9-20-24 cve updates #4026

frederickjoi · 2024-09-20T13:50:42Z

Describe the Change

updated official summaries

This PR ....

Changed Pages

💻 Add Preview URL for Page

Jira Tickets

🎫 Jira Ticket

Backports

Can this PR be backported?

Yes. Remember to add the relevant backport labels to your PR.
No. Please leave a short comment below about why this PR cannot be backported.

docs/docs-content/security-bulletins/reports/cve-2022-28948.md

github-actions · 2024-09-20T13:51:40Z

docs/docs-content/security-bulletins/reports/cve-2022-28948.md

@@ -23,7 +23,7 @@ input.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+A flaw was found in the Unmarshal function in Go-Yaml. This vulnerability results in program crashes when attempting to convert (or deserialize) invalid input data, potentially impacting system stability and reliability. 3rd party images affected will be upgraded to remove the vulnerability.


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'deserialize'?

github-actions · 2024-09-20T13:51:40Z

docs/docs-content/security-bulletins/reports/cve-2022-28948.md

@@ -23,7 +23,7 @@ input.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+A flaw was found in the Unmarshal function in Go-Yaml. This vulnerability results in program crashes when attempting to convert (or deserialize) invalid input data, potentially impacting system stability and reliability. 3rd party images affected will be upgraded to remove the vulnerability.


🚫 [vale] _{reported by reviewdog 🐶}
[Google.Ordinal] Spell out all ordinal numbers ('3rd') in text.

github-actions · 2024-09-20T13:51:40Z

docs/docs-content/security-bulletins/reports/cve-2023-52356.md

@@ -14,7 +14,7 @@ tags: ["security", "cve"]

 ## Last Update

-09/15/2024
+09/20/2024


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/20/2024'.

github-actions · 2024-09-20T13:51:41Z

docs/docs-content/security-bulletins/reports/cve-2023-52356.md

@@ -24,7 +24,8 @@ service.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+This is a vulnerability in libtiff that can be exploited by a remote attacker to cause a heap-buffer overflow and denial-of-service. The vulnerability is caused by a segment


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'libtiff'?

github-actions · 2024-09-20T13:51:41Z

docs/docs-content/security-bulletins/reports/cve-2023-52356.md

@@ -24,7 +24,8 @@ service.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+This is a vulnerability in libtiff that can be exploited by a remote attacker to cause a heap-buffer overflow and denial-of-service. The vulnerability is caused by a segment
+fault (SEGV) flaw that can be triggered when a crafted TIFF file is passed to the TIFFReadRGBATileExt() API. Investigating a possible fix for this vulnerability on the affected images.


🚫 [vale] _{reported by reviewdog 🐶}
[spectrocloud-docs-internal.acronym] Use title case to define the acronym '(SEGV)'.

github-actions · 2024-09-20T13:51:41Z

docs/docs-content/security-bulletins/reports/cve-2023-24534.md

@@ -14,7 +14,7 @@ tags: ["security", "cve"]

 ## Last Update

-09/15/2024
+09/20/2024


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/20/2024'.

github-actions · 2024-09-20T13:51:41Z

docs/docs-content/security-bulletins/reports/cve-2023-24534.md

@@ -27,7 +27,9 @@ parsed headers.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+This CVE involves excessive memory allocation in net/http and net/textproto, potentially leading to a denial-of-service due to large memory allocation while parsing HTTP and MIME


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'HTTP' instead of 'http'.

github-actions · 2024-09-20T13:51:41Z

docs/docs-content/security-bulletins/reports/cve-2023-24534.md

-Investigation is ongoing to determine how this vulnerability affects our products.
+This CVE involves excessive memory allocation in net/http and net/textproto, potentially leading to a denial-of-service due to large memory allocation while parsing HTTP and MIME
+headers even for small inputs. Attackers can exploit this vulnerability to exhaust an HTTP server's memory resources, causing a denial of service. By crafting specific input data
+patterns, an attacker can trigger the excessive memory allocation behavior in the HTTP and MIME header parsing functions, leading to memory exhaustion. The risk of this vulnerability exploited in Spectro Cloud products is very low. 3rd party images affected will be upgraded to remove the vulnerability.


🚫 [vale] _{reported by reviewdog 🐶}
[Google.Ordinal] Spell out all ordinal numbers ('3rd') in text.

netlify · 2024-09-20T13:52:44Z

✅ Deploy Preview for docs-spectrocloud ready!

Name	Link
🔨 Latest commit	`c0b7f11`
🔍 Latest deploy log	https://app.netlify.com/sites/docs-spectrocloud/deploys/66ed7e5574a4710008ee35a4
😎 Deploy Preview	https://deploy-preview-4026--docs-spectrocloud.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

github-actions · 2024-09-20T13:54:11Z

docs/docs-content/security-bulletins/reports/cve-2022-28948.md

@@ -23,7 +23,9 @@ input.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+A flaw was found in the Unmarshal function in Go-Yaml. This vulnerability results in program crashes when attempting to


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'Unmarshal'?

github-actions · 2024-09-20T13:54:11Z

docs/docs-content/security-bulletins/reports/cve-2022-28948.md

@@ -23,7 +23,9 @@ input.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+A flaw was found in the Unmarshal function in Go-Yaml. This vulnerability results in program crashes when attempting to
+convert (or deserialize) invalid input data, potentially impacting system stability and reliability. 3rd party images


