govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:14567-1 Final 1 1 2024-12-11T00:00:00Z current 2024-12-11T00:00:00Z 2024-12-11T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media These are all security issues fixed in the govulncheck-vulndb-0.0.20241209T183251-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-14567 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ E-Mail link for openSUSE-SU-2024:14567-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2024-10220/ SUSE CVE CVE-2024-10220 page https://www.suse.com/security/cve/CVE-2024-36620/ SUSE CVE CVE-2024-36620 page https://www.suse.com/security/cve/CVE-2024-36621/ SUSE CVE CVE-2024-36621 page https://www.suse.com/security/cve/CVE-2024-36623/ SUSE CVE CVE-2024-36623 page https://www.suse.com/security/cve/CVE-2024-37820/ SUSE CVE CVE-2024-37820 page https://www.suse.com/security/cve/CVE-2024-43784/ SUSE CVE CVE-2024-43784 page https://www.suse.com/security/cve/CVE-2024-45719/ SUSE CVE CVE-2024-45719 page https://www.suse.com/security/cve/CVE-2024-50948/ SUSE CVE CVE-2024-50948 page https://www.suse.com/security/cve/CVE-2024-52003/ SUSE CVE CVE-2024-52003 page https://www.suse.com/security/cve/CVE-2024-52529/ SUSE CVE CVE-2024-52529 page https://www.suse.com/security/cve/CVE-2024-52801/ SUSE CVE CVE-2024-52801 page https://www.suse.com/security/cve/CVE-2024-53259/ SUSE CVE CVE-2024-53259 page https://www.suse.com/security/cve/CVE-2024-53264/ SUSE CVE CVE-2024-53264 page https://www.suse.com/security/cve/CVE-2024-53858/ SUSE CVE CVE-2024-53858 page https://www.suse.com/security/cve/CVE-2024-53862/ SUSE CVE CVE-2024-53862 page https://www.suse.com/security/cve/CVE-2024-54131/ SUSE CVE CVE-2024-54131 page https://www.suse.com/security/cve/CVE-2024-54132/ SUSE CVE CVE-2024-54132 page https://www.suse.com/security/cve/CVE-2024-6156/ SUSE CVE CVE-2024-6156 page https://www.suse.com/security/cve/CVE-2024-6219/ SUSE CVE CVE-2024-6219 page https://www.suse.com/security/cve/CVE-2024-6538/ SUSE CVE CVE-2024-6538 page https://www.suse.com/security/cve/CVE-2024-8676/ SUSE CVE CVE-2024-8676 page openSUSE Tumbleweed govulncheck-vulndb-0.0.20241209T183251-1.1 govulncheck-vulndb-0.0.20241209T183251-1.1 as a component of openSUSE Tumbleweed The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2. CVE-2024-10220 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-10220.html CVE-2024-10220 https://bugzilla.suse.com/1233583 SUSE Bug 1233583 moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go. CVE-2024-36620 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-36620.html CVE-2024-36620 https://bugzilla.suse.com/1234127 SUSE Bug 1234127 moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion. CVE-2024-36621 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-36621.html CVE-2024-36621 https://bugzilla.suse.com/1234131 SUSE Bug 1234131 moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes. CVE-2024-36623 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-36623.html CVE-2024-36623 https://bugzilla.suse.com/1234132 SUSE Bug 1234132 A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation. CVE-2024-37820 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-37820.html CVE-2024-37820 lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit all of the previous user's credentials. This issue has been addressed in release version 1.33.0 and all users are advised to upgrade. The only known workaround for those who cannot upgrade is to not reuse usernames. CVE-2024-43784 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-43784.html CVE-2024-43784 Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1, which fixes the issue. CVE-2024-45719 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-45719.html CVE-2024-45719 An issue in mochiMQTT v2.6.3 allows attackers to cause a Denial of Service (DoS) via a crafted request. CVE-2024-50948 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-50948.html CVE-2024-50948 Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2024-52003 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-52003.html CVE-2024-52003 Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range `AND` 2. A Layer 7 allow policy that selects a specific port within the first policy's range the Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy. This issue only affects users who use Cilium's port range functionality, which was introduced in Cilium v1.16. This issue is patched in PR #35150. This issue affects Cilium v1.16 between v1.16.0 and v1.16.3 inclusive. This issue is patched in Cilium v1.16.4. Users are advised to upgrade. Users with network policies that match the pattern described above can work around the issue by rewriting any policies that use port ranges to individually specify the ports permitted for traffic. CVE-2024-52529 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-52529.html CVE-2024-52529 sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically secure. This issue was fixed in version v2.6.4, where cookies are opaque and cryptographically secure strings. All users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2024-52801 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-52801.html CVE-2024-52801 quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet. By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they're unable to establish a QUIC connection). The attacker needs to at least know the client's IP and port tuple to mount an attack. This