CVE sync 2026-11-12T11:31:36Z
This commit is contained in:
Vulnerability Bot committed
1 parent
0f91613884
commit
249bc4cebe
21 files changed
+1752
-187
No files matched your search
@@ -0,0 +1,164 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-114369",
|
||||
"assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "Qt",
|
||||
"dateReserved": "2026-10-21T10:56:06.723Z",
|
||||
"datePublished": "2026-11-12T11:09:29.857Z",
|
||||
"dateUpdated": "2026-11-12T11:09:29.857Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
|
||||
"shortName": "Qt",
|
||||
"dateUpdated": "2026-11-12T11:09:29.857Z"
|
||||
},
|
||||
"title": "Security Issue CVE-2026-114369 - Resource exhaustion (denial of service) vulnerability in the WebSocket handshake handling of QWebSocket and QWebSocketServer impacts Qt Framework",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-407",
|
||||
"description": "CWE-407 Inefficient Algorithmic Complexity",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-227",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-227 Sustained Client Engagement"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "qt",
|
||||
"product": "Qt Framework",
|
||||
"modules": [
|
||||
"qtwebsockets"
|
||||
],
|
||||
"versions": [
|
||||
{
|
||||
"status": "unknown",
|
||||
"version": "0",
|
||||
"lessThan": "5.15.0",
|
||||
"versionType": "python"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "5.15.0",
|
||||
"lessThanOrEqual": "6.8.9",
|
||||
"versionType": "python"
|
||||
},
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "6.9.0",
|
||||
"lessThanOrEqual": "6.12.0",
|
||||
"versionType": "python"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected",
|
||||
"cpes": [
|
||||
"cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:qt:qtwebsockets:*:*:*:*:*:*:*:*"
|
||||
]
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.qt.io/security-advisories?search=CVE-2026-114369",
|
||||
"name": "Qt security advisory CVE-2026-114369",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://codereview.qt-project.org/c/qt/qtwebsockets/+/772146",
|
||||
"name": "Qt dev branch",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://codereview.qt-project.org/c/qt/qtwebsockets/+/772145",
|
||||
"name": "Qt dev branch",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://codereview.qt-project.org/c/qt/qtwebsockets/+/772144",
|
||||
"name": "Qt dev branch",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV4_0": {
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"attackRequirements": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"vulnConfidentialityImpact": "NONE",
|
||||
"subConfidentialityImpact": "NONE",
|
||||
"vulnIntegrityImpact": "NONE",
|
||||
"subIntegrityImpact": "NONE",
|
||||
"vulnAvailabilityImpact": "LOW",
|
||||
"subAvailabilityImpact": "NONE",
|
||||
"exploitMaturity": "UNREPORTED",
|
||||
"Safety": "NOT_DEFINED",
|
||||
"Automatable": "NOT_DEFINED",
|
||||
"Recovery": "AUTOMATIC",
|
||||
"valueDensity": "NOT_DEFINED",
|
||||
"vulnerabilityResponseEffort": "LOW",
|
||||
"providerUrgency": "CLEAR",
|
||||
"version": "4.0",
|
||||
"baseSeverity": "LOW",
|
||||
"baseScore": 2.7,
|
||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/R:A/RE:L/U:Clear"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "Joomla",
|
||||
"dateReserved": "2026-10-28T11:58:55.650Z",
|
||||
"datePublished": "2026-11-05T18:02:09.401Z",
|
||||
"dateUpdated": "2026-11-05T18:53:31.034Z"
|
||||
"dateUpdated": "2026-11-12T11:12:57.005Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -110,6 +110,40 @@
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
}
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "ssvc",
|
||||
"content": {
|
||||
"timestamp": "2026-11-12T11:12:48.502869Z",
|
||||
"id": "CVE-2026-118494",
|
||||
"options": [
|
||||
{
|
||||
"Exploitation": "none"
|
||||
},
|
||||
{
|
||||
"Automatable": "no"
|
||||
},
|
||||
{
|
||||
"Technical Impact": "partial"
|
||||
}
|
||||
],
|
||||
"role": "CISA Coordinator",
|
||||
"version": "2.0.3"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"title": "CISA ADP Vulnrichment",
|
||||
"providerMetadata": {
|
||||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"shortName": "CISA-ADP",
|
||||
"dateUpdated": "2026-11-12T11:12:57.005Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,141 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-124023",
|
||||
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "apache",
|
||||
"dateReserved": "2026-11-06T18:42:23.751Z",
|
||||
"datePublished": "2026-11-12T10:38:28.771Z",
|
||||
"dateUpdated": "2026-11-12T11:08:29.565Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||||
"shortName": "apache",
|
||||
"dateUpdated": "2026-11-12T10:38:28.771Z"
|
||||
},
|
||||
"title": "Apache Axis2/C: Out-of-bounds read in the Guththila XML reader wrapper",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"description": "CWE-125 Out-of-bounds read",
|
||||
"lang": "en",
|
||||
"cweId": "CWE-125",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Apache Software Foundation",
|
||||
"product": "Apache Axis2/C",
|
||||
"repo": "https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "f2b30c159720cf63ada72f19183828533154c749",
|
||||
"lessThan": "23110287924e79d05a5b4712298c355d1f05c606",
|
||||
"versionType": "git"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
},
|
||||
{
|
||||
"vendor": "Apache Software Foundation",
|
||||
"product": "Apache Axis2/C",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "0",
|
||||
"lessThanOrEqual": "2.0.0",
|
||||
"versionType": "semver"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"value": "Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its range, reading heap memory past the end of the table. An unauthenticated client could trigger this by sending a crafted XML request to a server built with Guththila, the default parser, causing the request to be parsed incorrectly or, in some cases, the process to crash. The memory read is not returned to the client. This issue affects Apache Axis2/C: through 2.0.0. The fix is available in commits 23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6 and will be included in the next release.",
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its range, reading heap memory past the end of the table. An unauthenticated client could trigger this by sending a crafted XML request to a server built with Guththila, the default parser, causing the request to be parsed incorrectly or, in some cases, the process to crash. The memory read is not returned to the client. This issue affects Apache Axis2/C: through 2.0.0. The fix is available in commits 23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6 and will be included in the next release.<br><br>"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/apache/axis-axis2-c-core/commit/23110287924e79d05a5b4712298c355d1f05c606",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/apache/axis-axis2-c-core/commit/f01683ec10e8fddb87279ec9351b3239021223e6",
|
||||
"tags": [
|
||||
"patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://lists.apache.org/thread/yzmshl8n819pfy2f3p07r9swgh0b3dfz",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"type": "Textual description of severity",
|
||||
"content": {
|
||||
"text": "low"
|
||||
}
|
||||
},
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Adithyan P",
|
||||
"type": "finder"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 1.0.3"
|
||||
}
|
||||
},
|
||||
"adp": [
|
||||
{
|
||||
"title": "CVE Program Container",
|
||||
"references": [
|
||||
{
|
||||
"url": "http://www.openwall.com/lists/oss-security/2026/11/12/1"
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||||
"shortName": "CVE",
|
||||
"dateUpdated": "2026-11-12T11:08:29.565Z"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,113 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-124701",
|
||||
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ProgressSoftware",
|
||||
"dateReserved": "2026-11-09T10:41:43.933Z",
|
||||
"datePublished": "2026-11-12T10:45:53.345Z",
|
||||
"dateUpdated": "2026-11-12T10:45:53.345Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
|
||||
"shortName": "ProgressSoftware",
|
||||
"dateUpdated": "2026-11-12T10:45:53.345Z"
|
||||
},
|
||||
"title": "Deserialization of Untrusted Data in Progress Telerik UI for WinForms",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-502",
|
||||
"description": "CWE-502 Deserialization of Untrusted Data",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-586",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CAPEC-586 Object Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Progress Software",
|
||||
"product": "Telerik UI for WinForms",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "2026.3.1007",
|
||||
"lessThan": "2026.4.1111",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.telerik.com/products/winforms/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-124701",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.8,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "INTERNAL"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-124703",
|
||||
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ProgressSoftware",
