velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:14663-1 Final 1 1 2025-01-17T00:00:00Z current 2025-01-17T00:00:00Z 2025-01-17T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media These are all security issues fixed in the velociraptor-0.7.0.4.git142.862ef23-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-14663 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ E-Mail link for openSUSE-SU-2025:14663-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2023-1732/ SUSE CVE CVE-2023-1732 page https://www.suse.com/security/cve/CVE-2023-44270/ SUSE CVE CVE-2023-44270 page https://www.suse.com/security/cve/CVE-2023-45133/ SUSE CVE CVE-2023-45133 page https://www.suse.com/security/cve/CVE-2023-45683/ SUSE CVE CVE-2023-45683 page https://www.suse.com/security/cve/CVE-2023-46234/ SUSE CVE CVE-2023-46234 page https://www.suse.com/security/cve/CVE-2024-21538/ SUSE CVE CVE-2024-21538 page https://www.suse.com/security/cve/CVE-2024-23331/ SUSE CVE CVE-2024-23331 page https://www.suse.com/security/cve/CVE-2024-24786/ SUSE CVE CVE-2024-24786 page https://www.suse.com/security/cve/CVE-2024-28180/ SUSE CVE CVE-2024-28180 page https://www.suse.com/security/cve/CVE-2024-31207/ SUSE CVE CVE-2024-31207 page https://www.suse.com/security/cve/CVE-2024-37298/ SUSE CVE CVE-2024-37298 page https://www.suse.com/security/cve/CVE-2024-4067/ SUSE CVE CVE-2024-4067 page https://www.suse.com/security/cve/CVE-2024-4068/ SUSE CVE CVE-2024-4068 page https://www.suse.com/security/cve/CVE-2024-42459/ SUSE CVE CVE-2024-42459 page https://www.suse.com/security/cve/CVE-2024-42460/ SUSE CVE CVE-2024-42460 page https://www.suse.com/security/cve/CVE-2024-42461/ SUSE CVE CVE-2024-42461 page https://www.suse.com/security/cve/CVE-2024-45296/ SUSE CVE CVE-2024-45296 page https://www.suse.com/security/cve/CVE-2024-45338/ SUSE CVE CVE-2024-45338 page https://www.suse.com/security/cve/CVE-2024-45811/ SUSE CVE CVE-2024-45811 page https://www.suse.com/security/cve/CVE-2024-45812/ SUSE CVE CVE-2024-45812 page https://www.suse.com/security/cve/CVE-2024-47068/ SUSE CVE CVE-2024-47068 page https://www.suse.com/security/cve/CVE-2024-47875/ SUSE CVE CVE-2024-47875 page https://www.suse.com/security/cve/CVE-2024-48948/ SUSE CVE CVE-2024-48948 page https://www.suse.com/security/cve/CVE-2024-48949/ SUSE CVE CVE-2024-48949 page https://www.suse.com/security/cve/CVE-2024-51744/ SUSE CVE CVE-2024-51744 page https://www.suse.com/security/cve/CVE-2024-55565/ SUSE CVE CVE-2024-55565 page https://www.suse.com/security/cve/CVE-2024-6104/ SUSE CVE CVE-2024-6104 page openSUSE Tumbleweed velociraptor-0.7.0.4.git142.862ef23-1.1 velociraptor-0.7.0.4.git142.862ef23-1.1 as a component of openSUSE Tumbleweed When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read() returns an error. In rare deployment cases (error thrown by the Read() function), this could lead to a predictable shared secret. The tkn20 and blindrsa components did not check whether enough randomness was returned from the user provided randomness source. Typically the user provides crypto/rand.Reader, which in the vast majority of cases will always return the right number random bytes. In the cases where it does not, or the user provides a source that does not, the blinding for blindrsa is weak and integrity of the plaintext is not ensured in tkn20. CVE-2023-1732 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2023-1732.html CVE-2023-1732 An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment. CVE-2023-44270 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2023-44270.html CVE-2023-44270 Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3. CVE-2023-45133 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2023-45133.html CVE-2023-45133 github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the victim's browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: SP registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or publicly accessible to ease the IdP interoperability. This issue is fixed in version 0.4.14. Users unable to upgrade may perform external validation of URLs provided in SAML metadata, or restrict the ability for end-users to upload arbitrary metadata. CVE-2023-45683 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2023-45683.html CVE-2023-45683 https://bugzilla.suse.com/1216308 SUSE Bug 1216308 browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2. CVE-2023-46234 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2023-46234.html CVE-2023-46234 Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string. CVE-2024-21538 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-21538.html CVE-2024-21538 https://bugzilla.suse.com/1233843 SUSE Bug 1233843 Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers. CVE-2024-23331 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-23331.html CVE-2024-23331 The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set. CVE-2024-24786 