un contenedor con acceso al socket vhost_user, puede enviar mensajes de VRING_SET_NUM especialmente diseñados, resultando en una pérdida de memoria incluyendo descriptores de archivo. Este fallo podría conllevar a una condición de denegación de servicio. A flaw was found in dpdk where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. • https://access.redhat.com/errata/RHSA-2020:0165 https://access.redhat.com/errata/RHSA-2020:0166 https://access.redhat.com/errata/RHSA-2020:0168 https://access.redhat.com/errata/RHSA-2020:0171 https://access.redhat.com/errata/RHSA-2020:0172 https://bugs.dpdk.org/show_bug.cgi?id=363 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULJ3C7OVBOEVDGSHYC3VCLSUHANGTFFP https://access.redhat& • CWE-401: Missing Release of Memory after Effective Lifetime •