Vulnerability from csaf_opensuse
Published
2024-11-20 00:00
Modified
2024-11-20 00:00
Summary
govulncheck-vulndb-0.0.20241119T173509-1.1 on GA media

Notes

Title of the patch
govulncheck-vulndb-0.0.20241119T173509-1.1 on GA media
Description of the patch
These are all security issues fixed in the govulncheck-vulndb-0.0.20241119T173509-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-14513
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "govulncheck-vulndb-0.0.20241119T173509-1.1 on GA media",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "These are all security issues fixed in the govulncheck-vulndb-0.0.20241119T173509-1.1 package on the GA media of openSUSE Tumbleweed.",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-Tumbleweed-2024-14513",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_14513-1.json",
         },
         {
            category: "self",
            summary: "URL for openSUSE-SU-2024:14513-1",
            url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CJ6SUNDNOZSHM4PZYYGMBH7233D63JOI/",
         },
         {
            category: "self",
            summary: "E-Mail link for openSUSE-SU-2024:14513-1",
            url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CJ6SUNDNOZSHM4PZYYGMBH7233D63JOI/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-8911 page",
            url: "https://www.suse.com/security/cve/CVE-2020-8911/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2023-0109 page",
            url: "https://www.suse.com/security/cve/CVE-2023-0109/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-0793 page",
            url: "https://www.suse.com/security/cve/CVE-2024-0793/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-24425 page",
            url: "https://www.suse.com/security/cve/CVE-2024-24425/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-24426 page",
            url: "https://www.suse.com/security/cve/CVE-2024-24426/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-44625 page",
            url: "https://www.suse.com/security/cve/CVE-2024-44625/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-52010 page",
            url: "https://www.suse.com/security/cve/CVE-2024-52010/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-52308 page",
            url: "https://www.suse.com/security/cve/CVE-2024-52308/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-52522 page",
            url: "https://www.suse.com/security/cve/CVE-2024-52522/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-9526 page",
            url: "https://www.suse.com/security/cve/CVE-2024-9526/",
         },
      ],
      title: "govulncheck-vulndb-0.0.20241119T173509-1.1 on GA media",
      tracking: {
         current_release_date: "2024-11-20T00:00:00Z",
         generator: {
            date: "2024-11-20T00:00:00Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2024:14513-1",
         initial_release_date: "2024-11-20T00:00:00Z",
         revision_history: [
            {
               date: "2024-11-20T00:00:00Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                        product: {
                           name: "govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                           product_id: "govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                        product: {
                           name: "govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                           product_id: "govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                        product: {
                           name: "govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                           product_id: "govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
                        product: {
                           name: "govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
                           product_id: "govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Tumbleweed",
                        product: {
                           name: "openSUSE Tumbleweed",
                           product_id: "openSUSE Tumbleweed",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:tumbleweed",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
            },
            product_reference: "govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
            },
            product_reference: "govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "govulncheck-vulndb-0.0.20241119T173509-1.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
            },
            product_reference: "govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
            },
            product_reference: "govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2020-8911",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-8911",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-8911",
               url: "https://www.suse.com/security/cve/CVE-2020-8911",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.6,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-11-20T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-8911",
      },
      {
         cve: "CVE-2023-0109",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2023-0109",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2023-0109",
               url: "https://www.suse.com/security/cve/CVE-2023-0109",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-11-20T00:00:00Z",
               details: "critical",
            },
         ],
         title: "CVE-2023-0109",
      },
      {
         cve: "CVE-2024-0793",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-0793",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-0793",
               url: "https://www.suse.com/security/cve/CVE-2024-0793",
            },
            {
               category: "external",
               summary: "SUSE Bug 1219964 for CVE-2024-0793",
               url: "https://bugzilla.suse.com/1219964",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-11-20T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-0793",
      },
      {
         cve: "CVE-2024-24425",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-24425",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amf/amf_as.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-24425",
               url: "https://www.suse.com/security/cve/CVE-2024-24425",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-11-20T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-24425",
      },
      {
         cve: "CVE-2024-24426",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-24426",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Reachable assertions in the NGAP_FIND_PROTOCOLIE_BY_ID function of OpenAirInterface Magma v1.8.0 and OAI EPC Federation v1.2.0 allow attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-24426",
               url: "https://www.suse.com/security/cve/CVE-2024-24426",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-11-20T00:00:00Z",
               details: "not set",
            },
         ],
         title: "CVE-2024-24426",
      },
      {
         cve: "CVE-2024-44625",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-44625",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-44625",
               url: "https://www.suse.com/security/cve/CVE-2024-44625",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-11-20T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-44625",
      },
      {
         cve: "CVE-2024-52010",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-52010",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH servers from their browsers. In HandleCreateProxySession the request to create an SSH session is handled. An attacker can exploit the username variable to escape from the bash command and inject arbitrary commands into sshCommand. This is possible, because, unlike hostname and port, the username is not validated or sanitized.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-52010",
               url: "https://www.suse.com/security/cve/CVE-2024-52010",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-11-20T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-52010",
      },
      {
         cve: "CVE-2024-52308",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-52308",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0.\n\nDevelopers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the [default devcontainer image]( https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-... https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers#using-the-default-dev-container-configuration) . GitHub CLI [retrieves SSH connection details]( https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/inv... https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/invoker.go#L230-L244 ), such as remote username, which is used in [executing `ssh` commands]( https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L2... https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L263 ) for `gh codespace ssh` or `gh codespace logs` commands.\n\nThis exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects `ssh` arguments within the SSH connection details. `gh codespace ssh` and `gh codespace logs` commands could execute arbitrary code on the user's workstation if the remote username contains something like `-oProxyCommand=\"echo hacked\" #`.  The `-oProxyCommand` flag causes `ssh` to execute the provided command while `#` shell comment causes any other `ssh` arguments to be ignored.\n\nIn `2.62.0`, the remote username information is being validated before being used.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-52308",
               url: "https://www.suse.com/security/cve/CVE-2024-52308",
            },
            {
               category: "external",
               summary: "SUSE Bug 1233387 for CVE-2024-52308",
               url: "https://bugzilla.suse.com/1233387",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.6,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-11-20T00:00:00Z",
               details: "critical",
            },
         ],
         title: "CVE-2024-52308",
      },
      {
         cve: "CVE-2024-52522",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-52522",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-52522",
               url: "https://www.suse.com/security/cve/CVE-2024-52522",
            },
            {
               category: "external",
               summary: "SUSE Bug 1233422 for CVE-2024-52522",
               url: "https://bugzilla.suse.com/1233422",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-11-20T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-52522",
      },
      {
         cve: "CVE-2024-9526",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-9526",
            },
         ],
         notes: [
            {
               category: "general",
               text: "There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI.  The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit  930c35f1c543998e60e8d648ce93185c9b5dbe8d",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
               "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-9526",
               url: "https://www.suse.com/security/cve/CVE-2024-9526",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.aarch64",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.ppc64le",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.s390x",
                  "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241119T173509-1.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-11-20T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-9526",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.