CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-24761 – HTTP Request Smuggling in waitress
https://notcve.org/view.php?id=CVE-2022-24761
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and where it ends. This would allow requests to be smuggled via the front-end proxy to waitress and later behavior. There are two classes of vulnerability that may lead to request smuggling that are addressed by this advisory: The use of Python's `int()` to parse strings into integers, leading to `+10` to be parsed as `10`, or `0x01` to be parsed as `1`, where as the standard specifies that the string should contain only digits or hex digits; and Waitress does not support chunk extensions, however it was discarding them without validating that they did not contain illegal characters. This vulnerability has been patched in Waitress 2.1.1. • https://github.com/Pylons/waitress/commit/9e0b8c801e4d505c2ffc91b891af4ba48af715e0 https://github.com/Pylons/waitress/releases/tag/v2.1.1 https://github.com/Pylons/waitress/security/advisories/GHSA-4f7p-27jc-3c36 https://lists.debian.org/debian-lts-announce/2022/05/msg00011.html https://www.debian.org/security/2022/dsa-5138 https://access.redhat.com/security/cve/CVE-2022-24761 https://bugzilla.redhat.com/show_bug.cgi?id=2065086 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 7.0EPSS: 0%CPEs: 2EXPL: 1CVE-2021-39713
https://notcve.org/view.php?id=CVE-2021-39713
Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel Producto: Android, Versiones: Android kernel, ID de Android: A-173788806, Referencias: kernel Ascendente • http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html https://source.android.com/security/bulletin/pixel/2022-03-01 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 3.2EPSS: 0%CPEs: 3EXPL: 0CVE-2022-26354 – QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak
https://notcve.org/view.php?id=CVE-2022-26354
A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0. Se ha encontrado un fallo en el dispositivo vhost-vsock de QEMU. En caso de error, un elemento inválido no era desprendido de la virtqueue antes de liberar su memoria, conllevando a una pérdida de memoria y otros resultados no esperados. • https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html https://security.gentoo.org/glsa/202208-27 https://security.netapp.com/advisory/ntap-20220425-0003 https://www.debian.org/security/2022/dsa-5133 https://access.redhat.com/security/cve/CVE-2022-26354 https://bugzilla.redhat.com/show_bug.cgi?id=2063257 • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 8.8EPSS: 0%CPEs: 23EXPL: 0CVE-2022-27223
https://notcve.org/view.php?id=CVE-2022-27223
In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access. En el archivo drivers/usb/gadget/udc/udc-xilinx.c en el kernel de Linux versiones anteriores a 5.16.12, el índice del punto final no se comprueba y podría ser manipulado por el host para el acceso fuera de la matriz • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.12 https://github.com/torvalds/linux/commit/7f14c7227f342d9932f9b918893c8814f86d2a0d https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html https://security.netapp.com/advisory/ntap-20220419-0001 • CWE-129: Improper Validation of Array Index •
CVSS: 7.5EPSS: 1%CPEs: 32EXPL: 4CVE-2022-0778 – Infinite loop in BN_mod_sqrt() reachable when parsing certificates
https://notcve.org/view.php?id=CVE-2022-0778
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. • https://github.com/drago-96/CVE-2022-0778 https://github.com/jkakavas/CVE-2022-0778-POC https://github.com/0xUhaw/CVE-2022-0778 https://github.com/jeongjunsoo/CVE-2022-0778 http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html http://seclists.org/fulldisclosure/2022/May/33 http://seclists.org/fulldisclosure/2022/May/35 http://seclists.org/fulldisclosure/2022/May/38 https://cert-portal.siemens.com/productcert/pdf/ssa-712 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •