Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: Restrict conditions for adding duplicating netems to qdisc tree<br /> <br /> netem_enqueue&amp;#39;s duplication prevention logic breaks when a netem<br /> resides in a qdisc tree with other netems - this can lead to a<br /> soft lockup and OOM loop in netem_dequeue, as seen in [1].<br /> Ensure that a duplicating netem cannot exist in a tree with other<br /> netems.<br /> <br /> Previous approaches suggested in discussions in chronological order:<br /> <br /> 1) Track duplication status or ttl in the sk_buff struct. Considered<br /> too specific a use case to extend such a struct, though this would<br /> be a resilient fix and address other previous and potential future<br /> DOS bugs like the one described in loopy fun [2].<br /> <br /> 2) Restrict netem_enqueue recursion depth like in act_mirred with a<br /> per cpu variable. However, netem_dequeue can call enqueue on its<br /> child, and the depth restriction could be bypassed if the child is a<br /> netem.<br /> <br /> 3) Use the same approach as in 2, but add metadata in netem_skb_cb<br /> to handle the netem_dequeue case and track a packet&amp;#39;s involvement<br /> in duplication. This is an overly complex approach, and Jamal<br /> notes that the skb cb can be overwritten to circumvent this<br /> safeguard.<br /> <br /> 4) Prevent the addition of a netem to a qdisc tree if its ancestral<br /> path contains a netem. However, filters and actions can cause a<br /> packet to change paths when re-enqueued to the root from netem<br /> duplication, leading us to the current solution: prevent a<br /> duplicating netem from inhabiting the same tree as other netems.<br /> <br /> [1] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/<br /> [2] https://lwn.net/Articles/719297/

The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the _process_mla_download_file function in all versions up to, and including, 3.27. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server from the /wp-content/uploads/ directory.

An insufficient access control vulnerability was found in the Red Hat<br /> Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Developer Hub cluster admin/user, who has standard user access to the cluster, and the Red Hat Developer Hub namespace, can access the<br /> rhdh/rhdh-hub-rhel9 container image and modify the image&amp;#39;s content. This issue affects the confidentiality and integrity of the data, and any changes made are not permanent, as they reset after the pod restarts.

The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via DOM elements in all versions up to, and including, 6.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Rejected reason: Not used

Rejected reason: Not used

Rejected reason: Not used

Rejected reason: Not used

Rejected reason: Not used

Rejected reason: Not used

Rejected reason: Not used

Rejected reason: Not used