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-24786.html CVE-2024-24786 https://bugzilla.suse.com/1226136 SUSE Bug 1226136 Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. CVE-2024-28180 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-28180.html CVE-2024-28180 https://bugzilla.suse.com/1234984 SUSE Bug 1234984 Vite (French word for "quick", pronounced /vit/, like "veet") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18. CVE-2024-31207 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-31207.html CVE-2024-31207 gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue. CVE-2024-37298 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-37298.html CVE-2024-37298 https://bugzilla.suse.com/1227309 SUSE Bug 1227309 The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8. CVE-2024-4067 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-4067.html CVE-2024-4067 https://bugzilla.suse.com/1224255 SUSE Bug 1224255 The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash. CVE-2024-4068 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-4068.html CVE-2024-4068 https://bugzilla.suse.com/1224256 SUSE Bug 1224256 In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended. CVE-2024-42459 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-42459.html CVE-2024-42459 https://bugzilla.suse.com/1232538 SUSE Bug 1232538 In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero. CVE-2024-42460 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-42460.html CVE-2024-42460 https://bugzilla.suse.com/1232538 SUSE Bug 1232538 In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed. CVE-2024-42461 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-42461.html CVE-2024-42461 https://bugzilla.suse.com/1232538 SUSE Bug 1232538 path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0. CVE-2024-45296 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-45296.html CVE-2024-45296 An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. CVE-2024-45338 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-45338.html CVE-2024-45338 https://bugzilla.suse.com/1234794 SUSE Bug 1234794 Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2024-45811 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-45811.html CVE-2024-45811 Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to `cjs`/`iife`/`umd` output format. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. We have identified a DOM Clobbering vulnerability in Vite bundled scripts, particularly when the scripts dynamically import other scripts from the assets folder and the developer sets the build output format to `cjs`, `iife`, or `umd`. In such cases, Vite replaces relative paths starting with `__VITE_ASSET__` using the URL retrieved from `document.currentScript`. However, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the src attribute of the attacker-controlled element is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server. This vulnerability can result in cross-site scripting (XSS) attacks on websites that include Vite-bundled files (configured with an output format of `cjs`, `iife`, or `umd`) and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2024-45812 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-45812.html CVE-2024-45812 Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability. CVE-2024-47068 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-47068.html CVE-2024-47068 DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3. CVE-2024-47875 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-47875.html CVE-2024-47875 https://bugzilla.suse.com/1231571 SUSE Bug 1231571 The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid. CVE-2024-48948 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-48948.html CVE-2024-48948 https://bugzilla.suse.com/1231681 SUSE Bug 1231681 The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation. CVE-2024-48949 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-48949.html CVE-2024-48949 https://bugzilla.suse.com/1231557 SUSE Bug 1231557 golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in "dangerous" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors ("dangerous" ones first), so that you are not running in the case detailed above. CVE-2024-51744 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-51744.html CVE-2024-51744 https://bugzilla.suse.com/1232936 SUSE Bug 1232936 nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version. CVE-2024-55565 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-55565.html CVE-2024-55565 go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. CVE-2024-6104 openSUSE Tumbleweed:velociraptor-0.7.0.4.git142.862ef23-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/ https://www.suse.com/security/cve/CVE-2024-6104.html CVE-2024-6104 https://bugzilla.suse.com/1227024 SUSE Bug 1227024