CVE-2020-10769

kernel: Buffer over-read in crypto_authenc_extractkeys() when a payload longer than 4 bytes is not aligned.

A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4 bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat, leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Opensuse Redhat

Products

Leap Enterprise Linux Rhel Extras Rt

CVE-2020-10768

kernel: Indirect branch speculation can be enabled after it was force-disabled by the PR_SPEC_FORCE_DISABLE prctl command.

A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation after it has been disabled. This call incorrectly reports it as being 'force disabled' when it is not and opens the system to Spectre v2 attacks. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel E4s and 1 more

CVE-2020-10767

kernel: Indirect Branch Prediction Barrier is force-disabled when STIBP is unavailable or enhanced IBRS is available.

A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBPB mitigation will be disabled when STIBP is not available or when the Enhanced Indirect Branch Restricted Speculation (IBRS) is available. This flaw allows a local attacker to perform a Spectre V2 style attack when this configuration is active. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel E4s and 1 more

CVE-2020-10766

kernel: Rogue cross-process SSBD shutdown. Linux scheduler logical bug allows an attacker to turn off the SSBD protection.

A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with a local account to disable SSBD protection during a context switch when additional speculative execution mitigations are in place. This issue was introduced when the per task/process conditional STIPB switching was added on top of the existing SSBD switching. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel E4s and 1 more

CVE-2020-10763

heketi: gluster-block volume password details available in logs

An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwords.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Heketi Project Redhat

Products

Heketi Enterprise Linux Gluster Storage and 3 more

CVE-2020-10762

gluster-block: information disclosure through world-readable gluster-block log files

An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Gluster-block Storage

CVE-2020-10761

QEMU: nbd: reachable assertion failure in nbd_negotiate_send_rep_verr via remote client

An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service.

CVSS 3.1 · 5 Medium EPSS 1.8% KEV · Not listed

Vendors

Canonical Opensuse Qemu and 1 more

Products

Ubuntu Linux Leap Qemu and 2 more

CVE-2020-10760

samba: LDAP Use-after-free in Samba AD DC Global Catalog with paged_results and VLV

A use-after-free flaw was found in all samba LDAP server versions before 4.10.17, before 4.11.11, before 4.12.4 used in a AC DC configuration. A Samba LDAP user could use this flaw to crash samba.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed

Vendors

Canonical Fedoraproject Opensuse and 1 more

Products

Ubuntu Linux Fedora Leap and 1 more

CVE-2020-10759

fwupd: Possible bypass in signature verification

A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. The highest threat from this vulnerability is to confidentiality and integrity.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux

CVE-2020-10758

keycloak: DoS by sending multiple simultaneous requests with a Content-Length header value greater than actual byte count of request body

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Openshift Application Runtimes and 2 more

CVE-2020-10757

kernel: kernel: DAX hugepages not considered during mremap

A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 10 more

CVE-2020-10756

QEMU: slirp: networking out-of-bounds read information disclosure vulnerability

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Libslirp Project and 2 more

Products

Ubuntu Linux Debian Linux Libslirp and 4 more

CVE-2020-10755

openstack-cinder: Improper handling of ScaleIO backend credentials

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the ``connection_info`` element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint. Source: OpenStack project

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Canonical Redhat

Products

Ubuntu Linux Openstack Openstack-cinder

CVE-2020-10754

NetworkManager: user configuration not honoured leaving the connection unauthenticated via insecure defaults

It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and the connection is made insecurely.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Gnome Redhat

Products

Fedora Networkmanager Enterprise Linux

CVE-2020-10753

ceph: radosgw: HTTP header injection via CORS ExposeHeader tag

A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway). The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. Ceph versions 3.x and 4.x are vulnerable to this issue.

CVSS 3.1 · 5.4 Medium EPSS 1.5% KEV · Not listed

Vendors

Canonical Fedoraproject Linuxfoundation and 2 more

Products

Ubuntu Linux Fedora Ceph and 3 more

CVE-2020-10752

openshift/openshift-apiserver: oauthtokens leaked to logs on panic

A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API Server panic occurred. This flaw allows an attacker with the ability to cause an API Server error to read the logs, and use the leaked OAuthToken to log into the API Server with the leaked token.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Openshift Container Platform

CVE-2020-10751

kernel: SELinux netlink permission check bypass

A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Kernel Redhat

Products

Selinux Enterprise Linux Enterprise Linux Server and 1 more

CVE-2020-10750

jaegertracing/jaeger: credentials leaked to container logs

Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linuxfoundation Redhat

Products

Jaeger Jaeger

CVE-2020-10749

containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters

A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.

CVSS 3.1 · 6 Medium EPSS 2.1% KEV · Not listed

Vendors

Fedoraproject Linuxfoundation Redhat

Products

Fedora Cni Network Plugins Container Native Virtualization and 4 more

CVE-2020-10748

keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697)

A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Single Sign-on