CVE-2018-1077

spacewalk: XML External Entity (XXE) on Spacewalk APIs

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.

CVSS 3.0 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Redhat

Products

Satellite Spacewalk

CVE-2018-1075

ovirt-engine: Unfiltered password when choosing manual db provisioning

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.

CVSS 3.0 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Ovirt Redhat

Products

Ovirt Rhev Manager

CVE-2018-1074

ovirt-engine: API exposes power management credentials to administrators

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.

CVSS 3.0 · 7.7 High EPSS 1.4% KEV · Not listed

Vendors

Ovirt Redhat

Products

Ovirt Enterprise Virtualization Rhev Manager

CVE-2018-1073

ovirt-engine: account enumeration through login to web console

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts.

CVSS 3.1 · 5.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Ovirt Redhat

Products

Ovirt-engine Enterprise Linux Virtualization and 1 more

CVE-2018-1072

ovirt-engine-setup: unfiltered db password in engine-backup log

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.

CVSS 3.0 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Ovirt Redhat

Products

Ovirt Enterprise Virtualization Manager Rhev Manager

CVE-2018-1071

zsh: Stack-based buffer overflow in exec.c:hashcmd()

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Redhat and 1 more

Products

Ubuntu Linux Debian Linux Enterprise Linux and 4 more

CVE-2018-1070

Routing: Malicous Service configuration can bring down routing for an entire shard.

routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which can cause an entire shard to be brought down. A malicious user can use this vulnerability to cause a Denial of Service attack for other users of the router shard.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2018-1069

Networking: container networking does not prevent access to network resources

Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. An attacker could override the UserId and GroupId for GlusterFS and NFS to read and write any data on the network filesystem.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2018-1068

kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c

A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 14 more

CVE-2018-1067

undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)

In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.

CVSS 3.1 · 6.1 Medium EPSS 1.8% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd and 3 more

CVE-2018-1066

kernel: Null pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() when empty TargetInfo is returned in NTLMSSP setup negotiation response allowing to crash client's kernel

The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery.

CVSS 3.0 · 6.5 Medium EPSS 3.4% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 1 more

CVE-2018-1065

kernel: netfilter: xtables NULL pointer dereference in ip6_tables.c:ip6t_do_table() leading to a crash

The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2018-1064

libvirt: Incomplete fix for CVE-2018-5748 triggered by QEMU guest agent

libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed

Vendors

Debian Redhat

Products

Debian Linux Enterprise Linux Libvirt and 1 more

CVE-2018-1063

policycoreutils: Relabelling of symbolic links in /tmp and /var/tmp change the context of their target instead

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.

CVSS 3.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Selinux Project

Products

Enterprise Linux Selinux

CVE-2018-1062

ovirt-engine: When Wipe After Delete (WAD) and Enable Discard are both enabled for a VM disk, discarded data might not be wiped after the disk is removed.

A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM.

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed

Vendors

Redhat

Products

Ovirt-engine Rhev Manager

CVE-2018-1059

dpdk: Information exposure in unchecked guest physical to host virtual address translations

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Dpdk Redhat

Products

Ubuntu Linux Data Plane Development Kit Ceph Storage and 8 more

CVE-2018-1058

postgresql: Uncontrolled search path element in pg_dump and other client applications

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.

CVSS 3.1 · 8.8 High EPSS 13.1% KEV · Not listed

Vendors

Canonical Postgresql Redhat

Products

Ubuntu Linux Postgresql Cloudforms and 2 more

CVE-2018-1057

samba: Authenticated users can change other users password in an AD DC configuration

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

CVSS 3.1 · 8.8 High EPSS 10.0% KEV · Not listed

Vendors

Canonical Debian Samba

Products

Ubuntu Linux Debian Linux Samba

CVE-2018-1056

advancecomp: Heap buffer overflow in zip.cc:zip_entry::load_cent() allows for denial of service or unspecified impact via crafted ZIP file

An out-of-bounds heap buffer read flaw was found in the way advancecomp before 2.1-2018/02 handled processing of ZIP files. An attacker could potentially use this flaw to crash the advzip utility by tricking it into processing crafted ZIP files.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed

Vendors

Advancemame Canonical Debian

Products

Advancecomp Ubuntu Linux Debian Linux

CVE-2018-1054

389-ds-base: remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 in collate.c

An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.

CVSS 3.0 · 7.5 High EPSS 4.6% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

389 Directory Server Enterprise Linux Enterprise Linux Desktop and 2 more