sha.js could be made to consume resources or return incorrect hash values if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-7778-1 September 25, 2025 node-sha.js vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.04 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: sha.js could be made to consume resources or return incorrect hash values if it received specially crafted input. Software Description: - node-sha.js: Streamable SHA hashes in pure javascript Details: Nikita Skovoroda discovered that sha.js did not properly handle certain inputs. An attacker could possibly use this issue to manipulate the internal state of hash functions, resulting in hash collisions, denial of service, or other unspecified impact. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.04 node-sha.js 2.4.11+~2.4.0-2+deb13u1build0.25.04.1 Ubuntu 24.04 LTS node-sha.js 2.4.11+~2.4.0-2+deb13u1build0.24.04.1 Ubuntu 22.04 LTS node-sha.js 2.4.11+~2.4.0-1ubuntu0.1 Ubuntu 20.04 LTS node-sha.js 2.4.11-2ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS node-sha.js 2.4.9-1ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7778-1 CVE-2025-9288 Package Information: https://launchpad.net/ubuntu/+source/node-sha.js/2.4.11+~2.4.0-2+deb13u1build0.25.04.1 https://launchpad.net/ubuntu/+source/node-sha.js/2.4.11+~2.4.0-2+deb13u1build0.24.04.1 https://launchpad.net/ubuntu/+source/node-sha.js/2.4.11+~2.4.0-1ubuntu0.1 .Upgrade Ubuntu installations to address the significant sha.js vulnerability which leads to excessive resource usage or invalid hash results.. ubuntu sha.js denial of service hash collision security fix. . Severity: Critical. LinuxSecurity.com Team
Hash collisions in IPv4Interface and IPv6Interface could lead to DOS (CVE-2020-14422). References: - https://bugs.mageia.org/show_bug.cgi?id=27056 . MGASA-2020-0343 - Updated python-ipaddress package fixes security vulnerability Publication date: 25 Aug 2020 URL: https://advisories.mageia.org/MGASA-2020-0343.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-14422 Hash collisions in IPv4Interface and IPv6Interface could lead to DOS (CVE-2020-14422). References: - https://bugs.mageia.org/show_bug.cgi?id=27056 - - https://www.cve.org/CVERecord?id=CVE-2020-14422 SRPMS: - 7/core/python-ipaddress-1.0.22-1.1.mga7 . The python-ipaddress library has released an update that resolves a significant hash collision vulnerability, which posed a risk for denial-of-service attacks. For more information, read on.. python ipaddress, security update, hash collision, DOS attack. . LinuxSecurity.com Team
Security fix for CVE-2019-20907, CVE-2020-14422. Provide a versioned pathfix3.7.py command.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-d808fdd597 2020-08-14 02:43:09.714652 --------------------------------------------------------------------------------Name : python3 Product : Fedora 31 Version : 3.7.8 Release : 2.fc31 URL : https://www.python.org/ Summary : Interpreter of the Python programming language Description : Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3 package provides the "python3" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3-libs package, which should be installed automatically along with python3. The remaining parts of the Python standard library are broken out into the python3-tkinter and python3-test packages, which may need to be installed separately. Documentation for Python is provided in the python3-docs package. Packages containing additional libraries for Python are generally named with the "python3-" prefix. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2019-20907, CVE-2020-14422. Provide a versioned pathfix3.7.py command. --------------------------------------------------------------------------------ChangeLog: * Tue Jul 28 2020 Charalampos Stratakis - 3.7.8-2 - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907) Resolves: rhbz#1856481 - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422) Resolves: rhbz#1854926 - Ship versioned pathfixX.Y.py in main and non-main Pythonversions --------------------------------------------------------------------------------References: [ 1 ] Bug #1854926 - CVE-2020-14422 python: DoS via inefficiency in IPv{4,6}Interface classes https://bugzilla.redhat.com/show_bug.cgi?id=1854926 [ 2 ] Bug #1856481 - CVE-2019-20907 python: infinite loop in the tarfile module via crafted TAR archive https://bugzilla.redhat.com/show_bug.cgi?id=1856481 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-d808fdd597' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Updates for rh-dotnet20-dotnet, rh-dotnetcore10-dotnetcore, and rh-dotnetcore11-dotnetcore are now available for .NET Core on Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Low: .NET Core on Red Hat Enterprise Linux security update Advisory ID: RHSA-2018:0522-01 Product: .NET Core on Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:0522 Issue date: 2018-03-14 CVE Names: CVE-2018-0875 ==================================================================== 1. Summary: Updates for rh-dotnet20-dotnet, rh-dotnetcore10-dotnetcore, and rh-dotnetcore11-dotnetcore are now available for .NET Core on Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 .NET Core on Red Hat Enterprise Linux Server (v. 7) - x86_64 .NET Core on Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: .NET Core is a managed software framework. It implements a subset of the .NET framework APIs and includes a CLR implementation. New versions of .NET Core that address several security vulnerabilities are now available. The updated versions are .NET Core 1.0.10, 1.1.7, and 2.0.6. These correspond to the March 2018 security release by .NET Core upstream projects. Security Fix(es): * .NET Core: Hash Collision Denial of Service (CVE-2018-0875) Red Hat would like to thank Ben Adams (Illyriad Games) for reporting this issue. For more details about the security issue(s), including the impact, aCVSS score, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1552060 - CVE-2018-0875 .NET Core: Hash Collision Denial of Service 6. Package List: .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7): Source: rh-dotnetcore10-dotnetcore-1.0.10-1.el7.src.rpm x86_64: rh-dotnetcore10-dotnetcore-1.0.10-1.el7.x86_64.rpm rh-dotnetcore10-dotnetcore-debuginfo-1.0.10-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7): Source: rh-dotnetcore11-dotnetcore-1.1.7-1.el7.src.rpm x86_64: rh-dotnetcore11-dotnetcore-1.1.7-1.el7.x86_64.rpm rh-dotnetcore11-dotnetcore-debuginfo-1.1.7-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7): Source: rh-dotnet20-dotnet-2.0.6-1.el7.src.rpm x86_64: rh-dotnet20-dotnet-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-debuginfo-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-host-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-runtime-2.0-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-sdk-2.1-2.1.101-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux Server (v. 7): Source: rh-dotnetcore10-dotnetcore-1.0.10-1.el7.src.rpm x86_64: rh-dotnetcore10-dotnetcore-1.0.10-1.el7.x86_64.rpm rh-dotnetcore10-dotnetcore-debuginfo-1.0.10-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux Server (v. 7): Source: rh-dotnetcore11-dotnetcore-1.1.7-1.el7.src.rpm x86_64: rh-dotnetcore11-dotnetcore-1.1.7-1.el7.x86_64.rpm rh-dotnetcore11-dotnetcore-debuginfo-1.1.7-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux Server (v.7): Source: rh-dotnet20-dotnet-2.0.6-1.el7.src.rpm x86_64: rh-dotnet20-dotnet-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-debuginfo-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-host-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-runtime-2.0-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-sdk-2.1-2.1.101-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux Workstation (v. 7): Source: rh-dotnetcore10-dotnetcore-1.0.10-1.el7.src.rpm x86_64: rh-dotnetcore10-dotnetcore-1.0.10-1.el7.x86_64.rpm rh-dotnetcore10-dotnetcore-debuginfo-1.0.10-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux Workstation (v. 7): Source: rh-dotnetcore11-dotnetcore-1.1.7-1.el7.src.rpm x86_64: rh-dotnetcore11-dotnetcore-1.1.7-1.el7.x86_64.rpm rh-dotnetcore11-dotnetcore-debuginfo-1.1.7-1.el7.x86_64.rpm .NET Core on Red Hat Enterprise Linux Workstation (v. 7): Source: rh-dotnet20-dotnet-2.0.6-1.el7.src.rpm x86_64: rh-dotnet20-dotnet-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-debuginfo-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-host-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-runtime-2.0-2.0.6-1.el7.x86_64.rpm rh-dotnet20-dotnet-sdk-2.1-2.1.101-1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2018-0875 https://access.redhat.com/security/updates/classification#low 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFaqUTsXlSAg2UNWIIRAuzUAKCDhqW/mE1ZwG1Bv9JVc2oVTo7cngCfUnVc slFh/sAwzwax82xICfw1G1M=37s1 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
An update for rh-nodejs6-nodejs is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-nodejs6-nodejs security update Advisory ID: RHSA-2017:2908-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2017:2908 Issue date: 2017-10-18 CVE Names: CVE-2017-11499 ==================================================================== 1. Summary: An update for rh-nodejs6-nodejs is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Description: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: rh-nodejs6-nodejs (6.11.3). (BZ#1476317) Security Fix(es): * It was found that Node.js was using a non-randomizedseed when populating hash tables. An attacker, able to supply a large number of inputs, could send specially crafted entries to the Node.js application, maximizing hash collisions to trigger an excessive amount of CPU usage, resulting in a denial of service. (CVE-2017-11499) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1475327 - CVE-2017-11499 nodejs: Constant Hashtable Seeds vulnerability 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: rh-nodejs6-nodejs-6.11.3-2.el6.src.rpm noarch: rh-nodejs6-nodejs-docs-6.11.3-2.el6.noarch.rpm x86_64: rh-nodejs6-nodejs-6.11.3-2.el6.x86_64.rpm rh-nodejs6-nodejs-debuginfo-6.11.3-2.el6.x86_64.rpm rh-nodejs6-nodejs-devel-6.11.3-2.