Doran Moppert

A flaw was found in argocd, allowing any unprivileged user to deploy argocd in their namespace. With the created ServiceAccount `argocd-argocd-server`, the unprivileged user can read all resources of the cluster, including all secrets, which might enable privilege escalations. The highest threat from this issue is to data confidentiality.

A flaw was found in the provisioning of internal service APIs, which were incorrectly set up using a test certificate from the source repository. This results in all installations using the same certificates. If an attacker can observe network traffic internal to a cluster, they could use the private key to decode API requests that should be protected by TLS sessions, potentially obtaining information they would not otherwise be able to. These certificates are not used for service authentication, so no opportunity for impersonation or active MITM attacks is made possible.

A denial of service issue was discovered in nbdkit. An attacker could connect to the nbdkit service, causing it to perform a large amount of work in initializing backend plugins by simply opening a connection to the service. This could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Name of the Vulnerable Software and Affected Versions: oVirt Metrics (affected versions not specified) Description: The issue concerns sensitive passwords used in the deployment and configuration of oVirt Metrics. These passwords are insufficiently protected and could be disclosed in log files if playbooks are run with the -v option or in playbooks stored on Metrics or Bastion hosts. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A flaw in fence-agents can cause the fence rhevm component to exit with an exception when non-ASCII characters are used in certain fields of a guest VM, such as comments. This issue can lead to denial of service in cluster environments, preventing automated recovery. The vulnerability is related to encoding errors and can be exploited by a remote attacker to cause a denial of service.

The issue is related to the `virConnectGetDomainCapabilities()` function in the libvirt API, which accepts an `emulatorbin` argument. This argument can be used to specify a program for domain emulation. Since version 1.2.19, libvirt executes the specified program to probe domain capabilities. A problem arises because read-only clients can provide an arbitrary path for the `emulatorbin` argument, potentially causing libvirtd to execute a crafted executable with its own privileges. This is due to errors in access control.

The issue is related to insufficient access control in the `virDomainManagedSaveDefineXML()` API, allowing readonly clients to modify managed save state files. If a managed save was created by a privileged user, a local attacker could modify this file to execute an arbitrary program when the domain is resumed. This could potentially allow an attacker to change arbitrary files by sending a specially crafted request.

The gnome-shell lock screen does not properly restrict all contextual actions, allowing an attacker with physical access to a locked workstation to invoke certain keyboard shortcuts and potentially other actions.

The issue concerns improper restriction of access to the infopipe based on the `allowed uids` configuration parameter. This could lead to the disclosure of sensitive information stored in the user directory to local attackers.

The issue allows an attacker to cause a denial of service condition by uploading a specially crafted image, which could consume unbounded amounts of memory or CPU time, potentially impacting other users of the host.

The issue allows for information exposure through log files. When the engine-backup command is run with certain options, such as `--provision*db`, the database `username` and `password` are logged in cleartext. This could lead to database passwords being leaked if the provisioning log is shared.

The issue is due to a missing no log directive in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook, which results in the inadvertent disclosure of admin passwords in the provisioning log. This could lead to privilege escalation in environments where logs are shared with other parties.

The web console login form in oVirt Engine returned different errors for non-existent users and invalid passwords. This allowed an attacker to discover the names of valid user accounts by exploiting the difference in error responses.

The issue allows exposure of Power Management credentials, including cleartext passwords, to Host Administrators. A Host Administrator could exploit this to gain access to the power management systems of hosts they control.

The issue is related to errors in authorization. It violates security assumptions made by pam shells and some daemons, which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users who had their shell changed to /sbin/nologin could still access the system. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

A vulnerability was discovered where the combination of Enable Discard and Wipe After Delete flags for VM disks could cause a disk to be incompletely zeroed when removed from a VM. This could potentially reveal sensitive data to privileged users of another VM if the same storage blocks are later allocated to a new disk.

The issue concerns external entity expansion (XXE) not being disabled when parsing an SVG file. This could allow an attacker to craft a malicious SVG file, potentially leading to denial of service or information disclosure when processed by an application using the affected software.

A heap-based buffer overflow flaw was found in the patch for a previous issue. A crafted j2k image could cause the application to crash, or potentially execute arbitrary code.

The issue is related to the mtree bidder in libarchive, which does not properly track line sizes when extending the read-ahead. This allows remote attackers to cause a denial of service, resulting in a crash, by providing a crafted file. The crash is triggered by an invalid read in either the `detect form` or `bid entry` function in libarchive/archive read support format mtree.c.

The issue is related to a stack-based buffer overflow in the safe fprintf function, located in tar/util.c. This overflow can be triggered by remote attackers who send a crafted non-printable multibyte character in a filename, potentially causing a denial of service.