|
||||
"dateReserved": "2026-11-09T10:41:43.933Z",
|
||||
"datePublished": "2026-11-12T10:53:41.511Z",
|
||||
"dateUpdated": "2026-11-12T10:53:41.511Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
|
||||
"shortName": "ProgressSoftware",
|
||||
"dateUpdated": "2026-11-12T10:53:41.511Z"
|
||||
},
|
||||
"title": "Improper Control of Generation of Code in Progress Telerik UI for WPF",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-94",
|
||||
"description": "CWE-94 Improper Control of Generation of Code",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Code Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Progress Software",
|
||||
"product": "Telerik UI for WPF",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "2026.3.1007",
|
||||
"lessThan": "2026.4.1110",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to execute unauthorized code in the context of the affected application.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to execute unauthorized code in the context of the affected application."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-improper-control-of-generation-of-code-cve-2026-124703",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.8,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "INTERNAL"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,113 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-124704",
|
||||
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "ProgressSoftware",
|
||||
"dateReserved": "2026-11-09T10:41:43.933Z",
|
||||
"datePublished": "2026-11-12T10:56:36.170Z",
|
||||
"dateUpdated": "2026-11-12T10:56:36.170Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
|
||||
"shortName": "ProgressSoftware",
|
||||
"dateUpdated": "2026-11-12T10:56:36.170Z"
|
||||
},
|
||||
"title": "Deserialization of Untrusted Data in Progress Telerik UI for WPF",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"cweId": "CWE-502",
|
||||
"description": "CWE-502 Deserialization of Untrusted Data",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"impacts": [
|
||||
{
|
||||
"capecId": "CAPEC-586",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Object Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Progress Software",
|
||||
"product": "Telerik UI for WPF",
|
||||
"versions": [
|
||||
{
|
||||
"status": "affected",
|
||||
"version": "2026.3.1007",
|
||||
"lessThan": "2026.4.1110",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.telerik.com/products/wpf/documentation/knowledge-base/kb-security-deserialization-of-untrusted-data-cve-2026-124704",
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
{
|
||||
"format": "CVSS",
|
||||
"scenarios": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GENERAL"
|
||||
}
|
||||
],
|
||||
"cvssV3_1": {
|
||||
"version": "3.1",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseSeverity": "HIGH",
|
||||
"baseScore": 7.8,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "INTERNAL"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "fortinet",
|
||||
"dateReserved": "2026-11-10T20:09:01.512Z",
|
||||
"datePublished": "2026-11-11T21:35:18.269Z",
|
||||
"dateUpdated": "2026-11-11T21:35:18.269Z"
|
||||
"dateUpdated": "2026-11-12T10:32:04.483Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -39,7 +39,6 @@
|
||||
"cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*",
|
||||
@@ -94,7 +93,7 @@
|
||||
{
|
||||
"versionType": "semver",
|
||||
"version": "7.2.0",
|
||||
"lessThanOrEqual": "7.2.13",
|
||||
"lessThanOrEqual": "7.2.12",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
@@ -131,7 +130,6 @@
|
||||
"cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*",
|
||||
@@ -186,7 +184,7 @@
|
||||
{
|
||||
"versionType": "semver",
|
||||
"version": "7.2.0",
|
||||
"lessThanOrEqual": "7.2.13",
|
||||
"lessThanOrEqual": "7.2.12",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
@@ -221,7 +219,6 @@
|
||||
"cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*",
|
||||
@@ -272,7 +269,7 @@
|
||||
{
|
||||
"versionType": "semver",
|
||||
"version": "7.2.1",
|
||||
"lessThanOrEqual": "7.2.13",
|
||||
"lessThanOrEqual": "7.2.12",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
@@ -307,7 +304,6 @@
|
||||
"cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*",
|
||||
"cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*",
|
||||
@@ -358,7 +354,7 @@
|
||||
{
|
||||
"versionType": "semver",
|
||||
"version": "7.2.1",
|
||||
"lessThanOrEqual": "7.2.13",
|
||||
"lessThanOrEqual": "7.2.12",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
@@ -373,13 +369,13 @@
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests."
