Andrej Nemec

Name of the Vulnerable Software and Affected Versions: node-uuid versions prior to 1.4.4 Description: The issue is related to the generation of GUIDs using insufficiently random data, which could make it easier for attackers to have an unspecified impact via brute force guessing. Affected versions of `node-uuid` consistently fall back to using `Math.random` as an entropy source instead of `crypto`, resulting in potentially guessable UUIDs. Recommendations: Update to version 1.4.4 or later. As a temporary workaround, consider avoiding the use of `node-uuid` for generating sensitive identifiers until the issue is resolved. Restrict access to applications using `node-uuid` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PowerDNS Recursor versions prior to 4.1.8 **Description** A remote attacker can trigger an out-of-bounds memory read by sending a DNS query, which can cause a crash while the software computes the hash of the query for a packet cache lookup. **Recommendations** For versions prior to 4.1.8, update to version 4.1.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** KDE Applications versions prior to 18.12.0 **Description** The issue allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address. This is related to the HTML thumbnailer plugin. **Recommendations** For versions prior to 18.12.0, update to version 18.12.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Ansible Tower versions prior to 3.0.3 **Description** A privilege escalation flaw was found in Ansible Tower, where it incorrectly configures the trust level of the `postgres` user when deploying a PostgreSQL database. This allows an attacker to gain admin level access to the database. **Recommendations** For versions prior to 3.0.3, update to version 3.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the PostgreSQL database to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Samba versions 4.9.0 through 4.9.3 Description: The issue is related to the configuration of AD DC in Samba, where the mechanism for watching bad passwords to restrict brute forcing may not function as intended if the window for monitoring is set to more than 3 minutes. This primarily poses a risk to domains that have been upgraded from Samba 4.8 and earlier, as the password policies may not have been re-tested after the upgrade. The vulnerability is associated with an incorrect implementation of security checks for standard system elements, which could allow a remote attacker to compromise the integrity of information. Recommendations: For Samba versions 4.9.0 through 4.9.3, consider re-configuring the password watching mechanism to ensure it functions correctly, especially in domains upgraded from Samba 4.8 and earlier. As a temporary workaround, manual testing of password policies should be re-done after the upgrade to confirm they apply as expected. Additionally, restrict access to the AD DC configuration to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Openstack Glance (affected versions not specified) **Description** A vulnerability was found in Openstack Glance where no limits are enforced within the Glance image service for both v1 and v2 "/images" API POST method for authenticated users. This could result in possible denial of service attacks through database table saturation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** JBoss EAP versions prior to 7.0.9 **Description** A security issue was discovered where properties-based files for management and application realm configurations, containing user-to-role mappings, are world-readable. This allows all logged-in users to access user and role information. **Recommendations** For versions prior to 7.0.9, update to version 7.0.9 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** The issue is related to a double free error in the snd rawmidi ioctl() handler, specifically in the rawmidi.c file, which can be exploited by a malicious local attacker for privilege escalation. This could potentially impact the confidentiality, integrity, and availability of protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foreman versions prior to 1.16.1 **Description** An input sanitization flaw was found in the `id` field in the dashboard controller. This flaw could be used to perform an SQL injection attack on the back end database. **Recommendations** For versions prior to 1.16.1, update to version 1.16.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the dashboard controller to minimize the risk of exploitation. Avoid using the `id` field in the dashboard controller until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Graphviz version 2.40.1 **Description** The issue is related to a NULL pointer dereference vulnerability in the rebuild vlists function in lib/dotgen/conc.c in the dotgen library. This vulnerability allows remote attackers to cause a denial of service, resulting in an application crash, via a crafted file. **Recommendations** For Graphviz version 2.40.1, consider disabling the rebuild vlists function in lib/dotgen/conc.c as a temporary workaround until a patch is available. Restrict access to crafted files that could exploit this vulnerability to minimize the risk of denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 0.8.1 **Description** The issue concerns a Cross-Site Scripting (XSS) vulnerability in the ` keyify` function. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML by exploiting the failure to escape the `key` argument. **Recommendations** For versions prior to 0.8.1, update to version 0.8.1 or later to resolve the issue. As a temporary workaround, consider restricting the input to the ` keyify` function to minimize the risk of exploitation. Avoid using the `key` argument in sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** cobbler version 2.6.11-1 **Description** A flaw in the cobbler software component leads to an invalid parameter validation issue, resulting in arbitrary file reading. This issue is triggered by navigating to a vulnerable URL via cobbler-web on a default installation. **Recommendations** For version 2.6.11-1, consider restricting access to cobbler-web to minimize the risk of exploitation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** libreswan versions prior to 3.18 **Description** The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and a restart of the pluto daemon. **Recommendations** For versions prior to 3.18, update to version 3.18 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Irregex versions prior to 0.9.6 **Description** The issue allows remote attackers to cause a denial of service, specifically memory consumption, by utilizing a crafted regular expression that contains a repeating pattern. **Recommendations** For versions prior to 0.9.6, update to version 0.9.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** oVirt Engine versions prior to 4.0.3 **Description** The issue allows local users to obtain sensitive password information by reading engine log files, as the `DWH DB PASSWORD` is not included in the list of keys to hide in log files. **Recommendations** For versions prior to 4.0.3, update to version 4.0.3 or later to include `DWH DB PASSWORD` in the list of keys to hide in log files, preventing local users from obtaining sensitive password information.

**Name of the Vulnerable Software and Affected Versions** botan versions 1.11.x through 1.11.21 **Description** The issue improperly handles wildcard matching against hostnames. This might allow remote attackers to have an unspecified impact via a valid X.509 certificate, as demonstrated by accepting *.example.com as a match for bar.foo.example.com. **Recommendations** For botan versions 1.11.x through 1.11.21, update to version 1.11.22 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** botan versions 1.11.x through 1.11.21 **Description** The issue makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites. **Recommendations** For botan versions 1.11.x through 1.11.21, update to version 1.11.22 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** botan versions prior to 1.11.22 **Description** The issue is related to improper validation of certificate paths, which can lead to a denial of service due to an infinite loop and memory consumption. This can be triggered by a certificate with a loop in the certificate chain. **Recommendations** For versions prior to 1.11.22, update to version 1.11.22 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SaltStack Salt versions prior to 2016.3.8 SaltStack Salt versions 2016.11.x prior to 2016.11.8 SaltStack Salt versions 2017.7.x prior to 2017.7.2 **Description** A directory traversal vulnerability exists in the minion id validation of SaltStack Salt, allowing remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. **Recommendations** For versions prior to 2016.3.8, update to version 2016.3.8 or later. For versions 2016.11.x prior to 2016.11.8, update to version 2016.11.8 or later. For versions 2017.7.x prior to 2017.7.2, update to version 2017.7.2 or later.

Name of the Vulnerable Software and Affected Versions: Pulp versions prior to 2.3.0 Description: The issue arises from Pulp using the same certificate authority key and certificate across all installations. This could potentially lead to security issues due to the lack of unique identification and authentication for each installation. Recommendations: For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue.