govulncheck-vulndb-0.0.20241030T212825-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:14447-1 Final 1 1 2024-11-01T00:00:00Z current 2024-11-01T00:00:00Z 2024-11-01T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z govulncheck-vulndb-0.0.20241030T212825-1.1 on GA media These are all security issues fixed in the govulncheck-vulndb-0.0.20241030T212825-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-14447 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ E-Mail link for openSUSE-SU-2024:14447-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2022-45157/ SUSE CVE CVE-2022-45157 page https://www.suse.com/security/cve/CVE-2023-22644/ SUSE CVE CVE-2023-22644 page https://www.suse.com/security/cve/CVE-2023-32197/ SUSE CVE CVE-2023-32197 page https://www.suse.com/security/cve/CVE-2024-10214/ SUSE CVE CVE-2024-10214 page https://www.suse.com/security/cve/CVE-2024-10241/ SUSE CVE CVE-2024-10241 page https://www.suse.com/security/cve/CVE-2024-22030/ SUSE CVE CVE-2024-22030 page https://www.suse.com/security/cve/CVE-2024-22036/ SUSE CVE CVE-2024-22036 page https://www.suse.com/security/cve/CVE-2024-33662/ SUSE CVE CVE-2024-33662 page https://www.suse.com/security/cve/CVE-2024-36814/ SUSE CVE CVE-2024-36814 page https://www.suse.com/security/cve/CVE-2024-38365/ SUSE CVE CVE-2024-38365 page https://www.suse.com/security/cve/CVE-2024-39223/ SUSE CVE CVE-2024-39223 page https://www.suse.com/security/cve/CVE-2024-47003/ SUSE CVE CVE-2024-47003 page https://www.suse.com/security/cve/CVE-2024-47067/ SUSE CVE CVE-2024-47067 page https://www.suse.com/security/cve/CVE-2024-47182/ SUSE CVE CVE-2024-47182 page https://www.suse.com/security/cve/CVE-2024-47534/ SUSE CVE CVE-2024-47534 page https://www.suse.com/security/cve/CVE-2024-47616/ SUSE CVE CVE-2024-47616 page https://www.suse.com/security/cve/CVE-2024-47825/ SUSE CVE CVE-2024-47825 page https://www.suse.com/security/cve/CVE-2024-47827/ SUSE CVE CVE-2024-47827 page https://www.suse.com/security/cve/CVE-2024-47832/ SUSE CVE CVE-2024-47832 page https://www.suse.com/security/cve/CVE-2024-47877/ SUSE CVE CVE-2024-47877 page https://www.suse.com/security/cve/CVE-2024-48909/ SUSE CVE CVE-2024-48909 page https://www.suse.com/security/cve/CVE-2024-48921/ SUSE CVE CVE-2024-48921 page https://www.suse.com/security/cve/CVE-2024-49380/ SUSE CVE CVE-2024-49380 page https://www.suse.com/security/cve/CVE-2024-49381/ SUSE CVE CVE-2024-49381 page https://www.suse.com/security/cve/CVE-2024-49753/ SUSE CVE CVE-2024-49753 page https://www.suse.com/security/cve/CVE-2024-49757/ SUSE CVE CVE-2024-49757 page https://www.suse.com/security/cve/CVE-2024-50312/ SUSE CVE CVE-2024-50312 page https://www.suse.com/security/cve/CVE-2024-7558/ SUSE CVE CVE-2024-7558 page https://www.suse.com/security/cve/CVE-2024-7594/ SUSE CVE CVE-2024-7594 page https://www.suse.com/security/cve/CVE-2024-8037/ SUSE CVE CVE-2024-8037 page https://www.suse.com/security/cve/CVE-2024-8038/ SUSE CVE CVE-2024-8038 page https://www.suse.com/security/cve/CVE-2024-8901/ SUSE CVE CVE-2024-8901 page https://www.suse.com/security/cve/CVE-2024-8975/ SUSE CVE CVE-2024-8975 page https://www.suse.com/security/cve/CVE-2024-8996/ SUSE CVE CVE-2024-8996 page https://www.suse.com/security/cve/CVE-2024-9180/ SUSE CVE CVE-2024-9180 page https://www.suse.com/security/cve/CVE-2024-9264/ SUSE CVE CVE-2024-9264 page https://www.suse.com/security/cve/CVE-2024-9312/ SUSE CVE CVE-2024-9312 page https://www.suse.com/security/cve/CVE-2024-9313/ SUSE CVE CVE-2024-9313 page https://www.suse.com/security/cve/CVE-2024-9341/ SUSE CVE CVE-2024-9341 page https://www.suse.com/security/cve/CVE-2024-9355/ SUSE CVE CVE-2024-9355 page https://www.suse.com/security/cve/CVE-2024-9407/ SUSE CVE CVE-2024-9407 page https://www.suse.com/security/cve/CVE-2024-9486/ SUSE CVE CVE-2024-9486 page https://www.suse.com/security/cve/CVE-2024-9594/ SUSE CVE CVE-2024-9594 page https://www.suse.com/security/cve/CVE-2024-9675/ SUSE CVE CVE-2024-9675 page openSUSE Tumbleweed govulncheck-vulndb-0.0.20241030T212825-1.1 govulncheck-vulndb-0.0.20241030T212825-1.1 as a component of openSUSE Tumbleweed A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments. CVE-2022-45157 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2022-45157.html CVE-2022-45157 https://bugzilla.suse.com/1231677 SUSE Bug 1231677 A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. CVE-2023-22644 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2023-22644.html CVE-2023-22644 https://bugzilla.suse.com/1207199 SUSE Bug 1207199 https://bugzilla.suse.com/1209434 SUSE Bug 1209434 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2023-32197 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2023-32197.html CVE-2023-32197 https://bugzilla.suse.com/1222643 SUSE Bug 1222643 https://bugzilla.suse.com/1222681 SUSE Bug 1222681 Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings. CVE-2024-10214 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-10214.html CVE-2024-10214 Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K. CVE-2024-10241 