diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index 6a27a246869e..ad0fba1ec554 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,255 +1,284 @@ + + openvpn -- too long a username or password from a client can confuse openvpn servers + + + openvpn + 2.6.13 + + + + +

Frank Lichtenheld reports:

+
+

[OpenVPN v2.6.13 ...] improve server-side handling of clients sending + usernames or passwords longer than USER_PASS_LEN - this would not + result in a crash, buffer overflow or other security issues, but the + server would then misparse incoming IV variables and produce misleading + error messages.

+
+ + + + https://github.com/OpenVPN/openvpn/releases/tag/v2.6.13 + + + 2024-10-28 + 2025-01-17 + + + rsync -- Multiple security fixes rsync 3.4.0

rsync reports:

This update includes multiple security fixes:

  • CVE-2024-12084: Heap Buffer Overflow in Checksum Parsing
  • CVE-2024-12085: Info Leak via uninitialized Stack contents defeats ASLR
  • CVE-2024-12086: Server leaks arbitrary client files
  • CVE-2024-12087: Server can make client write files outside of destination directory using symbolic links
  • CVE-2024-12088: --safe-links Bypass
  • CVE-2024-12747: symlink race condition
 CVE-2024-12084 CVE-2024-12085 CVE-2024-12086 CVE-2024-12087 CVE-2024-12088 CVE-2024-12747 2025-01-14 2025-01-14 git -- multiple vulnerabilities git git-cvs git-gui git-p4 git-svn 2.48.1

Git development team reports:

CVE-2024-50349: Printing unsanitized URLs when asking for credentials made the user susceptible to crafted URLs (e.g. in recursive clones) that mislead the user into typing in passwords for trusted sites that would then be sent to untrusted sites instead.

CVE-2024-52006: Git may pass on Carriage Returns via the credential protocol to credential helpers which use line-reading functions that interpret said Carriage Returns as line endings, even though Git did not intend that.

 CVE-2024-50349 https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr CVE-2024-52006 https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp 2024-10-29 2025-01-14 keycloak -- Multiple security fixes keycloak 26.0.8

Keycloak reports:

This update includes 2 security fixes:

  • CVE-2024-11734: Unrestricted admin use of system and environment variables
  • CVE-2024-11736: Denial of Service in Keycloak Server via Security Headers
 CVE-2024-11734 CVE-2024-11736 2025-01-13 2025-01-13 asterisk - path traversal asterisk18 18.26.20 asterisk20 20.11.0

cve@mitre.org reports:

An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.

 CVE-2024-53566 https://nvd.nist.gov/vuln/detail/CVE-2024-53566 2024-12-02 2025-01-12 redis,valkey -- Denial-of-service valnerability due to malformed ACL selectors redis 7.0.07.4.2 redis72 7.2.7 valkey 8.0.2

Redis core team reports:

An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service.The problem exists in Redis 7.0.0 or newer.

CVE-2024-51741 https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9 2025-01-06 2025-01-10 redis,valkey -- Remote code execution valnerability redis 7.4.2 redis72 7.2.7 redis62 6.2.17 valkey 8.0.2

Redis core team reports:

An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting.

CVE-2024-46981 https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c 2025-01-06 2025-01-10 Gitlab -- Vulnerabilities gitlab-ce gitlab-ee 17.7.017.7.1 17.6.017.6.3 11.0.017.5.5

Gitlab reports:

Possible access token exposure in GitLab logs

Cyclic reference of epics leads resource exhaustion

Unauthorized user can manipulate status of issues in public projects

Instance SAML does not respect external_provider configuration

 CVE-2025-0194 CVE-2024-6324 CVE-2024-12431 CVE-2024-13041 https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/ 2025-01-08 2025-01-08