|
||||
"value": "A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiAnalyzer Cloud 7.0 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager 7.0 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12, FortiManager Cloud 7.0 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
|
||||
"shortName": "fortinet",
|
||||
"dateUpdated": "2026-11-11T21:35:18.269Z"
|
||||
"dateUpdated": "2026-11-12T10:32:04.483Z"
|
||||
},
|
||||
"problemTypes": [
|
||||
{
|
||||
@@ -415,7 +411,7 @@
|
||||
"solutions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above"
|
||||
"value": "Upgrade to FortiManager version 8.0.2 or above\nUpgrade to FortiManager version 7.6.8 or above\nUpgrade to FortiManager version 7.4.12 or above\nUpgrade to FortiManager version 7.2.13 or above\nUpgrade to FortiManager Cloud version 8.0.2 or above\nUpgrade to FortiManager Cloud version 7.6.8 or above\nUpgrade to FortiManager Cloud version 7.4.12 or above\nUpgrade to FortiManager Cloud version 7.2.13 or above\nUpgrade to FortiAnalyzer version 8.0.2 or above\nUpgrade to FortiAnalyzer version 7.6.8 or above\nUpgrade to FortiAnalyzer version 7.4.12 or above\nUpgrade to FortiAnalyzer version 7.2.13 or above\nUpgrade to FortiAnalyzer Cloud version 8.0.2 or above\nUpgrade to FortiAnalyzer Cloud version 7.6.8 or above\nUpgrade to FortiAnalyzer Cloud version 7.4.12 or above\nUpgrade to FortiAnalyzer Cloud version 7.2.13 or above"
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
|
||||
@@ -0,0 +1,177 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126641",
|
||||
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-11-11T10:46:47.354Z",
|
||||
"datePublished": "2026-11-12T10:47:30.699Z",
|
||||
"dateUpdated": "2026-11-12T10:47:30.699Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Ansible-pylibssh: accepts a changed ssh host key when host_key_auto_add is enabled",
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"content": {
|
||||
"value": "Moderate",
|
||||
"namespace": "https://access.redhat.com/security/updates/classification/"
|
||||
},
|
||||
"type": "Red Hat severity rating"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
|
||||
"version": "3.1"
|
||||
},
|
||||
"format": "CVSS"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A host key verification flaw was found in ansible-pylibssh and in the ansible.netcommon libssh connection plugin. When trust-on-first-use is enabled (host_key_auto_add on the libssh connection plugin, or AutoAddPolicy in ansible-pylibssh), a host that is already present in known_hosts but now presents a different key is accepted without warning. The pylibssh Session.verify_knownhost() method passes the SSH_KNOWN_HOSTS_CHANGED and SSH_KNOWN_HOSTS_OTHER states to the same missing_host_key() policy hook used for unknown hosts, and the bundled AutoAddPolicy/RejectPolicy classes (as well as ansible.netcommon's MyAddPolicy, which is modeled on paramiko's AutoAddPolicy) therefore add the changed key and continue the connection rather than aborting as paramiko's BadHostKeyException path would. As a result the controller authenticates to the substitute host, runs the play there, and appends the new key to known_hosts, which can disclose connection credentials to an attacker performing a machine-in-the-middle attack. Default configurations (host_key_checking enabled, host_key_auto_add unset) are not affected; non-interactive runs fail closed."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Ansible Automation Platform 2",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "ansible-automation-platform-26/ee-supported-rhel9",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:ansible_automation_platform:2"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Ansible Automation Platform 2",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "ansible-automation-platform-27/ee-supported-rhel9",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:ansible_automation_platform:2"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Ansible Automation Platform 2",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "python3.11-ansible-pylibssh",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:ansible_automation_platform:2"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Ansible Automation Platform 2",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "python3.12-ansible-pylibssh",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:ansible_automation_platform:2"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Ansible Automation Platform 2",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "python3x-ansible-pylibssh",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:ansible_automation_platform:2"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Ansible Automation Platform 2",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "python-ansible-pylibssh",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:ansible_automation_platform:2"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-126641",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571719",
|
||||
"name": "RHBZ#2571719",
|
||||
"tags": [
|
||||
"issue-tracking",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-11T14:19:28.279Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-322",
|
||||
"description": "Key Exchange without Entity Authentication",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_redhatCweChain": "CWE-322: Key Exchange without Entity Authentication",
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Do not enable host_key_auto_add (ansible.netcommon libssh) or AutoAddPolicy (ansible-pylibssh). Keep host_key_checking enabled and pre-populate known_hosts with verified host keys so that a changed key causes the connection to fail closed."
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-11T14:10:25.855Z",
|
||||
"value": "Reported to Red Hat."
