Andrej Nemec

Name of the Vulnerable Software and Affected Versions: node-uuid versions prior to 1.4.4 Description: The issue is related to the generation of GUIDs using insufficiently random data, which could make it easier for attackers to have an unspecified impact via brute force guessing. Affected versions of `node-uuid` consistently fall back to using `Math.random` as an entropy source instead of `crypto`, resulting in potentially guessable UUIDs. Recommendations: Update to version 1.4.4 or later. As a temporary workaround, consider avoiding the use of `node-uuid` for generating sensitive identifiers until the issue is resolved. Restrict access to applications using `node-uuid` to minimize the risk of exploitation.

A remote attacker can trigger an out-of-bounds memory read by sending a DNS query, which can cause a crash while the software computes the hash of the query for a packet cache lookup.

The issue allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address. This is related to the HTML thumbnailer plugin.

A privilege escalation flaw was found in Ansible Tower, where it incorrectly configures the trust level of the `postgres` user when deploying a PostgreSQL database. This allows an attacker to gain admin level access to the database.

Name of the Vulnerable Software and Affected Versions: Samba versions 4.9.0 through 4.9.3 Description: The issue is related to the configuration of AD DC in Samba, where the mechanism for watching bad passwords to restrict brute forcing may not function as intended if the window for monitoring is set to more than 3 minutes. This primarily poses a risk to domains that have been upgraded from Samba 4.8 and earlier, as the password policies may not have been re-tested after the upgrade. The vulnerability is associated with an incorrect implementation of security checks for standard system elements, which could allow a remote attacker to compromise the integrity of information. Recommendations: For Samba versions 4.9.0 through 4.9.3, consider re-configuring the password watching mechanism to ensure it functions correctly, especially in domains upgraded from Samba 4.8 and earlier. As a temporary workaround, manual testing of password policies should be re-done after the upgrade to confirm they apply as expected. Additionally, restrict access to the AD DC configuration to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability was found in Openstack Glance where no limits are enforced within the Glance image service for both v1 and v2 "/images" API POST method for authenticated users. This could result in possible denial of service attacks through database table saturation.

A security issue was discovered where properties-based files for management and application realm configurations, containing user-to-role mappings, are world-readable. This allows all logged-in users to access user and role information.

The issue is related to a double free error in the snd rawmidi ioctl() handler, specifically in the rawmidi.c file, which can be exploited by a malicious local attacker for privilege escalation. This could potentially impact the confidentiality, integrity, and availability of protected information.

An input sanitization flaw was found in the `id` field in the dashboard controller. This flaw could be used to perform an SQL injection attack on the back end database.

The issue is related to a NULL pointer dereference vulnerability in the rebuild vlists function in lib/dotgen/conc.c in the dotgen library. This vulnerability allows remote attackers to cause a denial of service, resulting in an application crash, via a crafted file.

The issue concerns a Cross-Site Scripting (XSS) vulnerability in the ` keyify` function. This vulnerability allows remote attackers to inject arbitrary web scripts or HTML by exploiting the failure to escape the `key` argument.

A flaw in the cobbler software component leads to an invalid parameter validation issue, resulting in arbitrary file reading. This issue is triggered by navigating to a vulnerable URL via cobbler-web on a default installation.

The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and a restart of the pluto daemon.

The issue allows remote attackers to cause a denial of service, specifically memory consumption, by utilizing a crafted regular expression that contains a repeating pattern.

The issue allows local users to obtain sensitive password information by reading engine log files, as the `DWH DB PASSWORD` is not included in the list of keys to hide in log files.

The issue improperly handles wildcard matching against hostnames. This might allow remote attackers to have an unspecified impact via a valid X.509 certificate, as demonstrated by accepting *.example.com as a match for bar.foo.example.com.

The issue makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites.

The issue is related to improper validation of certificate paths, which can lead to a denial of service due to an infinite loop and memory consumption. This can be triggered by a certificate with a loop in the certificate chain.

A directory traversal vulnerability exists in the minion id validation of SaltStack Salt, allowing remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.

Name of the Vulnerable Software and Affected Versions: Pulp versions prior to 2.3.0 Description: The issue arises from Pulp using the same certificate authority key and certificate across all installations. This could potentially lead to security issues due to the lack of unique identification and authentication for each installation. Recommendations: For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue.