Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
202
security advisorymoderatedenial of serviceopenSUSE Leap 15.2: 2021-0066-1 Moderate Nodejs14 DoS Vulnerability Alert
An update that fixes three vulnerabilities is now available. . openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0066-1 Rating: moderate References: #1178882 #1180553 #1180554 Cross-References: CVE-2020-8265 CVE-2020-8277 CVE-2020-8287 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: - New upstream LTS version 14.15.4: * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits (bsc#1180553) * CVE-2020-8287: HTTP Request Smuggling allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling (https://cwe.mitre.org/data/definitions/444.html). (bsc#1180554) - New upstream LTS version 14.15.3: * deps: + upgrade npm to 6.14.9 + update acorn to v8.0.4 * http2: check write not scheduled in scope destructor * stream: fix regression on duplex end - New upstream LTS version 14.15.1: * deps: Denial of Service through DNS request (High). A Node.js application that allows an attacker to trigger a DNS request for a host of their choice couldtrigger a Denial of Service by getting the application to resolve a DNS record with a larger number of responses (bsc#1178882, CVE-2020-8277) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-66=1 Package List: - openSUSE Leap 15.2 (noarch): nodejs14-docs-14.15.4-lp152.5.1 - openSUSE Leap 15.2 (x86_64): nodejs14-14.15.4-lp152.5.1 nodejs14-debuginfo-14.15.4-lp152.5.1 nodejs14-debugsource-14.15.4-lp152.5.1 nodejs14-devel-14.15.4-lp152.5.1 npm14-14.15.4-lp152.5.1 References: https://www.suse.com/security/cve/CVE-2020-8265.html https://www.suse.com/security/cve/CVE-2020-8277.html https://www.suse.com/security/cve/CVE-2020-8287.html https://bugzilla.suse.com/1178882 https://bugzilla.suse.com/1180553 https://bugzilla.suse.com/1180554 . Essential patch for nodejs14 on openSUSE to mitigate three security concerns, particularly focusing on DNS as well as HTTP-related flaws.. openSUSE,nodejs,security update,exploit fix. . Severity: Important. LinuxSecurity.com Team
Jan 15, 2021
•Important
OpenSUSE
197
security advisorymoderateDebianDebian 8: DLA-1399-1 Moderate: Ruby-Passenger HTTP Exploits Fix
Two flaws were discovered in ruby-passenger for Ruby Rails and Rack support that allowed attackers to spoof HTTP headers or exploit a race condition which made privilege escalation under certain conditions possible. . Package : ruby-passenger Version : 4.0.53-1+deb8u1 CVE ID : CVE-2015-7519 CVE-2018-12029 Debian Bug : 864651 Two flaws were discovered in ruby-passenger for Ruby Rails and Rack support that allowed attackers to spoof HTTP headers or exploit a race condition which made privilege escalation under certain conditions possible. CVE-2015-7519 Remote attackers could spoof headers passed to applications by using an underscore character instead of a dash character in an HTTP header as demonstrated by an X_User header. CVE-2018-12029 A vulnerability was discovered by the Pulse Security team. It was exploitable only when running a non-standard passenger_instance_registry_dir, via a race condition where after a file was created, there was a window in which it could be replaced with a symlink before it was chowned via the path and not the file descriptor. If the symlink target was to a file which would be executed by root such as root's crontab file, then privilege escalation was possible. This is now mitigated by using fchown(). For Debian 8 "Jessie", these problems have been fixed in version 4.0.53-1+deb8u1. We recommend that you upgrade your ruby-passenger packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Recent vulnerabilities in ruby-passenger reveal risks of HTTP header spoofing and unauthorized privilege escalation, making immediate updates crucial for security.. ruby passenger security,debian package update,http header exploits. . LinuxSecurity.com Team
Jun 27, 2018
Debian LTS
87
security advisorycriticaldebianDebian: DSA-3745-1 Urgent: Threat of Squid3 Cookie Information Leak
Saulius Lapinskas from Lithuanian State Social Insurance Fund Board discovered that Squid3, a fully featured web proxy cache, does not properly process responses to If-None-Modified HTTP conditional requests, leading to client-specific Cookie data being leaked to other . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3745-1
Dec 24, 2016
•Critical
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!