CVE Vulnerability Catalog

The faraday-http-cache library stores cached responses in JSON format by default and reads them back using JSON.load, which honors the json_class key and calls json_create on the named class. Response headers are stored verbatim in the cache entry, so a malicious origin server can return a response with a json_class key leading to unsafe deserialization.

A vulnerability has been identified in the Linux kernel related to the asynchronous creation of sub-groups in the PCI context. This could lead to a NULL pointer dereference if the driver directory is removed before the work completes.

A vulnerability has been identified in the Linux kernel related to improper memory deallocation in the uhdlc_memclean() function. The rx_buffer and tx_buffer are allocated as contiguous but freed as two separate buffers, which may lead to memory management issues.

A vulnerability has been identified in the Linux kernel related to ntb_hw_switchtec, which may lead to undefined behavior when the number of MW LUTs is set to zero.

A vulnerability in the Linux kernel has been resolved in the HID: logitech-hidpp module, which could lead to system crashes when a report has no fields.

A vulnerability in the Linux kernel related to handling unsupported hardware configurations in the perf module for ARM CMN architecture has been resolved. Previously, unknown CMN models and their unknown revisions were accepted, which could lead to issues.

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the pwlan variable, which may be NULL when passed to the rtw_free_network_nolock() function, leading to dereferencing of this variable.

A vulnerability in the Linux kernel has been resolved, which occurred in the try_to_free_buffers() function. The issue involved folios without attached buffers, potentially leading to system instability.

A vulnerability has been identified in the Linux kernel regarding missing syscalls in the audit read class. The missing 'at' variants of getxattr() and listxattr() may allow bypassing audit rules when reading file extended attributes.

A vulnerability in the Linux kernel related to interrupt handling in the SPI driver for tegra210-quad has been resolved. The issue was the lack of protection for the NULL check of curr_xfer in the tegra_qspi_isr_thread() function.

A vulnerability has been identified in the Linux kernel related to the fchmodat2() function, which is not included in the audit attribute class. This function, introduced in version 6.6, allows changing file attributes similarly to chmod().

A vulnerability has been identified in the Linux kernel that has been resolved. It concerns the scsi: qla2xxx module, which could cause system crashes during load/unload tests in a loop.

`NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory entry inside `secrets_dir` that is a symbolic link pointing outside `secrets_dir` is followed, allowing access to files outside the configured directory.

An issue was discovered in versions 6.0 before 6.0.5 and 5.2 before 5.2.14 in `django.middleware.cache.UpdateCacheMiddleware`, which erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served.

A vulnerability in PCRE before version 8.43 allows a subject buffer over-read in JIT when UTF is disabled and \X or \R has more than one fixed quantifier, related to CVE-2019-20454.

An issue was discovered in versions 6.0 before 6.0.5 and 5.2 before 5.2.14 related to ASGI requests that can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit when the `Content-Length` header is missing or understated. This may lead to large files being loaded into memory, causing service degradation.

A denial-of-service vulnerability exists in Engine.IO / Socket.IO servers that allow transport upgrades. The Engine.IO protocol revision is negotiated during the initial handshake and stored on the session, but a newly-created transport, including a WebSocket upgrade transport, could be exploited to overload the server.

Granian is a Rust HTTP server for Python applications. From versions 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value.

An issue was discovered in versions 6.0 before 6.0.5 and 5.2 before 5.2.14 regarding response headers that do not vary on cookies if a session is not modified, while `SESSION_SAVE_EVERY_REQUEST` is set to `True`. A remote attacker can steal a user's session after that user visits a cached public page.

Vulnerability in the PDO PostgreSQL driver for PHP causes an invalid character sequence (e.g., \x99) in a prepared statement parameter to lead to quoting errors when PDO::ATTR_EMULATE_PREPARES is enabled. Affects PHP versions 8.1.x before 8.1.34, 8.2.x before 8.2.30, 8.3.x before 8.3.29, 8.4.x before 8.4.16, and 8.5.x before 8.5.1.