Security update for govulncheck-vulndb SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:0350-1 Final 1 1 2024-11-05T14:52:20Z current 2024-11-05T14:52:20Z 2024-11-05T14:52:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for govulncheck-vulndb This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww * GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97 * GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r * GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch * GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq * GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw * GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h * GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh * GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj - Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g * GO-2024-3245 CVE-2024-39720 * GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v - Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm * GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh - Update to version 0.0.20241030T160108 2024-10-30T16:01:08Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr * GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c * GO-2024-3228 GHSA-wcx9-ccpj-hx3c - Packaging improvments: * Backfill CVE aliases in recent changelog entries - Update to version 0.0.20241028T152002 2024-10-28T15:20:02Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3207 GHSA-p5wf-cmr4-xrwr * GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6 * GO-2024-3210 CVE-2024-8901 * GO-2024-3211 CVE-2024-50312 * GO-2024-3212 GHSA-rjfv-pjvx-mjgv * GO-2024-3213 CVE-2024-49380 * GO-2024-3214 CVE-2024-49381 * GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7 * GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv * GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc * GO-2024-3219 GHSA-7h65-4p22-39j6 * GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4 * GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc * GO-2024-3222 GHSA-x7xj-jvwp-97rv * GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v * GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r - Update to version 0.0.20241017T153730 date 2024-10-17T15:37:30Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8 * GO-2024-3203 CVE-2024-9486 * GO-2024-3204 CVE-2024-9594 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8 * GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc * GO-2024-3199 GHSA-vv6c-69r6-chg9 * GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj * GO-2024-3201 CVE-2023-22644 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j * GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6 Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4 * GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3 * GO-2024-3163 CVE-2024-47182 * GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j * GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52 * GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h * GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc * GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4 * GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8 * GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4 * GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x * GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq * GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787 * GO-2024-3182 GHSA-wpr2-j6gr-pjw9 * GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m * GO-2024-3185 CVE-2024-47832 * GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2 * GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226 * GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2024-350 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ E-Mail link for openSUSE-SU-2024:0350-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2022-45157/ SUSE CVE CVE-2022-45157 page https://www.suse.com/security/cve/CVE-2023-22644/ SUSE CVE CVE-2023-22644 page https://www.suse.com/security/cve/CVE-2023-32197/ SUSE CVE CVE-2023-32197 page https://www.suse.com/security/cve/CVE-2024-0132/ SUSE CVE CVE-2024-0132 page https://www.suse.com/security/cve/CVE-2024-0133/ SUSE CVE CVE-2024-0133 page https://www.suse.com/security/cve/CVE-2024-10005/ SUSE CVE CVE-2024-10005 page https://www.suse.com/security/cve/CVE-2024-10006/ SUSE CVE CVE-2024-10006 page https://www.suse.com/security/cve/CVE-2024-10086/ SUSE CVE CVE-2024-10086 page https://www.suse.com/security/cve/CVE-2024-10214/ SUSE CVE CVE-2024-10214 page https://www.suse.com/security/cve/CVE-2024-10241/ SUSE CVE CVE-2024-10241 page https://www.suse.com/security/cve/CVE-2024-10452/ SUSE CVE CVE-2024-10452 page https://www.suse.com/security/cve/CVE-2024-22030/ SUSE CVE CVE-2024-22030 page https://www.suse.com/security/cve/CVE-2024-22036/ SUSE CVE CVE-2024-22036 page https://www.suse.com/security/cve/CVE-2024-33662/ SUSE CVE CVE-2024-33662 page https://www.suse.com/security/cve/CVE-2024-36814/ SUSE CVE CVE-2024-36814 page https://www.suse.com/security/cve/CVE-2024-38365/ SUSE CVE CVE-2024-38365 page https://www.suse.com/security/cve/CVE-2024-39223/ SUSE CVE CVE-2024-39223 page https://www.suse.com/security/cve/CVE-2024-39720/ SUSE CVE CVE-2024-39720 page https://www.suse.com/security/cve/CVE-2024-46872/ SUSE CVE CVE-2024-46872 