2019-10-02
ALT-BU-2019-3987-1
Branch sisyphus update bulletin.
Package clickhouse updated to version 19.13.5.44-alt1 for branch sisyphus in task 238181.
Closed vulnerabilities
Published: 2019-10-31
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2019-18657
ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.
Severity: MEDIUM (5.3)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References:
- https://github.com/ClickHouse/ClickHouse/blob/master/CHANGELOG.md
- https://github.com/ClickHouse/ClickHouse/blob/master/CHANGELOG.md
- https://github.com/ClickHouse/ClickHouse/pull/6466
- https://github.com/ClickHouse/ClickHouse/pull/6466
- https://github.com/ClickHouse/ClickHouse/pull/7526/files
- https://github.com/ClickHouse/ClickHouse/pull/7526/files
Package kernel-image-un-def updated to version 5.2.18-alt1 for branch sisyphus in task 238458.
Closed vulnerabilities
Published: 2019-07-25
BDU:2020-05553
Уязвимость функции show_numa_stats() системы NUMA ядра операционных систем Linux, позволяющая нарушителю вызвать отказ в обслуживании
Severity: MEDIUM (5.3)
Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
References:
Published: 2020-11-28
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2019-20934
An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c.
Severity: MEDIUM (5.3)
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
References:
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1913
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1913
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.6
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.6
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16d51a590a8ce3befb1308e0e7ab77f3b661af33
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16d51a590a8ce3befb1308e0e7ab77f3b661af33