Threat database

A security update for the fence-agents packages in Red Hat Enterprise Linux 9.0 addresses a vulnerability in the jinja2 template engine (CVE-2024-34064) where keys containing non-attribute characters are accepted. The fence-agents scripts manage remote power control for cluster nodes, allowing failed or unreachable nodes to be forcibly restarted and removed. This update is rated as having a moderate security impact. No CVSS score is provided in the advisory.

A SQL injection vulnerability (CVE-2024-36039) exists in the python3.11-PyMySQL package when it processes untrusted JSON input. PyMySQL is a pure-Python MySQL client library intended as a drop-in replacement for MySQLdb. This vulnerability could allow an attacker to execute arbitrary SQL commands if untrusted JSON input is used improperly. Red Hat has issued a security update for this issue in Red Hat Enterprise Linux 8. The update addresses the vulnerability by fixing the SQL injection flaw.

This security update for Ghostscript addresses multiple vulnerabilities including arbitrary path traversal, format string injection leading to command execution, and path validation bypass. These flaws could allow attackers to execute commands or access unauthorized paths. The vulnerabilities are fixed in this update. Public exploit code is available via Metasploit. No specific affected versions are stated.

A security update for Red Hat OpenStack Platform 16.2 addresses a vulnerability in python-gunicorn, a Python WSGI HTTP server. The vulnerability (CVE-2024-1135) involves HTTP Request Smuggling due to improper validation of Transfer-Encoding headers. Red Hat has rated this update as having an Important security impact and has released updated packages to fix the issue.

Multiple security issues were addressed in the python310-Authlib-1.3.1-1.1 package for openSUSE Tumbleweed. These fixes resolve vulnerabilities present in this specific package version. No detailed information about the nature of the vulnerabilities or their impact is provided.

This entry references a security update for Ruby provided by the SUSE Product Security Team, which is functionally equivalent to Red Hat's advisory RHSA-2024:3671. No specific vulnerability details, affected versions, or technical impact are provided in the input data. The severity is noted as low, and no CVSS score or exploit information is available.

A security update was released for the SUSE Linux Enterprise 15 SP5 RT kernel addressing various security bugfixes. This update also fixes a regression affecting kerberized NFSv4 shares introduced in a previous update.

A moderate severity vulnerability (CVE-2024-22195) in the python-jinja2 package allows HTML attribute injection when user input is passed as keys to the xmlattr filter. This flaw affects the Jinja2 template engine used in Red Hat Enterprise Linux 8. A security update is available that addresses this issue. Users must apply the update and restart all applications using Jinja2 for the fix to take effect.

CVE-2024-0510 is a critical server-side request forgery (SSRF) vulnerability in HaoKeKeJi YiQiNiu versions 3.0 and 3.1. It affects the http_post function in the /application/pay/controller/Api.php file. An attacker can manipulate the 'url' argument to cause the server to make unauthorized requests. The vulnerability is remotely exploitable and has public exploit code disclosed. The CVSS 3.1 base score is 7.3, indicating high severity.