page https://www.suse.com/security/cve/CVE-2024-47003/ SUSE CVE CVE-2024-47003 page https://www.suse.com/security/cve/CVE-2024-47067/ SUSE CVE CVE-2024-47067 page https://www.suse.com/security/cve/CVE-2024-47182/ SUSE CVE CVE-2024-47182 page https://www.suse.com/security/cve/CVE-2024-47401/ SUSE CVE CVE-2024-47401 page https://www.suse.com/security/cve/CVE-2024-47534/ SUSE CVE CVE-2024-47534 page https://www.suse.com/security/cve/CVE-2024-47616/ SUSE CVE CVE-2024-47616 page https://www.suse.com/security/cve/CVE-2024-47825/ SUSE CVE CVE-2024-47825 page https://www.suse.com/security/cve/CVE-2024-47827/ SUSE CVE CVE-2024-47827 page https://www.suse.com/security/cve/CVE-2024-47832/ SUSE CVE CVE-2024-47832 page https://www.suse.com/security/cve/CVE-2024-47877/ SUSE CVE CVE-2024-47877 page https://www.suse.com/security/cve/CVE-2024-48909/ SUSE CVE CVE-2024-48909 page https://www.suse.com/security/cve/CVE-2024-48921/ SUSE CVE CVE-2024-48921 page https://www.suse.com/security/cve/CVE-2024-49380/ SUSE CVE CVE-2024-49380 page https://www.suse.com/security/cve/CVE-2024-49381/ SUSE CVE CVE-2024-49381 page https://www.suse.com/security/cve/CVE-2024-49753/ SUSE CVE CVE-2024-49753 page https://www.suse.com/security/cve/CVE-2024-49757/ SUSE CVE CVE-2024-49757 page https://www.suse.com/security/cve/CVE-2024-50052/ SUSE CVE CVE-2024-50052 page https://www.suse.com/security/cve/CVE-2024-50312/ SUSE CVE CVE-2024-50312 page https://www.suse.com/security/cve/CVE-2024-50354/ SUSE CVE CVE-2024-50354 page https://www.suse.com/security/cve/CVE-2024-7558/ SUSE CVE CVE-2024-7558 page https://www.suse.com/security/cve/CVE-2024-7594/ SUSE CVE CVE-2024-7594 page https://www.suse.com/security/cve/CVE-2024-8037/ SUSE CVE CVE-2024-8037 page https://www.suse.com/security/cve/CVE-2024-8038/ SUSE CVE CVE-2024-8038 page https://www.suse.com/security/cve/CVE-2024-8185/ SUSE CVE CVE-2024-8185 page https://www.suse.com/security/cve/CVE-2024-8901/ SUSE CVE CVE-2024-8901 page https://www.suse.com/security/cve/CVE-2024-8975/ SUSE CVE CVE-2024-8975 page https://www.suse.com/security/cve/CVE-2024-8996/ SUSE CVE CVE-2024-8996 page https://www.suse.com/security/cve/CVE-2024-9180/ SUSE CVE CVE-2024-9180 page https://www.suse.com/security/cve/CVE-2024-9264/ SUSE CVE CVE-2024-9264 page https://www.suse.com/security/cve/CVE-2024-9312/ SUSE CVE CVE-2024-9312 page https://www.suse.com/security/cve/CVE-2024-9313/ SUSE CVE CVE-2024-9313 page https://www.suse.com/security/cve/CVE-2024-9341/ SUSE CVE CVE-2024-9341 page https://www.suse.com/security/cve/CVE-2024-9355/ SUSE CVE CVE-2024-9355 page https://www.suse.com/security/cve/CVE-2024-9407/ SUSE CVE CVE-2024-9407 page https://www.suse.com/security/cve/CVE-2024-9486/ SUSE CVE CVE-2024-9486 page https://www.suse.com/security/cve/CVE-2024-9594/ SUSE CVE CVE-2024-9594 page https://www.suse.com/security/cve/CVE-2024-9675/ SUSE CVE CVE-2024-9675 page SUSE Package Hub 12 govulncheck-vulndb-0.0.20241104T154416-5.1 govulncheck-vulndb-0.0.20241104T154416-5.1 as a component of SUSE Package Hub 12 A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments. CVE-2022-45157 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2022-45157.html CVE-2022-45157 https://bugzilla.suse.com/1231677 SUSE Bug 1231677 A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. CVE-2023-22644 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2023-22644.html CVE-2023-22644 https://bugzilla.suse.com/1207199 SUSE Bug 1207199 https://bugzilla.suse.com/1209434 SUSE Bug 1209434 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2023-32197 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2023-32197.html CVE-2023-32197 https://bugzilla.suse.com/1222643 SUSE Bug 1222643 https://bugzilla.suse.com/1222681 SUSE Bug 1222681 NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. CVE-2024-0132 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-0132.html CVE-2024-0132 https://bugzilla.suse.com/1231033 SUSE Bug 1231033 NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering. CVE-2024-0133 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-0133.html CVE-2024-0133 https://bugzilla.suse.com/1231032 SUSE Bug 1231032 A vulnerability was identified in Consul and Consul Enterprise ("Consul") such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules. CVE-2024-10005 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-10005.html CVE-2024-10005 A vulnerability was identified in Consul and Consul Enterprise ("Consul") such that using Headers in L7 traffic intentions could bypass HTTP header based access rules. CVE-2024-10006 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-10006.html CVE-2024-10006 A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS. CVE-2024-10086 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-10086.html CVE-2024-10086 Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings. CVE-2024-10214 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-10214.html CVE-2024-10214 Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K. CVE-2024-10241 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-10241.html CVE-2024-10241 Organization admins can delete pending invites created in an organization they are not part of. CVE-2024-10452 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-10452.html CVE-2024-10452 