oss-security mailing list

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2023/08

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 1	² 1	³ 2	⁴ 1	⁵ 1	⁶
⁷ 1	⁸ 8	⁹ 1	¹⁰ 3	¹¹ 1	¹²	¹³
¹⁴	¹⁵ 1	¹⁶ 5	¹⁷ 1	¹⁸ 2	¹⁹	²⁰ 1
²¹	²² 5	²³ 6	²⁴	²⁵ 4	²⁶ 3	²⁷ 5
²⁸ 4	²⁹ 1	³⁰ 1	³¹ 1

Messages by day:

August 1 (1 message)

Xen Security Advisory 436 v1 (CVE-2023-34320) - arm: Guests can trigger a deadlock on Cortex-A77 (Xen.org security team <security@....org>)

August 2 (1 message)

WebKitGTK and WPE WebKit Security Advisory WSA-2023-0007 (Carlos Alberto Lopez Perez <clopez@...lia.com>)

August 3 (2 messages)

Mozilla VPN: CVE-2023-4104: Privileged vpndaemon on Linux wrongly and incompletely implements Polkit authentication (Matthias Gerstner <mgerstner@...e.de>)
CVE-2023-38497: Cargo does not respect umask when extracting packages ("Pietro Albini" <pietro@...troalbini.org>)

August 4 (1 message)

CVE-2023-39508: Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges (Jarek Potiuk <potiuk@...che.org>)

August 5 (1 message)

CVE-2023-37581: Apache Roller: XSS vulnerability for site with untrusted users (Dave <snoopdave@...il.com>)

August 7 (1 message)

Foswiki-2.1.8 has been released (Michael Daum <daum@...haeldaumconsulting.com>)

August 8 (8 messages)

Fwd: Node.js security updates for all active release lines, August 2023 (Rafael Silva <rafael.silva@...rform.com>)
Re: Fwd: Node.js security updates for all active release lines, August 2023 (Solar Designer <solar@...nwall.com>)
Xen Security Advisory 432 v2 (CVE-2023-34319) - Linux: buffer overrun in netback due to unusual packet (Xen.org security team <security@....org>)
Xen Security Advisory 434 v1 (CVE-2023-20569) - x86/AMD: Speculative Return Stack Overflow (Xen.org security team <security@....org>)
Xen Security Advisory 435 v1 (CVE-2022-40982) - x86/Intel: Gather Data Sampling (Xen.org security team <security@....org>)
Re: Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed (Solar Designer <solar@...nwall.com>)
Re: Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed (Andrew Cooper <andrew.cooper3@...rix.com>)
Re: Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed (Demi Marie Obenour <demi@...isiblethingslab.com>)

August 9 (1 message)

Node.js security updates for August (Ken Moffat <zarniwhoop@...world.com>)

August 10 (3 messages)

CVE-2023-3772: Linux kernel: xfrm_update_ae_params NULL pointer dereference ("Lin Ma" <linma@....edu.cn>)
Fwd: Node.js security updates for all active release lines, August 2023 (Rafael Silva <rafael.silva@...rform.com>)
Re: CVE-2023-3772: Linux kernel: xfrm_update_ae_params NULL pointer dereference (Seth Arnold <seth.arnold@...onical.com>)

August 11 (1 message)

CVE-2023-39553: Apache Airflow Drill Provider Arbitrary File Read Vulnerability (Elad Kalif <eladkal@...che.org>)

August 15 (1 message)

Podman: API service listening on TCP can be used from websites (Dennis Dast <dennis.dast@...ofnet.de>)

August 16 (5 messages)

Re: CVE-2023-37581: Apache Roller: XSS vulnerability for site with untrusted users (Srivani Reddy <srivani.reddy@...urelayer7.net>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Multiple vulnerabilities in Jenkins plugins (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed (Solar Designer <solar@...nwall.com>)
Re: Xen Security Advisory 433 v3 (CVE-2023-20593) - x86/AMD: Zenbleed (Andrew Cooper <andrew.cooper3@...rix.com>)

August 17 (1 message)

CVE-2023-40272: Apache Airflow Spark Provider Arbitrary File Read via JDBC (Elad Kalif <eladkal@...che.org>)

August 18 (2 messages)