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-11T14:19:28.279Z",
|
||||
"value": "Made public."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Red Hat would like to thank Satriyo Utomo (aleens-labs) for reporting this issue."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-12T10:47:30.699Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,157 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126643",
|
||||
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-11-11T10:46:47.355Z",
|
||||
"datePublished": "2026-11-12T10:47:33.808Z",
|
||||
"dateUpdated": "2026-11-12T10:47:33.808Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Aap-gateway-operator: resource-server secret exposed in plaintext in the automationcontroller custom resource",
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"content": {
|
||||
"value": "Moderate",
|
||||
"namespace": "https://access.redhat.com/security/updates/classification/"
|
||||
},
|
||||
"type": "Red Hat severity rating"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||
"version": "3.1"
|
||||
},
|
||||
"format": "CVSS"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads the protected resource-server Secret (Secret/<aap-name>-resource-server, key controller_resource_server_secret) and copies its plaintext value into the generated AutomationController custom resource under spec.extra_settings (RESOURCE_SERVER.SECRET_KEY). Although the operator uses no_log to keep the value out of its own logs, serializing it into the custom resource exposes it to any principal able to read the AutomationController CR without permission to read the backing Kubernetes Secret, breaking the expected OpenShift RBAC separation between the two resources. The value may also propagate into Kubernetes API/etcd storage, GitOps and Argo diffs and history, rendered manifests, support bundles, and audit data. The resource-server secret is intended for trusted Gateway-to-Controller service authentication, and its disclosure may allow a user to impersonate a trusted Controller service and reach privileged service-index APIs."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Ansible Automation Platform 2",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "ansible-automation-platform-25/gateway-rhel8-operator",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:ansible_automation_platform:2"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Ansible Automation Platform 2",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "ansible-automation-platform-25/gateway-rhel9-operator",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:ansible_automation_platform:2"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Ansible Automation Platform 2",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "ansible-automation-platform-26/gateway-rhel9-operator",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:ansible_automation_platform:2"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Ansible Automation Platform 2",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "ansible-automation-platform-27/gateway-rhel9-operator",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:ansible_automation_platform:2"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-126643",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571730",
|
||||
"name": "RHBZ#2571730",
|
||||
"tags": [
|
||||
"issue-tracking",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-11T14:29:44.915Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-312",
|
||||
"description": "Cleartext Storage of Sensitive Information",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_redhatCweChain": "CWE-312: Cleartext Storage of Sensitive Information",
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Restrict OpenShift RBAC so that permission to read AutomationController custom resources is limited to principals already trusted to read the corresponding Kubernetes Secrets. Rotate the resource-server secret if untrusted principals may have been able to read the custom resource."
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-11T14:26:49.629Z",
|
||||
"value": "Reported to Red Hat."
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-11T14:29:44.915Z",
|
||||
"value": "Made public."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "This issue was discovered by Elijah DeLee (Red Hat Inc.)."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-12T10:47:33.808Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,131 @@
|
||||
{
|
||||
"dataType": "CVE_RECORD",
|
||||
"dataVersion": "5.2",
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-126644",
|
||||
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"state": "PUBLISHED",
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-11-11T10:46:47.355Z",
|
||||
"datePublished": "2026-11-12T10:50:16.148Z",
|
||||
"dateUpdated": "2026-11-12T10:50:16.148Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"title": "Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory",
|
||||
"metrics": [
|
||||
{
|
||||
"other": {
|
||||
"content": {
|
||||
"value": "Low",
|
||||
"namespace": "https://access.redhat.com/security/updates/classification/"
|
||||
},
|
||||
"type": "Red Hat severity rating"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cvssV3_1": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 3.9,
|
||||
"baseSeverity": "LOW",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
|
||||
"version": "3.1"
|
||||
},
|
||||
"format": "CVSS"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component (os.chown with follow_symlinks=False and O_NOFOLLOW in _safe_open_write()). When an unprivileged local user replaces their ~/.ssh directory with a symlink to a directory they do not own, and an operator subsequently runs the authorized_key task as root (a common provisioning pattern), the module resolves its path operations through the symlink: atomic_move() writes the temporary file in the symlink target and renames it to <target>/authorized_keys, creating or overwriting a file in the attacker-chosen directory, and os.chmod(sshdir, 0o700) follows the symlink and changes the target directory's permissions. The written file is chowned to the unprivileged user, so this is not a privilege escalation, but it allows an attacker to create or overwrite files (for example in /etc/apt/apt.conf.d/, which APT reads regardless of file ownership) to cause integrity and availability impacts."
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 10",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "rhc-worker-playbook",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:10"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 9",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "rhc-worker-playbook",
|
||||
"defaultStatus": "affected",
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:enterprise_linux:9"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-126644",
|
||||
"tags": [
|
||||
"vdb-entry",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571732",
|
||||
"name": "RHBZ#2571732",
|
||||
"tags": [
|
||||
"issue-tracking",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
}
|
||||
],
|
||||
"datePublic": "2026-11-11T14:33:28.109Z",
|
||||
"problemTypes": [
|
||||
{
|
||||
"descriptions": [
|
||||
{
|
||||
"cweId": "CWE-59",
|
||||
"description": "Improper Link Resolution Before File Access",
|
||||
"lang": "en",
|
||||
"type": "CWE"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access",
|
||||
"workarounds": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Do not run ansible.posix.authorized_key as root against home or .ssh directories that unprivileged users can modify. Verify that target directories are not attacker-controllable symlinks before running the task."
|
||||
}
|
||||
],
|
||||
"timeline": [
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-11T14:31:37.694Z",
|
||||
"value": "Reported to Red Hat."
