A vulnerability in multicluster-global-hub allows a compromised managed hub to gain read access to a shared communication topic during ManagedClusterMigration. This flaw enables interception of sensitive bootstrap kubeconfigs containing API server tokens intended for other hubs. These tokens have an extended validity of about 9.86 years, increasing the risk of unauthorized access and information disclosure across managed clusters. The issue has a CVSS score of 6.3 (medium severity). Red Hat has released security updates addressing this vulnerability in versions 1.4.9 and 1.7.3 of Multicluster Global Hub.
This security update for suseconnect-ng upgrades the software to version 1.23.0, addressing multiple issues including improved product migration handling, updated Go version for building, stricter flag parsing, consistent interactive handling, and enhanced package collection capabilities. It also allows deregistration when a subscribed registration code has expired. No specific CVE or exploit details are provided.
GitPython versions up to 3.1.52 have a vulnerability where attacker-controlled submodule names can inject arbitrary configuration directives into the .git/config file. This occurs due to improper escaping of section names in git config files, allowing injection of directives such as core.sshCommand. This flaw can lead to remote code execution during subsequent git operations. A patch is available to fix this issue.
GitPython version 3.1.50 has a vulnerability where the default safety check for dangerous git clone options fails to recognize joined short-option forms like '-u<value>'. This allows an attacker who can control clone options to bypass the safety mechanism and execute local commands via Git's upload-pack option.
Multiple command injection and arbitrary file overwrite vulnerabilities exist in Kimi CLI's GitPython integration due to insufficient validation of user-supplied Git command options in functions like Repo.archive() and git.ls_remote(). These vulnerabilities affect various versions of python-git and can lead to high impact including confidentiality, integrity, and availability loss. A patch is available to address these issues.
A classic buffer overflow vulnerability exists in the Erlang/OTP megaco flex scanner C driver, allowing a remote unauthenticated attacker to corrupt memory by sending a specially crafted H.248/Megaco message with an oversized property parameter name. This overflow can lead to denial of service or potentially remote code execution. The vulnerability affects multiple OTP versions prior to specific fixed releases. A patch is available from the vendor.
A high severity denial of service vulnerability exists in the Expat XML parsing library used in Red Hat Hardened Images RPMs. The flaw is due to quadratic algorithmic complexity in the storeAtts() function when processing XML attributes, which can be triggered remotely by an unauthenticated attacker supplying a specially crafted XML document. This leads to excessive CPU consumption and potential service unavailability. The vulnerability is addressed in expat version 2.8.4-0.1.hum1. Mitigation includes applying the update or restricting untrusted XML parsing.
This security update for OpenSSL 3 addresses multiple vulnerabilities including remote denial-of-service via expensive Diffie-Hellman key agreement computations, heap buffer overflows, out-of-bounds reads, null pointer dereferences, acceptance of forged CMS messages, and cryptographic processing errors in AES modes. These issues affect the OpenSSL 3 library and could lead to crashes, memory corruption, or cryptographic failures.
phpseclib versions prior to 1.0.29, 2.0.54, and 3.0.52 contain a vulnerability due to improper limitation of object identifier lengths when parsing ASN.1 data. This flaw can cause excessive resource consumption leading to denial of service. The issue is a bypass of CVE-2024-27355 and has been addressed in the specified fixed versions. Multiple Ubuntu package versions are affected, and patches are available via Ubuntu security updates.
A path traversal vulnerability in GitPython prior to version 3.1.48 allows local attackers who can supply crafted reference paths to write, overwrite, move, or delete files outside the repository's .git directory. This occurs due to insufficient validation of reference paths before filesystem operations. The vulnerability impacts integrity and availability by enabling corruption or deletion of important files. A patch is available that enforces repository boundary checks on reference paths.
GitPython's config_writer().set_value() method prior to version 3.1.49 does not validate input values for newline characters, allowing injection of malicious core.hooksPath configuration. This vulnerability enables remote code execution by redirecting Git hook execution to attacker-controlled scripts. Applications passing untrusted input to set_value(), such as MLRun's project.push(), are affected. A fix is available that rejects values containing CR, LF, or NUL characters.
A timing side-channel vulnerability exists in phpseclib versions prior to 3.0.51, 2.0.53, and 1.0.28 in the Net\SSH2::get_binary_packet() function. The vulnerability arises because the library uses PHP's != operator for HMAC comparison, which performs a variable-time memcmp() operation. This can potentially allow an attacker to gain sensitive information through timing analysis. The issue is fixed in the specified patched versions. Ubuntu has released security updates addressing this vulnerability in various php-phpseclib package versions.
A critical integer overflow vulnerability (CVE-2026-5121) exists in libarchive's zisofs block pointer allocation logic on 32-bit systems. This flaw can be exploited remotely by providing a specially crafted ISO9660 image, potentially leading to a heap buffer overflow and arbitrary code execution. The vulnerability affects all versions of libarchive. Red Hat has issued security advisories and updates to address this issue in their Enterprise Linux 9 distribution.
phpseclib versions 0.1.1 through 1.0.26, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 contain a vulnerability in AES CBC mode padding validation that can be exploited via a padding oracle timing attack. This flaw allows a remote attacker to potentially obtain sensitive information. The issue has been fixed in versions 1.0.27, 2.0.52, and 3.0.50. Ubuntu has released security updates addressing this vulnerability across multiple LTS releases, with fixes available through standard system updates or Ubuntu Pro Extended Security Maintenance (ESM).
A HTTP Request Smuggling vulnerability exists in the Erlang OTP inets httpd module due to inconsistent handling of duplicate Content-Length headers. The server uses the earliest Content-Length header for body parsing, while common reverse proxies use the last, violating RFC 9112 Section 6.3. This discrepancy can cause front-end/back-end desynchronization, allowing attacker-controlled bytes to be interpreted as the start of a new request. The issue affects multiple versions of Erlang OTP prior to fixed releases. A patch is available to address this vulnerability.
CVE-2025-14524 is a vulnerability in curl where an OAuth2 bearer token used during an HTTP(S) transfer may be incorrectly passed to a redirected URL that uses a different protocol such as IMAP, LDAP, POP3, or SMTP. This behavior can lead to unintended disclosure of authentication credentials to the new target host. The issue affects multiple Ubuntu curl package versions and has a CVSS score of 5.3, indicating a medium severity impact. A patch is available from Ubuntu to address this vulnerability.
Pdfminer.six versions prior to 20251107 contain a vulnerability where processing a malicious PDF file can lead to arbitrary code execution. This occurs because the CMapDB._load_data() function deserializes pickle files using pickle.loads(), and a malicious PDF can specify an alternative pickle file that executes code upon loading. The issue is fixed in version 20251107.
An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc version 0.95 and related versions. This flaw can be triggered by a specially crafted malformed document file, potentially leading to heap-based memory corruption. Successful exploitation may cause the application to crash or allow arbitrary code execution. The vulnerability has a CVSS 3.1 score of 8.4, indicating high severity. Official patches are available from Ubuntu for multiple LTS releases via Ubuntu Pro Extended Security Maintenance (ESM).