CVE-2020-14352

librepo: missing path validation in repomd.xml may lead to directory traversal

A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may be able to copy files outside of the destination directory on the targeted system via path traversal. This flaw could potentially result in system compromise via the overwriting of critical system files. The highest threat from this flaw is to users that make use of untrusted third-party repositories.

CVSS 3.1 · 8.0 High EPSS 2.5% KEV · Not listed

Vendors

Fedoraproject Opensuse Redhat

Products

Fedora Backports Sle Leap and 4 more

CVE-2020-14351

kernel: performance counters race condition use-after-free

A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 5 more

CVE-2020-14350

postgresql: Uncontrolled search path element in CREATE EXTENSION

It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension. This affects PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Opensuse and 2 more

Products

Ubuntu Linux Debian Linux Leap and 6 more

CVE-2020-14349

postgresql: Uncontrolled search path element in logical replication

It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in order to execute arbitrary SQL command in the context of the user used for replication.

CVSS 3.1 · 7.1 High EPSS 2.2% KEV · Not listed

Vendors

Opensuse Postgresql Redhat

Products

Leap Postgresql Enterprise Linux and 4 more

CVE-2020-14348

AMQ: Denial of Service via unrecognized field injection

It was found in AMQ Online before 1.5.2 that injecting an invalid field to a user's AddressSpace configuration of the user namespace puts AMQ Online in an inconsistent state, where the AMQ Online components do not operate properly, such as the failure of provisioning and the failure of creating addresses, though this does not impact upon already existing messaging clients or brokers.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Amq Online

CVE-2020-14345

xorg-x11-server: Out-of-bounds access in XkbSetNames function

A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Redhat X.org

Products

Ubuntu Linux Enterprise Linux X Server

CVE-2020-14344

libX11: Heap overflow in the X input method client

An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Fedoraproject Opensuse and 2 more

Products

Ubuntu Linux Fedora Leap and 2 more

CVE-2020-14343

PyYAML: incomplete fix for CVE-2020-1747

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

CVSS 3.1 · 9.8 Critical EPSS 6.2% KEV · Not listed

Vendors

Oracle Pyyaml Redhat

Products

Communications Cloud Native Core Network Function Cloud Native Environment Pyyaml Enterprise Linux and 2 more

CVE-2020-14342

cifs-utils: shell command injection in mount.cifs

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Opensuse Samba

Products

Fedora Leap Cifs-utils

CVE-2020-14341

RHSSO: test connection function in console permits timing based port scanning

The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timings of these scans, an attacker may glean information about hosts and ports which they do not have access to scan directly.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Single Sign-on

CVE-2020-14340

xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS

A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.

CVSS 3.1 · 5.9 Medium EPSS 2.2% KEV · Not listed

Vendors

Oracle Redhat

Products

Communications Cloud Native Core Console Communications Cloud Native Core Network Repository Function Communications Cloud Native Core Policy and 13 more

CVE-2020-14339

libvirt: leak of /dev/mapper/control into QEMU guests

A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Advanced Virtualization Enterprise Linux Libvirt

CVE-2020-14338

wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.

CVSS 3.1 · 5.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Jboss Enterprise Bpms Platform Jboss Enterprise Brms Platform and 4 more

CVE-2020-14337

Tower: Named URLs allow for testing the presence or absence of objects

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.8 Medium EPSS 1.5% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2020-14336

openshift: restricted SCC allows pods to craft custom network packets

A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allows an attacker to cause a denial of service attack on an OpenShift Container Platform cluster if they can deploy pods. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2020-14335

foreman: world-readable OMAPI secret through the ISC DHCP server

A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This flaw allows an attacker to gain control of DHCP records from the network. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Satellite Satellite Capsule

CVE-2020-14334

foreman: unauthorized cache read on RPM-based installations through local user

A flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files. These cache credentials could help attacker to gain complete control of the Satellite instance.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Satellite Satellite Capsule

CVE-2020-14333

ovirt-engine: Reflected cross site scripting vulnerability

A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not filter user-controllable parameters completely, resulting in a reflected cross-site scripting attack. This flaw allows an attacker to leverage a phishing attack, steal an unsuspecting user's cookies or other confidential information, or impersonate them within the application's context.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ovirt Redhat

Products

Ovirt-engine Rhev Manager

CVE-2020-14332

Ansible: module_args does not censor properly in --check mode

A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Redhat

Products

Debian Linux Ansible Engine

CVE-2020-14331

kernel: kernel: buffer over write in vgacon_scroll

A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds write to occur. This flaw allows a local user with access to the VGA console to crash the system, potentially escalating their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Extras Rt