https://bugzilla.suse.com/1232569 SUSE Bug 1232569 A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability. The targeted domain is the one used as the Rancher URL. CVE-2024-22030 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-22030.html CVE-2024-22030 https://bugzilla.suse.com/1219982 SUSE Bug 1219982 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2024-22036 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-22036.html CVE-2024-22036 https://bugzilla.suse.com/1231280 SUSE Bug 1231280 Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function. CVE-2024-33662 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-33662.html CVE-2024-33662 An arbitrary file read vulnerability in Adguard Home before v0.107.52 allows authenticated attackers to access arbitrary files as root on the underlying Operating System via placing a crafted file into a readable directory. CVE-2024-36814 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-36814.html CVE-2024-36814 btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn't return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a "standard" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindAndDelete` only removes exact matches. So for example, with `script = "<data> <data||foo>"` and `dataToRemove = "data"` btcd will remove both data pushes but Bitcoin Core's `FindAndDelete` only removes the first `<data>` push. This has been patched in btcd version v0.24.2. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2024-38365 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-38365.html CVE-2024-38365 An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey CVE-2024-39223 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-39223.html CVE-2024-39223 An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that includes a FROM statement pointing to the attacker-controlled blob file, the attacker can crash the application through the CreateModel route, leading to a segmentation fault (signal SIGSEGV: segmentation violation). CVE-2024-39720 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-39720.html CVE-2024-39720 https://bugzilla.suse.com/1232794 SUSE Bug 1232794 Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks CVE-2024-46872 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-46872.html CVE-2024-46872 Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend. CVE-2024-47003 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-47003.html CVE-2024-47003 AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up to HTML tags via XHTML and thus leading to a XSS vulnerability. This vulnerability is fixed in 3.29.0. CVE-2024-47067 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-47067.html CVE-2024-47067 Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3. CVE-2024-47182 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-47182.html CVE-2024-47182 Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks. CVE-2024-47401 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-47401.html CVE-2024-47401 go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1. CVE-2024-47534 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-47534.html CVE-2024-47534 Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token (JWT) signed by a key known by all Pomerium services in the same deployment. However, incomplete validation of this JWT meant that some service account access tokens would incorrectly be treated as valid for the purpose of databroker API authorization. Improper access to the databroker API could allow exfiltration of user info, spoofing of user sessions, or tampering with Pomerium routes, policies, and other settings. A Pomerium deployment is susceptible to this issue if all of the following conditions are met, you have issued a service account access token using Pomerium Zero or Pomerium Enterprise, the access token has an explicit expiration date in the future, and the core Pomerium databroker gRPC API is not otherwise secured by network access controls. This vulnerability is fixed in 0.27.1. CVE-2024-47616 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-47616.html CVE-2024-47616 Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`. CVE-2024-47825 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-47825.html CVE-2024-47825 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2. CVE-2024-47827 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-47827.html CVE-2024-47827 ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability. CVE-2024-47832 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-47832.html CVE-2024-47832 Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added. CVE-2024-47877 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-47877.html CVE-2024-47877 SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`. CVE-2024-48909 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-48909.html CVE-2024-48909 Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0. CVE-2024-48921 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-48921.html CVE-2024-48921 https://bugzilla.suse.com/1232557 SUSE Bug 1232557 Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the vulnerability. CVE-2024-49380 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-49380.html CVE-2024-49380 Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability. CVE-2024-49381 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-49381.html CVE-2024-49381 Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures. This vulnerability potentially allows unauthorized access to unsecured internal endpoints, which may contain sensitive information or functionalities. Versions 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available. CVE-2024-49753 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-49753.html CVE-2024-49753 The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available. CVE-2024-49757 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-49757.html CVE-2024-49757 Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post. CVE-2024-50052 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-50052.html CVE-2024-50052 A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation. CVE-2024-50312 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-50312.html CVE-2024-50312 gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory. CVE-2024-50354 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-50354.html CVE-2024-50354 JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm. CVE-2024-7558 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-7558.html CVE-2024-7558 Vault's SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault's SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15. CVE-2024-7594 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-7594.html CVE-2024-7594 Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm. CVE-2024-8037 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-8037.html CVE-2024-8037 Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks. CVE-2024-8038 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-8038.html CVE-2024-8038 Vault Community and Vault Enterprise ("Vault") clusters using Vault's Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself. This vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12. CVE-2024-8185 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-8185.html CVE-2024-8185 https://bugzilla.suse.com/1232752 SUSE Bug 1232752 The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer and issuer validation. In deployments of ALB that ignore security best practices, where ALB targets are directly exposed to internet traffic, an actor can provide a JWT signed by an untrusted entity in order to spoof OIDC-federated sessions and successfully bypass authentication. The repository/package has been deprecated, is end of life, and is no longer supported. As a security best practice, ensure that your ELB targets (e.g. EC2 Instances, Fargate Tasks etc.) do not have public IP addresses. Ensure any forked or derivative code validate that the signer attribute in the JWT match the ARN of the Application Load Balancer that the service is configured to use. CVE-2024-8901 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-8901.html CVE-2024-8901 Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1. CVE-2024-8975 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-8975.html CVE-2024-8975 Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Agent Flow: before 0.43.2 CVE-2024-8996 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-8996.html CVE-2024-8996 A privileged Vault operator with write permissions to the root namespace's identity endpoint could escalate their own or another user's privileges to Vault's root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16. CVE-2024-9180 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-9180.html CVE-2024-9180 The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. CVE-2024-9264 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-9264.html CVE-2024-9264 https://bugzilla.suse.com/1231844 SUSE Bug 1231844 Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges. CVE-2024-9312 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-9312.html CVE-2024-9312 Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them. CVE-2024-9313 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-9313.html CVE-2024-9313 A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system. CVE-2024-9341 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-9341.html CVE-2024-9341 https://bugzilla.suse.com/1231230 SUSE Bug 1231230 A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack. CVE-2024-9355 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-9355.html CVE-2024-9355 A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files. CVE-2024-9407 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-9407.html CVE-2024-9407 https://bugzilla.suse.com/1231208 SUSE Bug 1231208 A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider. CVE-2024-9486 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-9486.html CVE-2024-9486 A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring. CVE-2024-9594 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-9594.html CVE-2024-9594 A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah. CVE-2024-9675 SUSE Package Hub 12:govulncheck-vulndb-0.0.20241104T154416-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3GBL6IN35EDC2YQIKBPTX7XQQ67KRPAM/ https://www.suse.com/security/cve/CVE-2024-9675.html CVE-2024-9675 https://bugzilla.suse.com/1231499 SUSE Bug 1231499