Log

AVG-1991 edited at 09 Jun 2021 10:32:25
Status
- Vulnerable
+ Fixed
Fixed
+ 4.0.2312.24-1
References
- https://vivaldi.com/blog/desktop/minor-update-2-for-vivaldi-desktop-browser-3-8/
- https://vivaldi.com/blog/mobile/android-3-9-2307-3/
Notes
- Vivaldi version 3.8.2259.42 is based on Chromium version 90.0.4430.214, Vivaldi version 4.0.2312.24 is based on Chromium version 91.0.4472.79 according to the references.
+ Vivaldi version 3.8.2259.42 is based on Chromium version 90.0.4430.214, Vivaldi version 4.0.2312.24 is based on Chromium version 91.0.4472.79.
AVG-2039 edited at 09 Jun 2021 09:24:15
Affected
- 3.1.0-1
+ 3.1.1-1
AVG-1906 edited at 09 Jun 2021 09:21:46
Affected
- 9.2.17.0-1
+ 9.2.18.0-1
Notes
- RDoc version 6.1.2 is bundled in JRuby version 9.2.17.0.
+ RDoc version 6.1.2 is bundled in JRuby version 9.2.18.0.
ASA-202106-30 edited at 09 Jun 2021 08:54:40
Impact
- A remote attacker could crash Wireshark with crafted DVB-S2 packets via packet injection or a crafted capture
+ A remote attacker could crash Wireshark with crafted DVB-S2 packets via packet injection or a crafted capture file.
- file.
ASA-202106-29 edited at 09 Jun 2021 08:54:21
Impact
- A user could redirect pod traffic to private networks on a Node.
+ A user could redirect pod traffic to private networks on a node.
CVE-2021-25737 edited at 09 Jun 2021 08:53:59
Description
- A security issue was discovered in kube-apiserver before version 1.21.1 where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
+ A security issue was discovered in kube-apiserver before version 1.21.1 where a user may be able to redirect pod traffic to private networks on a node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
CVE-2021-33880 edited at 09 Jun 2021 08:53:14
Description
- The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
+ The aaugustin websockets library before 9.1 for Python has an observable timing discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
ASA-202106-30 edited at 09 Jun 2021 08:50:58
Impact
+ A remote attacker could crash Wireshark with crafted DVB-S2 packets via packet injection or a crafted capture
+ file.
ASA-202106-30 created at 09 Jun 2021 08:49:15
ASA-202106-29 edited at 09 Jun 2021 08:49:07
Workaround
+ To mitigate this vulnerability without upgrading kube-apiserver, you can create a validating admission webhook that prevents EndpointSlices with endpoint addresses in the 127.0.0.0/8 and 169.254.0.0/16 ranges. If you have an existing admission policy mechanism (like OPA Gatekeeper) you can create a policy that enforces this restriction.
Impact
+ A user could redirect pod traffic to private networks on a Node.