Redhat: Security Vulnerabilities
A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition for the cgroup. An attacker could abuse this flaw to get host network access on an cri-o host.
CVSS Score
5.0
EPSS Score
0.003
Published
2019-11-25
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
CVSS Score
7.5
EPSS Score
0.01
Published
2019-11-25
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
CVSS Score
4.5
EPSS Score
0.031
Published
2019-11-23
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.
CVSS Score
3.1
EPSS Score
0.005
Published
2019-11-22
PyXML: Hash table collisions CPU usage Denial of Service
CVSS Score
7.5
EPSS Score
0.005
Published
2019-11-22
Designate does not enforce the DNS protocol limit concerning record set sizes
CVSS Score
6.5
EPSS Score
0.009
Published
2019-11-22
libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files
CVSS Score
4.7
EPSS Score
0.001
Published
2019-11-22
redhat-upgrade-tool: Does not check GPG signatures when upgrading versions
CVSS Score
9.8
EPSS Score
0.003
Published
2019-11-22
oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center
CVSS Score
6.5
EPSS Score
0.002
Published
2019-11-22
ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.
CVSS Score
6.4
EPSS Score
0.002
Published
2019-11-22