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"time": "2026-11-11T14:33:28.109Z",
|
||||
"value": "Made public."
|
||||
}
|
||||
],
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-12T10:50:16.148Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-06-29T07:20:52.583Z",
|
||||
"datePublished": "2026-06-29T08:06:09.059Z",
|
||||
"dateUpdated": "2026-11-10T20:00:05.120Z"
|
||||
"dateUpdated": "2026-11-12T10:45:00.238Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -146,6 +146,26 @@
|
||||
"cpe:/o:redhat:enterprise_linux:9::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 9.8 Extended Update Support",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "util-linux",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:2.37.4-25.el9_8.2",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:rhel_eus:9.8::appstream",
|
||||
"cpe:/a:redhat:rhel_eus:9.8::crb",
|
||||
"cpe:/o:redhat:rhel_eus:9.8::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Cost Management On-Premise 1",
|
||||
@@ -584,6 +604,14 @@
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99119",
|
||||
"name": "RHSA-2026:99119",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-13595",
|
||||
"tags": [
|
||||
@@ -644,7 +672,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-10T20:00:05.120Z"
|
||||
"dateUpdated": "2026-11-12T10:45:00.238Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-06-29T14:42:33.339Z",
|
||||
"datePublished": "2026-08-31T19:23:18.741Z",
|
||||
"dateUpdated": "2026-11-09T05:19:17.236Z"
|
||||
"dateUpdated": "2026-11-12T11:14:04.702Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -102,6 +102,44 @@
|
||||
"cpe:/a:redhat:enterprise_linux:8::appstream"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "gdb",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:8.2-15.1.el8_4",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:rhel_aus:8.4::appstream",
|
||||
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "gdb",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:8.2-15.1.el8_4",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:rhel_aus:8.4::appstream",
|
||||
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 9",
|
||||
@@ -402,6 +440,14 @@
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99594",
|
||||
"name": "RHSA-2026:99594",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-13732",
|
||||
"tags": [
|
||||
@@ -459,7 +505,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-09T05:19:17.236Z"
|
||||
"dateUpdated": "2026-11-12T11:14:04.702Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-06-16T23:55:05.737Z",
|
||||
"datePublished": "2026-06-23T03:36:22.741Z",
|
||||
"dateUpdated": "2026-11-11T06:18:32.080Z"
|
||||
"dateUpdated": "2026-11-12T10:49:33.660Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -122,6 +122,90 @@
|
||||
"cpe:/o:redhat:enterprise_linux:8::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "openssh",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:8.0p1-7.el8_4.3",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:rhel_aus:8.4::appstream",
|
||||
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
|
||||
"cpe:/o:redhat:rhel_aus:8.4::baseos",
|
||||
"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "openssh",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:8.0p1-7.el8_4.3",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:rhel_aus:8.4::appstream",
|
||||
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
|
||||
"cpe:/o:redhat:rhel_aus:8.4::baseos",
|
||||
"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "openssh",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:8.0p1-15.el8_6.6",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:rhel_aus:8.6::appstream",
|
||||
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream",
|
||||
"cpe:/o:redhat:rhel_aus:8.6::baseos",
|
||||
"cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "openssh",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:8.0p1-15.el8_6.6",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:rhel_aus:8.6::appstream",
|
||||
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream",
|
||||
"cpe:/o:redhat:rhel_aus:8.6::baseos",
|
||||
"cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 9",
|
||||
@@ -1443,6 +1527,22 @@
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99573",
|
||||
"name": "RHSA-2026:99573",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99592",
|
||||
"name": "RHSA-2026:99592",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-55653",
|
||||
"tags": [
|
||||
@@ -1500,7 +1600,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-11T06:18:32.080Z"
|
||||
"dateUpdated": "2026-11-12T10:49:33.660Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
"assignerShortName": "redhat",
|
||||
"dateReserved": "2026-06-16T23:55:05.737Z",
|
||||
"datePublished": "2026-06-23T03:36:25.724Z",
|
||||
"dateUpdated": "2026-11-05T21:46:02.857Z"
|
||||
"dateUpdated": "2026-11-12T10:49:37.057Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
@@ -122,6 +122,90 @@
|
||||
"cpe:/o:redhat:enterprise_linux:8::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "openssh",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:8.0p1-7.el8_4.3",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:rhel_aus:8.4::appstream",
|
||||
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
|
||||
"cpe:/o:redhat:rhel_aus:8.4::baseos",
|
||||
"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "openssh",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:8.0p1-7.el8_4.3",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:rhel_aus:8.4::appstream",
|
||||
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream",
|
||||
"cpe:/o:redhat:rhel_aus:8.4::baseos",
|
||||
"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "openssh",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:8.0p1-15.el8_6.6",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:rhel_aus:8.6::appstream",
|
||||
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream",
|
||||
"cpe:/o:redhat:rhel_aus:8.6::baseos",
|
||||
"cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
|
||||
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
||||
"packageName": "openssh",
|
||||
"defaultStatus": "affected",
|
||||
"versions": [
|
||||
{
|
||||
"version": "0:8.0p1-15.el8_6.6",
|
||||
"lessThan": "*",
|
||||
"versionType": "rpm",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"cpes": [
|
||||
"cpe:/a:redhat:rhel_aus:8.6::appstream",
|
||||
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream",
|
||||
"cpe:/o:redhat:rhel_aus:8.6::baseos",
|
||||
"cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"
|
||||
]
|
||||
},
|
||||
{
|
||||
"vendor": "Red Hat",
|
||||
"product": "Red Hat Enterprise Linux 9",
|
||||
@@ -1427,6 +1511,22 @@
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99573",
|
||||
"name": "RHSA-2026:99573",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2026:99592",
|
||||
"name": "RHSA-2026:99592",
|
||||
"tags": [
|
||||
"vendor-advisory",
|
||||
"x_refsource_REDHAT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2026-55655",
|
||||
"tags": [
|
||||
@@ -1484,7 +1584,7 @@
|
||||
"providerMetadata": {
|
||||
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
|
||||
"shortName": "redhat",
|
||||
"dateUpdated": "2026-11-05T21:46:02.857Z"
|
||||
"dateUpdated": "2026-11-12T10:49:37.057Z"
|
||||
},
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.8.0"
|
||||
|
||||
@@ -4,55 +4,35 @@
|
||||
"cveMetadata": {
|
||||
"cveId": "CVE-2026-59599",
|
||||
"assignerOrgId": "83238938-5644-45f0-9007-c0392bcf6222",
|
||||
"state": "PUBLISHED",
|
||||
"state": "REJECTED",
|
||||
"assignerShortName": "Google_Devices",
|
||||
"dateReserved": "2026-07-06T06:25:53.894Z",
|
||||
"datePublished": "2026-11-10T19:22:13.747Z",
|
||||
"dateUpdated": "2026-11-10T19:47:13.747Z"
|
||||
"dateUpdated": "2026-11-12T11:15:37.859Z",
|
||||
"dateRejected": "2026-11-12T11:15:11.031Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "83238938-5644-45f0-9007-c0392bcf6222",
|
||||
"shortName": "Google_Devices",
|
||||
"dateUpdated": "2026-11-10T19:47:13.747Z"
|
||||
"dateUpdated": "2026-11-12T11:15:37.859Z"
|
||||
},
|
||||
"problemTypes": [
|
||||
"rejectedReasons": [
|
||||
{
|
||||
"descriptions": [
|
||||
"lang": "en",
|
||||
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"lang": "en",
|
||||
"description": "Elevation of privilege"
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"vendor": "Google",
|
||||
"product": "Android",
|
||||
"versions": [
|
||||
{
|
||||
"version": "Android kernel",
|
||||
"status": "affected"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Android on supported Pixel devices before security patch level 2026-11-05 allows elevation of privilege in the hypervisor subcomponent in the kernel, aka A-519434175."
