Marcus Meissner

**Name of the Vulnerable Software and Affected Versions** libzypp versions prior to 17.38.13-1.1 **Description** An issue exists allowing path traversal via the `keyhint` variable. **Recommendations** Update to version 17.38.13-1.1.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A double-free issue exists in the `net/rds` module of the Linux kernel. The problem occurs when a zerocopy page pin operation fails within the `rds message zcopy from user()` function, specifically when `iov iter get pages2()` fails. In this scenario, while pinned pages are released and `rm->data.op mmp znotifier` is cleared, the memory management counter `op nents` is not correctly reset. Subsequently, when `rds sendmsg()` calls the `rds message purge()` function, the cleanup loop uses the incorrect non-zero value of `op nents` to release memory that has already been freed. A local attacker could exploit this to cause a system crash (denial of service), escalate privileges, or execute unauthorized code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `net/rds` module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** osc (affected versions not specified) **Description** The issue allows attackers to manipulate the configuration of osc by injecting special files in .osc into the actual package sources, such as ` apiurl`. This enables the attacker to alter the osc configuration for the victim. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OBS service obs-service-download url (affected versions not specified) **Description** The OBS service obs-service-download url was vulnerable to a command injection issue. An attacker could provide a configuration to the service that allowed executing commands in later steps. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SUSE kubewarden kubewarden-controller versions prior to 1.6.0 **Description** An Improper Privilege Management issue allows attackers to read arbitrary secrets if they gain access to the ServiceAccount `kubewarden-controller`. **Recommendations** For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the `kubewarden-controller` ServiceAccount to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SUSE Linux Enterprise Server 12 supportutils versions 3.0.10-95.51.1 and prior versions SUSE Linux Enterprise Server 15 supportutils versions 3.1.21-150000.5.44.1 and prior versions SUSE Linux Enterprise Server 15 SP3 supportutils versions 3.1.21-150300.7.35.15.1 and prior versions **Description** A Cleartext Storage of Sensitive Information issue in supportutils of SUSE Linux Enterprise Server allows attackers that gain access to the support logs to obtain knowledge of the stored credentials. **Recommendations** For SUSE Linux Enterprise Server 12 supportutils versions 3.0.10-95.51.1 and prior versions, update to a version later than 3.0.10-95.51.1 to resolve the issue. For SUSE Linux Enterprise Server 15 supportutils versions 3.1.21-150000.5.44.1 and prior versions, update to a version later than 3.1.21-150000.5.44.1 to resolve the issue. For SUSE Linux Enterprise Server 15 SP3 supportutils versions 3.1.21-150300.7.35.15.1 and prior versions, update to a version later than 3.1.21-150300.7.35.15.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** ConnMan versions 1.41 and earlier **Description** The issue is related to a use-after-free in WISPR handling, which could be triggered by a man-in-the-middle attack against a WISPR HTTP query. This could lead to crashes or code execution. The vulnerability is associated with the implementation of WISPR support in the ConnMan connection manager, allowing a remote attacker to cause a denial of service or execute arbitrary code. **Recommendations** For ConnMan versions 1.41 and earlier, as a temporary workaround, consider disabling WISPR handling until a patch is available. Restrict access to WISPR HTTP queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** swtpm versions 0.4.1 and earlier swtpm versions 0.5.x before 0.5.1 **Description** A local attacker may be able to overwrite arbitrary files via a symlink attack against a temporary file such as TMP2-00.permall. This issue allows an attacker to potentially gain unauthorized access to sensitive data. **Recommendations** For swtpm versions 0.4.1 and earlier, update to version 0.4.2 or later. For swtpm versions 0.5.x before 0.5.1, update to version 0.5.1 or later. As a temporary workaround, consider restricting access to temporary files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SUSE Rancher Desktop versions prior to V. **Description** A vulnerability in SUSE Rancher Desktop allows attackers in the local network to connect to the "Dashboard API (steve)" to carry out arbitrary actions due to improper access control. **Recommendations** For SUSE Rancher Desktop versions prior to V, consider restricting access to the Dashboard API as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3 openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions **Description** The issue is related to an improper authentication algorithm implementation in SaltStack Salt, allowing local attackers to execute arbitrary code via salt without specifying valid credentials. This can be exploited to gain unauthorized access. **Recommendations** For SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3, update to version 3002.2-3 or later. For openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions, update to a version later than 3002.2-2.1. As a temporary workaround, consider restricting access to the salt functionality until a patch is applied.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 5.10.11 Description: An issue in the Linux kernel allows local users to execute code in the kernel due to a use-after-free in PI futexes during fault handling. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Recommendations: For Linux kernel versions through 5.10.11, update to a version later than 5.10.11 to resolve the issue. At the moment, there is no information about other specific fixes for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb **Description** A Improper Neutralization of Input During Web Page Generation issue allows remote attackers to store arbitrary JS code, causing XSS. **Recommendations** For versions prior to 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb, update to a version that includes the fix for this issue to prevent remote attackers from storing arbitrary JS code and causing XSS.

**Name of the Vulnerable Software and Affected Versions** Pen version 0.18.0 **Description** The issue is related to Insecure Temporary File Creation. **Recommendations** For Pen version 0.18.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenStack nova (affected versions not specified) **Description** The issue concerns OpenStack nova base images having world-readable permissions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SUSE Linux SMT versions prior to 3.0.37 **Description** The issue is related to insufficient authentication procedure using the HOST header in SUSE Linux Subscription Management Tool (SMT), allowing a remote attacker to spoof a server. **Recommendations** For versions prior to 3.0.37, update to version 3.0.37 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** openbuildservice versions prior to 2.9.4 **Description** The issue allows authorized users to delete packages by sending a malicious request against projects with the OBS:InitializeDevelPackage attribute. This is similar to a previously identified issue. **Recommendations** For versions prior to 2.9.4, update to version 2.9.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** openSUSE openbuildservice versions prior to 9.2.4 **Description** The issue allows authenticated users to delete packages on specific projects with project links. **Recommendations** For versions prior to 9.2.4, update to version 9.2.4 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Open Build Service versions prior to 70d1aa4cc4d7b940180553a63805c22fc62e2cf0 Description: A path traversal vulnerability in obs-service-tar scm of Open Build Service allows remote attackers to access files not in the current build. The issue is related to incorrect restriction of directory path names with limited access. Exploitation of the vulnerability may allow an attacker to gain unauthorized access to protected information. Recommendations: For versions prior to 70d1aa4cc4d7b940180553a63805c22fc62e2cf0, update to a version that includes the fix for this issue to prevent unauthorized access to files. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** obs-service-set version versions prior to 0.5.3-1.1 **Description** The issue concerns the set version script in obs-service-set version, which is a source validator for the Open Build Service (OBS). This script did not properly sanitize user input, allowing for code execution on the server. **Recommendations** For versions prior to 0.5.3-1.1, update to version 0.5.3-1.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Open Build Service (OBS) versions prior to 2.4.6 **Description** The issue concerns the Open Build Service (OBS) where the CSRF protection is incorrectly disabled in the web interface. This allows for requests to be made without the user's consent. **Recommendations** For versions prior to 2.4.6, update to version 2.4.6 or later to resolve the issue.