Red Hat
Page 17 of 74 — Red Hat CVEs from a corpus of 7350, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-31419 | Medium | 4.3 | 2024-04-03 | An information disclosure flaw was found in OpenShift Virtualization. The DownwardMetrics feature was introduced to expose host metrics to virtual machine gues… |
CVE-2024-1300 | Medium | 5.4 | 2024-04-02 | A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server na… |
CVE-2024-3094 | Critical | 10.0 | 2024-03-29 | Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build proces… |
CVE-2024-3019 | High | 8.8 | 2024-03-28 | A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the pr… |
CVE-2024-2947 | High | 7.3 | 2024-03-28 | A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in… |
CVE-2024-1023 | Medium | 6.5 | 2024-03-27 | A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP c… |
CVE-2023-5685 | High | 7.5 | 2024-03-22 | A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can… |
CVE-2024-2494 | Medium | 6.2 | 2024-03-21 | A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is pe… |
CVE-2024-28834 | Medium | 5.3 | 2024-03-21 | A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-ch… |
CVE-2024-1394 | High | 7.5 | 2024-03-21 | A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled… |
CVE-2024-28835 | Medium | 5.0 | 2024-03-21 | A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --… |
CVE-2024-2307 | Medium | 6.1 | 2024-03-19 | A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to… |
CVE-2024-1753 | High | 8.6 | 2024-03-18 | A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers… |
CVE-2024-2496 | Medium | 5.0 | 2024-03-18 | A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while… |
CVE-2024-2002 | High | 7.5 | 2024-03-18 | A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially cau… |
CVE-2023-7250 | Medium | 5.3 | 2024-03-18 | A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expe… |
CVE-2024-1013 | High | 7.8 | 2024-03-18 | An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnot… |
CVE-2023-6725 | Medium | 5.5 | 2024-03-15 | An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly mad… |
CVE-2024-1979 | Low | 3.5 | 2024-03-13 | A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the gi… |
CVE-2024-2182 | Medium | 6.5 | 2024-03-12 | A flaw was found in the Open Virtual Network (OVN). In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject special… |
CVE-2024-1441 | Medium | 5.5 | 2024-03-11 | An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array… |
CVE-2024-1725 | Medium | 6.5 | 2024-03-07 | A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to ga… |
CVE-2024-2236 | Medium | 5.9 | 2024-03-06 | A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack… |
CVE-2024-1722 | Low | 3.7 | 2024-02-29 | A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in. |
CVE-2024-0560 | Medium | 6.3 | 2024-02-28 | A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Toke… |
CVE-2023-6917 | Medium | 6.0 | 2024-02-28 | A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated… |
CVE-2024-21886 | High | 7.8 | 2024-02-28 | A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances… |
CVE-2024-21885 | High | 7.8 | 2024-02-28 | A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs a… |
CVE-2023-52160 | Medium | 6.5 | 2024-02-22 | The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verif… |
CVE-2023-3966 | High | 7.5 | 2024-02-22 | A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory a… |
CVE-2024-1635 | High | 7.5 | 2024-02-19 | A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and… |
CVE-2024-1488 | High | 8.0 | 2024-02-15 | A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configu… |
CVE-2023-50868 | High | 7.5 | 2024-02-14 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU… |
CVE-2023-50387 | High | 7.5 | 2024-02-14 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumpti… |
CVE-2024-1485 | High | 8.0 | 2024-02-14 | A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsin… |
CVE-2024-1454 | Low | 3.4 | 2024-02-12 | The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or… |
CVE-2024-1459 | Medium | 5.3 | 2024-02-12 | A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an a… |
CVE-2023-6681 | Medium | 5.3 | 2024-02-12 | A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary… |
CVE-2024-1062 | Medium | 5.5 | 2024-02-12 | A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr. |
CVE-2024-1151 | Medium | 5.5 | 2024-02-11 | A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls i… |
CVE-2024-0229 | High | 7.8 | 2024-02-09 | An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different… |
CVE-2024-1312 | Medium | 5.1 | 2024-02-08 | A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the mas_prev_slot… |
CVE-2023-6536 | Medium | 6.5 | 2024-02-07 | A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NV… |
CVE-2023-6535 | Medium | 6.5 | 2024-02-07 | A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NV… |
CVE-2023-6356 | Medium | 6.5 | 2024-02-07 | A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NV… |
CVE-2024-1048 | Low | 3.3 | 2024-02-06 | A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grub… |
CVE-2024-0690 | Medium | 5.0 | 2024-02-06 | An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still i… |
CVE-2023-4503 | Medium | 6.8 | 2024-02-06 | An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured… |
CVE-2023-50782 | High | 7.5 | 2024-02-05 | A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchan… |