vulnerability is fixed in 0.48.2. CVE-2024-53259 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-53259.html CVE-2024-53259 bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated "next" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2024-53264 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-53264.html CVE-2024-53264 The gh cli is GitHub's official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several `gh` commands used to clone a repository with submodules from a non-GitHub host including `gh repo clone`, `gh repo fork`, and `gh pr checkout`. These GitHub CLI commands invoke git with instructions to retrieve authentication tokens using the `credential.helper` configuration variable for any host encountered. Prior to version `2.63.0`, hosts other than GitHub.com and ghe.com are treated as GitHub Enterprise Server hosts and have tokens sourced from the following environment variables before falling back to host-specific tokens stored within system-specific secured storage: 1. `GITHUB_ENTERPRISE_TOKEN`, 2. `GH_ENTERPRISE_TOKEN` and 3. `GITHUB_TOKEN` when the `CODESPACES` environment variable is set. The result being `git` sending authentication tokens when cloning submodules. In version `2.63.0`, these GitHub CLI commands will limit the hosts for which `gh` acts as a credential helper to source authentication tokens. Additionally, `GITHUB_TOKEN` will only be used for GitHub.com and ghe.com. Users are advised to upgrade. Additionally users are advised to revoke authentication tokens used with the GitHub CLI and to review their personal security log and any relevant audit logs for actions associated with their account or enterprise CVE-2024-53858 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-53858.html CVE-2024-53858 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using `--auth-mode=client`, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}` or when using `--auth-mode=sso`, all Archived Workflows can be retrieved with a valid token via the GET Workflow endpoint: `/api/v1/workflows/{namespace}/{name}`. No authentication is performed by the Server itself on `client` tokens. Authentication & authorization is instead delegated to the k8s API server. However, the Workflow Archive does not interact with k8s, and so any token that looks valid will be considered authenticated, even if it is not a k8s token or even if the token has no RBAC for Argo. To handle the lack of pass-through k8s authN/authZ, the Workflow Archive specifically does the equivalent of a `kubectl auth can-i` check for respective methods. In 3.5.7 and 3.5.8, the auth check was accidentally removed on the GET Workflow endpoint's fallback to archived workflows on these lines, allowing archived workflows to be retrieved with a fake token. This vulnerability is fixed in 3.6.2 and 3.5.13. CVE-2024-53862 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-53862.html CVE-2024-53862 The Kolide Agent (aka: Launcher) is the lightweight agent designed to work with Kolide's service. An implementation bug in the Kolide Agent (known as `launcher`) allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. The bug was introduced in version 1.5.3 when launcher started storing upgraded binaries in the ProgramData directory. This move to the new directory meant the launcher root directory inherited default permissions that are not as strict as the previous location. These incorrect default permissions in conjunction with an omitted SystemDrive environmental variable (when launcher starts osqueryd), allows a malicious actor with access to the local Windows device to successfully place an arbitrary DLL into the osqueryd process's search path. Under some circumstances, this DLL will be executed when osqueryd performs a WMI query. This combination of events could then allow the attacker to escalate their privileges to SYSTEM. Impacted versions include versions >= 1.5.3 and the fix has been released in 1.12.3. CVE-2024-54131 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-54131.html CVE-2024-54131 The GitHub CLI is GitHub's official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact's download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1. CVE-2024-54132 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-54132.html CVE-2024-54132 https://bugzilla.suse.com/1234230 SUSE Bug 1234230 Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store. CVE-2024-6156 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-6156.html CVE-2024-6156 Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured. CVE-2024-6219 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-6219.html CVE-2024-6219 A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system. The /api/dev-console/proxy/internet endpoint on the OpenShit Console allows authenticated users to have the console's pod perform arbitrary and fully controlled HTTP(s) requests. The full response to these requests is returned by the endpoint. While the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster. CVE-2024-6538 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-6538.html CVE-2024-6538 A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore. CVE-2024-8676 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241209T183251-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EK3MV2UFLDNRIXIWLVT5CJNSLB2MKFBU/ https://www.suse.com/security/cve/CVE-2024-8676.html CVE-2024-8676 https://bugzilla.suse.com/1233812 SUSE Bug 1233812