Read Time:1 Second
Post Content
Category Archives: Advisories
pytest-8.3.4-1.fc41
Read Time:6 Second
FEDORA-2024-b747462264
Packages in this update:
pytest-8.3.4-1.fc41
Update description:
Update to pytest 8.3.4
ZDI-24-1645: Progress Software WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
Read Time:13 Second
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2024-46909.
ZDI-24-1644: (Pwn2Own) iXsystems TrueNAS fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability
Read Time:14 Second
This vulnerability allows network-adjacent attackers to tamper with firmware update files on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.1. The following CVEs are assigned: CVE-2024-11946.
ZDI-24-1643: (Pwn2Own) iXsystems TrueNAS tarfile.extractall Directory Traversal Remote Code Execution Vulnerability
Read Time:13 Second
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-11944.
DSA-5825-1 ceph – security update
Read Time:9 Second
Sage McTaggart discovered an authentication bypass in radosgw, the RADOS
REST gateway of Ceph, a distributed storage and file system.
DSA-5824-1 chromium – security update
Read Time:9 Second
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
python-virtualenv-20.21.1-14.el9
Read Time:9 Second
FEDORA-EPEL-2024-08d8c17c5d
Packages in this update:
python-virtualenv-20.21.1-14.el9
Update description:
Security fix for CVE-2024-53899
Fix for virtualenv –seeder pip –python=python3.12
USN-7117-3: needrestart regression
Read Time:57 Second
USN-7117-1 fixed vulnerabilities in needrestart. The update introduced a
regression in needrestart. This update fixes the problem for LXC
containers.
We apologize for the inconvenience.
Original advisory details:
Qualys discovered that needrestart passed unsanitized data to a library
(libmodule-scandeps-perl) which expects safe input. A local attacker could
possibly use this issue to execute arbitrary code as root.
(CVE-2024-11003)
Qualys discovered that the library libmodule-scandeps-perl incorrectly
parsed perl code. This could allow a local attacker to execute arbitrary
shell commands. (CVE-2024-10224)
Qualys discovered that needrestart incorrectly used the PYTHONPATH
environment variable to spawn a new Python interpreter. A local attacker
could possibly use this issue to execute arbitrary code as root.
(CVE-2024-48990)
Qualys discovered that needrestart incorrectly checked the path to the
Python interpreter. A local attacker could possibly use this issue to win
a race condition and execute arbitrary code as root. (CVE-2024-48991)
Qualys discovered that needrestart incorrectly used the RUBYLIB
environment variable to spawn a new Ruby interpreter. A local attacker
could possibly use this issue to execute arbitrary code as root.
(CVE-2024-48992)
python3.13-3.13.1-1.fc40
Read Time:42 Second
FEDORA-2024-be6ea1ce44
Packages in this update:
python3.13-3.13.1-1.fc40
Update description:
This is the first maintenance release of Python 3.13
Python 3.13 is the newest major release of the Python programming language, and it contains many new features and optimizations compared to Python 3.12. 3.13.1 is the latest maintenance release, containing almost 400 bugfixes, build improvements and documentation changes since 3.13.0.
Security content in this release
gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.
CVE-2024-9287: gh-124651: Properly quote template strings in venv activation scripts.
gh-125140: Remove the current directory from sys.path when using PyREPL.