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'deserialize'?

github-actions · 2024-09-20T13:54:11Z

docs/docs-content/security-bulletins/reports/cve-2022-28948.md

@@ -23,7 +23,9 @@ input.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+A flaw was found in the Unmarshal function in Go-Yaml. This vulnerability results in program crashes when attempting to
+convert (or deserialize) invalid input data, potentially impacting system stability and reliability. 3rd party images


🚫 [vale] _{reported by reviewdog 🐶}
[Google.Ordinal] Spell out all ordinal numbers ('3rd') in text.

github-actions · 2024-09-20T13:54:12Z

docs/docs-content/security-bulletins/reports/cve-2023-52356.md

@@ -24,7 +24,10 @@ service.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+This is a vulnerability in libtiff that can be exploited by a remote attacker to cause a heap-buffer overflow and


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'libtiff'?

github-actions · 2024-09-20T13:54:12Z

docs/docs-content/security-bulletins/reports/cve-2023-52356.md

@@ -24,7 +24,10 @@ service.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+This is a vulnerability in libtiff that can be exploited by a remote attacker to cause a heap-buffer overflow and
+denial-of-service. The vulnerability is caused by a segment fault (SEGV) flaw that can be triggered when a crafted TIFF


🚫 [vale] _{reported by reviewdog 🐶}
[spectrocloud-docs-internal.acronym] Use title case to define the acronym '(SEGV)'.

github-actions · 2024-09-20T13:54:12Z

docs/docs-content/security-bulletins/reports/cve-2023-24534.md

@@ -27,7 +27,12 @@ parsed headers.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+This CVE involves excessive memory allocation in net/http and net/textproto, potentially leading to a denial-of-service


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'HTTP' instead of 'http'.

github-actions · 2024-09-20T13:54:12Z

docs/docs-content/security-bulletins/reports/cve-2023-24534.md

+vulnerability to exhaust an HTTP server's memory resources, causing a denial of service. By crafting specific input data
+patterns, an attacker can trigger the excessive memory allocation behavior in the HTTP and MIME header parsing
+functions, leading to memory exhaustion. The risk of this vulnerability exploited in Spectro Cloud products is very low.
+3rd party images affected will be upgraded to remove the vulnerability.


🚫 [vale] _{reported by reviewdog 🐶}
[Google.Ordinal] Spell out all ordinal numbers ('3rd') in text.

* 9-20-24 cve updates * ci: auto-formatting prettier issues --------- Co-authored-by: frederickjoi <[email protected]> (cherry picked from commit 2d9cfa7)

vault-token-factory-spectrocloud · 2024-09-20T15:17:49Z

💚 All backports created successfully

Status	Branch	Result
✅	version-4-4

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details

* 9-20-24 cve updates * ci: auto-formatting prettier issues --------- Co-authored-by: frederickjoi <[email protected]> (cherry picked from commit 2d9cfa7) Co-authored-by: frederickjoi <[email protected]>

vault-token-factory-spectrocloud · 2024-10-13T16:09:45Z

🎉 This issue has been resolved in version 4.5.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

9-20-24 cve updates

c1cbc23

frederickjoi requested a review from a team as a code owner September 20, 2024 13:50

frederickjoi requested review from karl-cardenas-coding, addetz and caroldelwing September 20, 2024 13:50

github-actions bot reviewed Sep 20, 2024

View reviewed changes

ci: auto-formatting prettier issues

c0b7f11

github-actions bot reviewed Sep 20, 2024

View reviewed changes

karl-cardenas-coding approved these changes Sep 20, 2024

View reviewed changes

karl-cardenas-coding added auto-backport Enable backport backport-version-4-4 Backport change to version 4.4 labels Sep 20, 2024

karl-cardenas-coding merged commit 2d9cfa7 into master Sep 20, 2024
24 checks passed

karl-cardenas-coding deleted the 9-20-24-cve-updates branch September 20, 2024 15:17

vault-token-factory-spectrocloud bot mentioned this pull request Sep 20, 2024

[version-4-4] docs: 9-20-24 cve updates (#4026) #4027

Merged

vault-token-factory-spectrocloud bot added the released label Oct 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

9-20-24 cve updates #4026

9-20-24 cve updates #4026

frederickjoi commented Sep 20, 2024

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

netlify bot commented Sep 20, 2024 •

edited

Loading

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

github-actions bot Sep 20, 2024

vault-token-factory-spectrocloud bot commented Sep 20, 2024

vault-token-factory-spectrocloud bot commented Oct 13, 2024

9-20-24 cve updates #4026

9-20-24 cve updates #4026

Conversation

frederickjoi commented Sep 20, 2024

Describe the Change

Changed Pages

Jira Tickets

Backports

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

netlify bot commented Sep 20, 2024 • edited Loading

✅ Deploy Preview for docs-spectrocloud ready!

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

github-actions bot Sep 20, 2024

Choose a reason for hiding this comment

vault-token-factory-spectrocloud bot commented Sep 20, 2024

💚 All backports created successfully

Questions ?

vault-token-factory-spectrocloud bot commented Oct 13, 2024

netlify bot commented Sep 20, 2024 •

edited

Loading