govulncheck-vulndb-0.0.20241106T172143-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:14470-1 Final 1 1 2024-11-07T00:00:00Z current 2024-11-07T00:00:00Z 2024-11-07T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z govulncheck-vulndb-0.0.20241106T172143-1.1 on GA media These are all security issues fixed in the govulncheck-vulndb-0.0.20241106T172143-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-14470 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OX53GMPD3MLNI5INQF5WZ3M4WW7BFHZC/ E-Mail link for openSUSE-SU-2024:14470-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2024-10389/ SUSE CVE CVE-2024-10389 page https://www.suse.com/security/cve/CVE-2024-48057/ SUSE CVE CVE-2024-48057 page https://www.suse.com/security/cve/CVE-2024-51735/ SUSE CVE CVE-2024-51735 page https://www.suse.com/security/cve/CVE-2024-51746/ SUSE CVE CVE-2024-51746 page openSUSE Tumbleweed govulncheck-vulndb-0.0.20241106T172143-1.1 govulncheck-vulndb-0.0.20241106T172143-1.1 as a component of openSUSE Tumbleweed There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc CVE-2024-10389 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241106T172143-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OX53GMPD3MLNI5INQF5WZ3M4WW7BFHZC/ https://www.suse.com/security/cve/CVE-2024-10389.html CVE-2024-10389 localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage. CVE-2024-48057 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241106T172143-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OX53GMPD3MLNI5INQF5WZ3M4WW7BFHZC/ https://www.suse.com/security/cve/CVE-2024-48057.html CVE-2024-48057 Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the `general-template.md` template.The contents of the files are read and used to generate the report. However, the file contents are not properly filtered, leading to XSS. This may lead to commands executed on the host as well. This issue is not yet resolved. Users are advised to add their own filtering or to reach out to the developer to aid in developing a patch. CVE-2024-51735 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241106T172143-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OX53GMPD3MLNI5INQF5WZ3M4WW7BFHZC/ https://www.suse.com/security/cve/CVE-2024-51735.html CVE-2024-51735 Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The parameters used for the search are the public key and the payload. The search API returns entries that match either condition rather than both. When gitsign's credential cache is used, there can be multiple entries that use the same ephemeral keypair / signing certificate. As gitsign assumes both conditions are matched by Rekor, there is no additional validation that the entry's hash matches the payload being verified, meaning that the wrong entry can be used to successfully pass verification. Impact is minimal as while gitsign does not match the payload against the entry, it does ensure that the certificate matches. This would need to be exploited during the certificate validity window (10 minutes) by the key holder. CVE-2024-51746 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241106T172143-1.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OX53GMPD3MLNI5INQF5WZ3M4WW7BFHZC/ https://www.suse.com/security/cve/CVE-2024-51746.html CVE-2024-51746 https://bugzilla.suse.com/1232903 SUSE Bug 1232903