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-10241.html CVE-2024-10241 A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability. The targeted domain is the one used as the Rancher URL. CVE-2024-22030 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-22030.html CVE-2024-22030 https://bugzilla.suse.com/1219982 SUSE Bug 1219982 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2024-22036 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-22036.html CVE-2024-22036 https://bugzilla.suse.com/1231280 SUSE Bug 1231280 Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function. CVE-2024-33662 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-33662.html CVE-2024-33662 An arbitrary file read vulnerability in Adguard Home before v0.107.52 allows authenticated attackers to access arbitrary files as root on the underlying Operating System via placing a crafted file into a readable directory. CVE-2024-36814 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-36814.html CVE-2024-36814 btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one). This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn't return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a "standard" Bitcoin transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block. `removeOpcodeByData(script []byte, dataToRemove []byte)` removes any data pushes from `script` that contain `dataToRemove`. However, `FindAndDelete` only removes exact matches. So for example, with `script = "<data> <data||foo>"` and `dataToRemove = "data"` btcd will remove both data pushes but Bitcoin Core's `FindAndDelete` only removes the first `<data>` push. This has been patched in btcd version v0.24.2. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2024-38365 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-38365.html CVE-2024-38365 An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey CVE-2024-39223 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-39223.html CVE-2024-39223 Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend. CVE-2024-47003 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-47003.html CVE-2024-47003 AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up to HTML tags via XHTML and thus leading to a XSS vulnerability. This vulnerability is fixed in 3.29.0. CVE-2024-47067 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-47067.html CVE-2024-47067 Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3. CVE-2024-47182 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-47182.html CVE-2024-47182 go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1. CVE-2024-47534 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-47534.html CVE-2024-47534 Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token (JWT) signed by a key known by all Pomerium services in the same deployment. However, incomplete validation of this JWT meant that some service account access tokens would incorrectly be treated as valid for the purpose of databroker API authorization. Improper access to the databroker API could allow exfiltration of user info, spoofing of user sessions, or tampering with Pomerium routes, policies, and other settings. A Pomerium deployment is susceptible to this issue if all of the following conditions are met, you have issued a service account access token using Pomerium Zero or Pomerium Enterprise, the access token has an explicit expiration date in the future, and the core Pomerium databroker gRPC API is not otherwise secured by network access controls. This vulnerability is fixed in 0.27.1. CVE-2024-47616 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-47616.html CVE-2024-47616 Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`. CVE-2024-47825 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-47825.html CVE-2024-47825 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2. CVE-2024-47827 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-47827.html CVE-2024-47827 ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability. CVE-2024-47832 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-47832.html CVE-2024-47832 Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added. CVE-2024-47877 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-47877.html CVE-2024-47877 SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior to version 1.37.1, clients that have enabled `LookupResources2` and have caveats in the evaluation path for their requests can return a permissionship of `CONDITIONAL` with context marked as missing, even then the context was supplied. LookupResources2 is the new default in SpiceDB 1.37.0 and has been opt-in since SpiceDB 1.35.0. The bug is patched as part of SpiceDB 1.37.1. As a workaround, disable LookupResources2 via the `--enable-experimental-lookup-resources` flag by setting it to `false`. CVE-2024-48909 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-48909.html CVE-2024-48909 Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0. CVE-2024-48921 