Threats Tagged 'ubuntu-pro-24-04-lts'

These are all security issues fixed in the expat-2.9.0-1.1 package on the GA media of openSUSE Tumbleweed.

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

FreeRDP versions prior to 3.31.0 contain a heap buffer overflow vulnerability in the nego_send_negotiation_request() function. This occurs because the LB_LOAD_BALANCE_INFO field length is not properly validated before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can exploit this by sending a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value, potentially causing denial of service or heap corruption before authentication completes. Red Hat has issued a security update addressing this vulnerability.

FreeRDP versions prior to 3.31.0 contain a vulnerability where uninitialized heap memory is transmitted in reserved padding fields of the Save Session Info PDU. This occurs because certain PDU writers use Stream_Seek instead of zeroing the reserved padding bytes, potentially leaking stale heap data including cleartext credentials from previous sessions. This affects FreeRDP-based servers and proxies that forward these PDUs, allowing disclosure of server or proxy process memory to downstream clients. A security update addressing this issue is available.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library. This release of Red Hat JBoss Web Server 6.2.5 serves as a replacement for Red Hat JBoss Web Server 6.2.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section. Security Fix(es): * tomcat-catalina: Apache Tomcat: Misleading security logs due to incorrect control flow (CVE-2026-55276) * tomcat-coyote-ffm: Apache Tomcat: Error condition not handled when configuring CRL (CVE-2026-53434) * jws6-tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) * tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183) * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763) * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525) * tomcat: Apache Tomcat - DoS in WebSocket chat example (CVE-2026-66299) * tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination (CVE-2026-73180) * tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints (CVE-2026-66422) * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of public key authentication. Other Apache MINA SSHD servers are not affected. Lack of escaping LDAP filter metacharacters enabled successful authentication with username "*" and password "*". Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue by properly escaping filter parameters according to RFC 4515.