CVE-2023-50781 | High | 7.5 | 2024-02-05 | A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to… |
CVE-2023-7216 | Medium | 5.3 | 2024-02-05 | A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially… |
CVE-2023-6240 | Medium | 6.5 | 2024-02-04 | A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt c… |
CVE-2024-1141 | Medium | 5.5 | 2024-02-01 | A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enable… |
CVE-2023-6780 | Medium | 5.3 | 2024-01-31 | An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue… |
CVE-2023-6779 | High | 8.2 | 2024-01-31 | An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog f… |
CVE-2023-6246 | High | 8.4 | 2024-01-31 | A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. Th… |
CVE-2023-5992 | Medium | 5.6 | 2024-01-31 | A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potentia… |
CVE-2024-1086 | High | 7.8 | 2024-01-31 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_… |
CVE-2024-0914 | Medium | 5.9 | 2024-01-31 | A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potent… |
CVE-2024-0564 | Medium | 5.3 | 2024-01-30 | A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4… |
CVE-2023-40551 | Medium | 5.1 | 2024-01-29 | A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system'… |
CVE-2023-40550 | Medium | 5.5 | 2024-01-29 | An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the system's boot phas… |
CVE-2023-40549 | Medium | 6.2 | 2024-01-29 | An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to lo… |
CVE-2023-40546 | Medium | 6.2 | 2024-01-29 | A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message… |
CVE-2023-40548 | High | 7.4 | 2024-01-29 | A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the P… |
CVE-2023-6200 | High | 7.5 | 2024-01-28 | A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router adve… |
CVE-2024-0841 | Medium | 6.6 | 2024-01-28 | A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allo… |
CVE-2023-6291 | High | 7.1 | 2024-01-26 | A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may… |
CVE-2023-52356 | High | 7.5 | 2024-01-25 | A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a re… |
CVE-2023-52355 | High | 7.5 | 2024-01-25 | An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a rem… |
CVE-2023-6267 | High | 8.6 | 2024-01-25 | A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being proc… |
CVE-2024-0822 | High | 7.5 | 2024-01-25 | An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in… |
CVE-2023-40547 | High | 8.3 | 2024-01-25 | A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allow… |
CVE-2023-39197 | Medium | 4.0 | 2024-01-23 | An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sens… |
CVE-2024-0775 | Medium | 6.7 | 2024-01-22 | A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information lea… |
CVE-2023-6531 | High | 7.0 | 2024-01-21 | A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()… |
CVE-2024-0607 | Medium | 6.6 | 2024-01-18 | A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and… |
CVE-2024-0409 | High | 7.8 | 2024-01-18 | A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with… |
CVE-2024-0408 | Medium | 5.5 | 2024-01-18 | A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues a… |
CVE-2023-6816 | Critical | 9.8 | 2024-01-18 | A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbit… |
CVE-2024-0646 | High | 7.0 | 2024-01-17 | An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls soc… |
CVE-2024-0641 | Medium | 5.5 | 2024-01-17 | A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with l… |
CVE-2024-0639 | Medium | 5.5 | 2024-01-17 | A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw all… |
CVE-2024-0582 | High | 7.8 | 2024-01-16 | A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and… |
CVE-2023-6395 | Medium | 6.7 | 2024-01-16 | The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with ro… |
CVE-2024-0567 | High | 7.5 | 2024-01-16 | A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating… |
CVE-2024-0232 | Medium | 4.7 | 2024-01-16 | A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a… |
CVE-2024-0553 | High | 7.5 | 2024-01-16 | A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts wit… |
CVE-2024-0565 | Medium | 6.8 | 2024-01-15 | An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This… |
CVE-2024-0562 | High | 7.8 | 2024-01-15 | A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delay… |
CVE-2023-4001 | Medium | 6.8 | 2024-01-15 | An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file that contains the passw… |
CVE-2023-6915 | Medium | 6.2 | 2024-01-15 | A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denia… |
CVE-2024-23301 | Medium | 5.5 | 2024-01-12 | Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets… |
CVE-2023-6683 | Medium | 6.5 | 2024-01-12 | A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_serve… |
CVE-2024-0443 | Medium | 5.5 | 2024-01-12 | A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is be… |
CVE-2023-5455 | Medium | 6.5 | 2024-01-10 | A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the use… |
CVE-2023-6476 | Medium | 6.5 | 2024-01-09 | A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount… |
CVE-2024-0340 | Medium | 4.4 | 2024-01-09 | A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between v… |
CVE-2021-3600 | High | 7.8 | 2024-01-08 | It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod o… |
CVE-2023-6270 | High | 7.0 | 2024-01-04 | A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`… |