Threats tagged 'bitnami'

Redis versions 7.2.10 and earlier, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3 contain a use-after-free vulnerability in the Lua scripting engine. An authenticated user can exploit this by submitting a crafted Lua script that manipulates the garbage collector, potentially leading to remote code execution. This vulnerability is fixed in Redis version 8.2.2. As a workaround, administrators can restrict Lua script execution using ACLs to disable EVAL and EVALSHA commands.

An integer underflow vulnerability exists in the setDeferredReply function within networking.c in Valkey versions prior to 8.1.4. The flaw involves the calculation prev->size - prev->used, which can underflow. This issue is fixed in version 8.1.4.

A vulnerability in PyTorch version 2.7.0 can cause a Denial of Service (DoS) when a model uses torch.Tensor.to_sparse() and torch.Tensor.to_dense() operations and is compiled by Inductor. This issue affects versions prior to 2.7.1. A patch is available to address this problem.

Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

A vulnerability in GitLab CE/EE versions from 5.2 up to but not including 18.2.8, 18.3 up to 18.3.4, and 18.4 up to 18.4.2 allows an authenticated attacker to cause a denial of service by configuring malicious webhook endpoints that send crafted HTTP responses. This issue has been remediated in versions 18.2.8, 18.3.4, and 18.4.2.

Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)

Redis versions 7.2.10 and earlier, 8.0.0 through 8.0.5, and 8.1.0 through 8.1.3 are vulnerable to denial of service via specially crafted Lua scripts. An authenticated user can exploit this flaw to cause the server to crash or read out-of-bound data. The vulnerability affects all Redis versions with Lua scripting enabled. The issue is fixed in Redis version 8.2.2. As a workaround, administrators can restrict Lua script execution using ACLs to block the EVAL and FUNCTION command families.

Redis versions 7.2.11 and earlier, as well as certain 8.x versions before 8.2.2, contain a vulnerability that allows authenticated users to execute Lua scripts in the context of another user. This issue affects all Redis versions with Lua scripting enabled. The vulnerability is fixed in Redis version 8.2.2. A workaround is to restrict Lua script execution using ACLs by blocking the EVAL and FUNCTION command families.

Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.

A denial of service (DoS) vulnerability exists in TensorFlow version 2.18.0 when using the tf.keras.layers.Conv2D layer with padding set to 'valid'. This issue can cause the application to become unresponsive or crash. A patch is available to address this vulnerability.

A buffer overflow vulnerability exists in PyTorch version 2.7.0 when a model includes torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view combined with torch.mv(), and is compiled using Inductor. This flaw can lead to a Denial of Service (DoS) condition. A patch addressing this issue is available in versions 2.7.1 and later.

A vulnerability in GitLab CE/EE versions from 14.10 up to but not including 18.2.7, 18.3 up to 18.3.3, and 18.4 up to 18.4.1 allows Guest users to access sensitive information stored in virtual registry configurations. This issue has been fixed in versions 18.2.7, 18.3.3, and 18.4.1.

JupyterLab versions prior to 4.4.8 did not enforce the noopener attribute on links generated by LaTeX typesetters in Markdown files and cells. This could theoretically allow reverse tabnabbing attacks if third-party LaTeX-rendering extensions generated links with target=_blank, although no such extensions are currently known. The issue has been fixed in version 4.4.8.

CVE-2025-8869 is a vulnerability in pip's fallback tar extraction code used with Python versions that do not implement PEP 706. The flaw allows symbolic links in tar archives to point outside the intended extraction directory, potentially leading to unsafe file extraction. Upgrading pip to version 25.3.0 or later addresses this issue. Using Python versions implementing PEP 706 (>=3.9.17, >=3.10.12, >=3.11.4, or >=3.12) also mitigates the risk by avoiding the vulnerable fallback code. Users should also inspect source distributions before installation as a best practice.

CVE-2025-55557 is a vulnerability in PyTorch version 2.7.0 where a Name Error occurs if a model uses torch.cummin and is compiled by Inductor. This results in a Denial of Service (DoS) condition. The vulnerability has a high severity score of 7.5 and does not affect confidentiality or integrity, only availability. No patch or remediation information is currently provided.

TensorFlow version 2.18.0 has a vulnerability that causes it to output random results when compiling Embedding layers, which can lead to unexpected application behavior. This issue impacts the integrity and availability of applications relying on this functionality.

PyTorch version 2.8.0 contains an integer overflow vulnerability in the torch.nan_to_num-.long() component. This vulnerability has a medium severity CVSS score of 5.3 and could impact availability. There are no known exploits in the wild and no information about patches or fixes is currently available.

A syntax error in the proxy_tensor.py component of PyTorch version 2.7.0 can cause a Denial of Service (DoS) condition. This vulnerability does not impact confidentiality or integrity but can disrupt availability by crashing or halting the affected software.

PyTorch version 2.8.0 exhibits unexpected behavior when the functions torch.rot90 and torch.randn_like are used together. This issue does not impact confidentiality or integrity but may cause availability problems. The vulnerability is classified under CWE-682 (Incorrect Calculation). No official patch or remediation details are currently available.