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
"engine": "cvelib 1.7.1"
|
||||
"engine": "Vulnogram 1.0.5"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -8,14 +8,14 @@
|
||||
"assignerShortName": "apache",
|
||||
"dateReserved": "2026-07-30T16:38:58.984Z",
|
||||
"datePublished": "2026-11-05T14:11:35.683Z",
|
||||
"dateUpdated": "2026-11-10T17:01:18.681Z"
|
||||
"dateUpdated": "2026-11-12T10:41:07.490Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||||
"shortName": "apache",
|
||||
"dateUpdated": "2026-11-05T14:11:35.683Z"
|
||||
"dateUpdated": "2026-11-12T10:41:07.490Z"
|
||||
},
|
||||
"title": "Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading",
|
||||
"problemTypes": [
|
||||
@@ -50,13 +50,13 @@
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"value": "An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a \"file:\" URI to cause OFBiz to load an attacker-controlled Screen definition.\n\n\n\nThis issue affects Apache OFBiz: before 24.09.08.\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes the issue.",
|
||||
"value": "An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a \"file:\" URI to cause OFBiz to load an attacker-controlled Screen definition.\n\n\n\nThe described vulnerability was discovered independantly twice, with each having a CVE assigned. See References.\n\n\n\nThis issue affects Apache OFBiz: before 24.09.08.\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes the issue.",
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "<p>An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a \"file:\" URI to cause OFBiz to load an attacker-controlled Screen definition.</p><p>This issue affects Apache OFBiz: before 24.09.08.</p><p>Users are recommended to upgrade to version 24.09.08, which fixes the issue.</p>"
|
||||
"value": "<p>An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a \"file:\" URI to cause OFBiz to load an attacker-controlled Screen definition.</p><p>The described vulnerability was discovered independantly twice, with each having a CVE assigned. See References.</p><p>This issue affects Apache OFBiz: before 24.09.08.</p><p>Users are recommended to upgrade to version 24.09.08, which fixes the issue.</p>"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -67,6 +67,9 @@
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://app.opencve.io/cve/CVE-2026-83542"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
@@ -90,6 +93,21 @@
|
||||
"lang": "en",
|
||||
"value": "Naoya Takahashi (nakko)",
|
||||
"type": "reporter"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Jonah Burgess (CryptoCat)",
|
||||
"type": "reporter"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Krishna Uprit",
|
||||
"type": "remediation developer"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "David Crees, Abstract Shield",
|
||||
"type": "reporter"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
|
||||
@@ -8,14 +8,14 @@
|
||||
"assignerShortName": "apache",
|
||||
"dateReserved": "2026-08-31T17:54:52.913Z",
|
||||
"datePublished": "2026-11-05T13:59:22.695Z",
|
||||
"dateUpdated": "2026-11-06T11:39:30.788Z"
|
||||
"dateUpdated": "2026-11-12T10:41:35.991Z"
|
||||
},
|
||||
"containers": {
|
||||
"cna": {
|
||||
"providerMetadata": {
|
||||
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||||
"shortName": "apache",
|
||||
"dateUpdated": "2026-11-05T13:59:22.695Z"
|
||||
"dateUpdated": "2026-11-12T10:41:35.991Z"
|
||||
},
|
||||
"title": "Apache OFBiz: Unauthenticated RCE via login-page widget injection",
|
||||
"problemTypes": [
|
||||
@@ -50,13 +50,13 @@
|
||||
],
|
||||
"descriptions": [
|
||||
{
|
||||
"value": "Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:\n\n-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.\n\n-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.\n\n-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response — it is not limited to the login-failure rendering path used in the original report.\n\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.",
|
||||
"value": "Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:\n\n-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.\n\n-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.\n\n-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response — it is not limited to the login-failure rendering path used in the original report.\n\n\n\nThe described vulnerability was discovered independantly twice, with each having a CVE assigned. See References.\n\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.",
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"type": "text/html",
|
||||
"base64": false,
|
||||
"value": "Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:<br><br>-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.<br><br>-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.<br><br>-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response — it is not limited to the login-failure rendering path used in the original report.<br><br>Users are recommended to upgrade to version 24.09.08, which fixes this issue."
|
||||
"value": "Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:<br><br>-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.<br><br>-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.<br><br>-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response — it is not limited to the login-failure rendering path used in the original report.<br><div><br></div><div>The described vulnerability was discovered independantly twice, with each having a CVE assigned. See References.</div><div><br></div>Users are recommended to upgrade to version 24.09.08, which fixes this issue."
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -67,6 +67,9 @@
|
||||
"tags": [
|
||||
"vendor-advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://app.opencve.io/cve/CVE-2026-68524"
|
||||
}
|
||||
],
|
||||
"metrics": [
|
||||
@@ -100,6 +103,11 @@
|
||||
"lang": "en",
|
||||
"value": "David Crees, Abstract Shield",
|
||||
"type": "reporter"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Naoya Takahashi (nakko)",
|
||||
"type": "reporter"
|
||||
}
|
||||
],
|
||||
"x_generator": {
|
||||
|
||||
Reference in new issue
Block a user