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: rh-nodejs6-nodejs-6.11.3-2.el6.src.rpm noarch: rh-nodejs6-nodejs-docs-6.11.3-2.el6.noarch.rpm x86_64: rh-nodejs6-nodejs-6.11.3-2.el6.x86_64.rpm rh-nodejs6-nodejs-debuginfo-6.11.3-2.el6.x86_64.rpm rh-nodejs6-nodejs-devel-6.11.3-2.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: rh-nodejs6-nodejs-6.11.3-2.el6.src.rpm noarch: rh-nodejs6-nodejs-docs-6.11.3-2.el6.noarch.rpm x86_64: rh-nodejs6-nodejs-6.11.3-2.el6.x86_64.rpm rh-nodejs6-nodejs-debuginfo-6.11.3-2.el6.x86_64.rpm rh-nodejs6-nodejs-devel-6.11.3-2.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-nodejs6-nodejs-6.11.3-2.el7.src.rpm noarch: rh-nodejs6-nodejs-docs-6.11.3-2.el7.noarch.rpm x86_64: rh-nodejs6-nodejs-6.11.3-2.el7.x86_64.rpm rh-nodejs6-nodejs-debuginfo-6.11.3-2.el7.x86_64.rpm rh-nodejs6-nodejs-devel-6.11.3-2.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v.7.3): Source: rh-nodejs6-nodejs-6.11.3-2.el7.src.rpm noarch: rh-nodejs6-nodejs-docs-6.11.3-2.el7.noarch.rpm x86_64: rh-nodejs6-nodejs-6.11.3-2.el7.x86_64.rpm rh-nodejs6-nodejs-debuginfo-6.11.3-2.el7.x86_64.rpm rh-nodejs6-nodejs-devel-6.11.3-2.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-nodejs6-nodejs-6.11.3-2.el7.src.rpm noarch: rh-nodejs6-nodejs-docs-6.11.3-2.el7.noarch.rpm x86_64: rh-nodejs6-nodejs-6.11.3-2.el7.x86_64.rpm rh-nodejs6-nodejs-debuginfo-6.11.3-2.el7.x86_64.rpm rh-nodejs6-nodejs-devel-6.11.3-2.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-11499 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFZ5wgTXlSAg2UNWIIRAjr0AKCktmtDIRE7ArlXEpBANfCnZBp0nQCggwVi mNsMtsRQP3PlvvgN4fizpvU=oUtq -----END PGP SIGNATURE----- -- RHSA-announce mailing list
A hash collision vulnerability in Mono allows remote attackers to cause a Denial of Service condition.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201405-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Mono: Denial of Service Date: May 18, 2014 Bugs: #433768 ID: 201405-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A hash collision vulnerability in Mono allows remote attackers to cause a Denial of Service condition. Background ========= Mono is an open source implementation of Microsoft's .NET Framework. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-lang/mono < 2.10.9-r2 > = 2.10.9-r2 Description ========== Mono does not properly randomize hash functions for form posts to protect against hash collision attacks. Impact ===== A remote attacker could send specially crafted parameters, possibly resulting in a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All Mono users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-lang/mono-2.10.9-r2" References ========= [ 1 ] CVE-2012-3543 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3543 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201405-16 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security ofour users' machines is of utmost importance to us. Any security concerns should be addressed to
It was discovered that Expat, a C library to parse XML, is vulnerable to denial of service through hash collisions and a memory leak in pool handling. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2525-1
A hash collision vulnerability in JRuby allows remote attackers to cause a Denial of Service condition.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201207-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: JRuby: Denial of Service Date: July 09, 2012 Bugs: #396305 ID: 201207-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A hash collision vulnerability in JRuby allows remote attackers to cause a Denial of Service condition. Background ========= JRuby is a Java-based Ruby interpreter implementation. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-java/jruby < 1.6.5.1 > = 1.6.5.1 Description ========== JRuby does not properly randomize hash functions to protect against hash collision attacks. Impact ===== A remote attacker could send a specially crafted input, possibly resulting in a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All JRuby users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-java/jruby-1.6.5.1" References ========= [ 1 ] CVE-2011-4838 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4838 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201207-06 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is ofutmost importance to us. Any security concerns should be addressed to
Get the latest Linux and open source security news straight to your inbox.