Re: CVE-2023-40272: Apache Airflow Spark Provider Arbitrary File Read via JDBC (Seth Arnold <seth.arnold@...onical.com>)
CVE-2023-40037: Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs (David Handermann <exceptionfactory@...che.org>)

August 20 (1 message)

CVE-2022-46751: Apache Ivy: XML External Entity vulnerability in Apache Ivy (Stefan Bodewig <bodewig@...che.org>)

August 22 (5 messages)

openSUSE-welcome: local privilege escalation when choosing XFCE desktop layout (CVE-2023-32184) (Matthias Gerstner <mgerstner@...e.de>)
[CVE-2022-44729] Apache Batik information disclosure vulnerability ("Simon Steiner" <simonsteiner1984@...il.com>)
[CVE-2022-44730] Apache Batik information disclosure vulnerability ("Simon Steiner" <simonsteiner1984@...il.com>)
Re: [CVE-2022-44729] Apache Batik information disclosure vulnerability (Nbxiglk <fibr3s@...il.com>)
Re: [CVE-2022-44730] Apache Batik information disclosure vulnerability (Moritz Bechler <mbechler@...terphace.org>)

August 23 (6 messages)

CVE-2023-40273: Session fixation in Apache Airflow web interface (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2023-39441: Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components… (Ephraim Anierobi <ephraimanierobi@...ch…)
[kubernetes] CVE-2023-3676: Insufficient input sanitization on Windows nodes leads to privilege escalation (Rita Zhang <rita.z.zhang@...il.com>)
CVE-2023-37379: Apache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" feature (Ephraim Anierobi <ephraimanierobi@...ch…)
[kubernetes] CVE-2023-3955: Insufficient input sanitization on Windows nodes leads to privilege escalation (Rita Zhang <rita.z.zhang@...il.com>)
[kubernetes] CVE-2023-3893: Insufficient input sanitization on kubernetes-csi-proxy leads to privilege escalation (Rita Zhang <rita.z.zhang@...il.com>)

August 25 (4 messages)

Re: Re: [MAINTAINERS SUMMIT] Handling of embargoed security issues -- security@...g vs. linux-distros@ (Donald Buczek <buczek@...gen.mpg.de>)
CVE-2023-27604: Apache Airflow Sqoop Provider: Airflow Sqoop Provider RCE Vulnerability (Elad Kalif <eladkal@...che.org>)
CVE-2023-40195: Apache Airflow Spark Provider Deserialization Vulnerability RCE (Elad Kalif <eladkal@...che.org>)
linux-distros list policy and Linux kernel, again (Solar Designer <solar@...nwall.com>)

August 26 (3 messages)

Re: linux-distros list policy and Linux kernel, again (Seth Arnold <seth.arnold@...onical.com>)
Re: linux-distros list policy and Linux kernel, again (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: linux-distros list policy and Linux kernel, again (Solar Designer <solar@...nwall.com>)

August 27 (5 messages)

Re: linux-distros list policy and Linux kernel, again ("Eduardo' Vela\" <Nava>" <evn@...gle.com>)
Re: Re: Re: [MAINTAINERS SUMMIT] Handling of embargoed security issues -- security@...g vs. linux-distros@ (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: linux-distros list policy and Linux kernel, again (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: linux-distros list policy and Linux kernel, again ("Eduardo' Vela\" <Nava>" <evn@...gle.com>)
Re: linux-distros list policy and Linux kernel, again (Willy Tarreau <w@....eu>)

August 28 (4 messages)

Re: linux-distros list policy and Linux kernel, again (Demi Marie Obenour <demi@...isiblethingslab.com>)
Re: linux-distros list policy and Linux kernel, again (Solar Designer <solar@...nwall.com>)
Re: linux-distros list policy and Linux kernel, again (Jeremy Stanley <fungi@...goth.org>)
Re: linux-distros list policy and Linux kernel, again (Willy Tarreau <w@....eu>)

August 29 (1 message)

Re: Re: [MAINTAINERS SUMMIT] Handling of embargoed security issues -- security@...g vs. linux-distros@ (Miroslav Benes <mbenes@...e.cz>)

August 30 (1 message)

Re: linux-distros list policy and Linux kernel, again (Solar Designer <solar@...nwall.com>)

August 31 (1 message)

[Security Advisory] open-vm-tools: SAML token signature bypass vulnerability (CVE-2023-20900) (VMware Security Response Center <security@...are.com>)

60 messages

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.