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-48921.html CVE-2024-48921 https://bugzilla.suse.com/1232557 SUSE Bug 1232557 Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the vulnerability. CVE-2024-49380 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-49380.html CVE-2024-49380 Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability. CVE-2024-49381 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-49381.html CVE-2024-49381 Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures. This vulnerability potentially allows unauthorized access to unsecured internal endpoints, which may contain sensitive information or functionalities. Versions 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available. CVE-2024-49753 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-49753.html CVE-2024-49753 The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the "User Registration allowed" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available. CVE-2024-49757 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-49757.html CVE-2024-49757 A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation. CVE-2024-50312 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-50312.html CVE-2024-50312 JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm. CVE-2024-7558 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-7558.html CVE-2024-7558 Vault's SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault's SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15. CVE-2024-7594 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-7594.html CVE-2024-7594 Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm. CVE-2024-8037 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-8037.html CVE-2024-8037 Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks. CVE-2024-8038 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-8038.html CVE-2024-8038 The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer and issuer validation. In deployments of ALB that ignore security best practices, where ALB targets are directly exposed to internet traffic, an actor can provide a JWT signed by an untrusted entity in order to spoof OIDC-federated sessions and successfully bypass authentication. The repository/package has been deprecated, is end of life, and is no longer supported. As a security best practice, ensure that your ELB targets (e.g. EC2 Instances, Fargate Tasks etc.) do not have public IP addresses. Ensure any forked or derivative code validate that the signer attribute in the JWT match the ARN of the Application Load Balancer that the service is configured to use. CVE-2024-8901 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-8901.html CVE-2024-8901 Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1. CVE-2024-8975 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-8975.html CVE-2024-8975 Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Agent Flow: before 0.43.2 CVE-2024-8996 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-8996.html CVE-2024-8996 A privileged Vault operator with write permissions to the root namespace's identity endpoint could escalate their own or another user's privileges to Vault's root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16. CVE-2024-9180 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-9180.html CVE-2024-9180 The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. CVE-2024-9264 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-9264.html CVE-2024-9264 https://bugzilla.suse.com/1231844 SUSE Bug 1231844 Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges. CVE-2024-9312 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-9312.html CVE-2024-9312 Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them. CVE-2024-9313 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-9313.html CVE-2024-9313 A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system. CVE-2024-9341 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-9341.html CVE-2024-9341 https://bugzilla.suse.com/1231230 SUSE Bug 1231230 A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack. CVE-2024-9355 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-9355.html CVE-2024-9355 A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files. CVE-2024-9407 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-9407.html CVE-2024-9407 https://bugzilla.suse.com/1231208 SUSE Bug 1231208 A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider. CVE-2024-9486 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-9486.html CVE-2024-9486 A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring. CVE-2024-9594 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-9594.html CVE-2024-9594 A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah. CVE-2024-9675 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241030T212825-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XTEQAM75LF5DZCFX3MOH4IT3DWP5ZTL6/ https://www.suse.com/security/cve/CVE-2024-9675.html CVE-2024-9675 https://bugzilla.suse.com/1231499 SUSE Bug 1231499