⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Automatically generated suggestions

Create Draft to queue a suggestion for refinement.

Dismiss to remove a suggestion from the queue.

CVE-2024-6505
6.8 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 9 hours ago
Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.

qemu
<9.1.0
qemu-kvm
qemu-kvm-ma
virt:av/qemu-kvm
virt:rhel/qemu-kvm

pkgs.qemu_xen

Generic and open source machine emulator and virtualizer

pkgs.qemu-user

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu_xen_4_15

A generic and open source machine emulator and virtualizer

pkgs.ubootQemuX86_64

Boot loader for embedded systems

pkgs.qemu.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu.aarch64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu.x86_64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu.aarch64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_xen_4_15-light

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_xen.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.python313Packages.qemu

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.qemu-user.x86_64-linux

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu_full.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.aarch64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.x86_64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_test.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu-user.aarch64-linux

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu-utils.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_full.aarch64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_full.x86_64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.aarch64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_test.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_test.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu-utils.aarch64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu-utils.x86_64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_full.aarch64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_test.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu-utils.aarch64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_xen_4_15.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_xen_4_15-light.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.armTrustedFirmwareQemu.aarch64-linux

A reference implementation of secure world software for ARMv8-A
Notify package maintainers: 13
CVE-2025-2559
4.9 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 9 hours ago
Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak

A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system.

keycloak
<26.1.5
<26.0.11
keycloak-services
rhbk/keycloak-rhel9
*
keycloak-rhel9-container
*
rhbk/keycloak-rhel9-operator
*
rhbk/keycloak-operator-bundle
*
keycloak-rhel9-operator-container
*
keycloak-rhel9-operator-bundle-container
*

pkgs.keycloak.x86_64-linux

Identity and access management for modern applications and services

pkgs.keycloak.aarch64-linux

Identity and access management for modern applications and services

pkgs.python313Packages.python-keycloak

Provides access to the Keycloak API

pkgs.python311Packages.python-keycloak.x86_64-linux

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.x86_64-linux

Provides access to the Keycloak API

pkgs.python311Packages.python-keycloak.aarch64-linux

Provides access to the Keycloak API

pkgs.python311Packages.python-keycloak.x86_64-darwin

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.aarch64-linux

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.x86_64-darwin

Provides access to the Keycloak API

pkgs.python311Packages.python-keycloak.aarch64-darwin

Provides access to the Keycloak API

pkgs.python312Packages.python-keycloak.aarch64-darwin

Provides access to the Keycloak API
Notify package maintainers: 3
CVE-2024-7383
7.4 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): NONE
created 9 hours ago
Libnbd: nbd server improper certificate validation

A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic.

libnbd
*
<1.20.2
<1.18.5
virt:rhel
*
virt:av/libnbd
virt-devel:rhel
*
virt:rhel/libnbd

pkgs.libnbd.x86_64-linux

Network Block Device client library in userspace

pkgs.libnbd.aarch64-linux

Network Block Device client library in userspace

pkgs.python311Packages.libnbd

Network Block Device client library in userspace

pkgs.python313Packages.libnbd

Network Block Device client library in userspace

pkgs.python312Packages.libnbd.x86_64-linux

Network Block Device client library in userspace

pkgs.python311Packages.libnbd.aarch64-linux

Network Block Device client library in userspace

pkgs.python312Packages.libnbd.aarch64-linux

Network Block Device client library in userspace
Notify package maintainers: 2
CVE-2024-8235
6.2 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 9 hours ago
Libvirt: crash of virtinterfaced via virconnectlistinterfaces()

A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced. This issue could allow clients connecting to the read-only socket to crash the virtinterfaced daemon.

libvirt
*
<10.7.0
virt:av/libvirt
virt:rhel/libvirt

pkgs.libvirt.x86_64-linux

A toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes

pkgs.libvirt.aarch64-linux

A toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes

pkgs.libvirt.x86_64-darwin

A toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes

pkgs.libvirt.aarch64-darwin

A toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes

pkgs.libvirt-glib.x86_64-linux

Library for working with virtual machines

pkgs.python313Packages.libvirt

libvirt Python bindings

pkgs.rubyPackages.ruby-libvirt

pkgs.libvirt-glib.aarch64-linux

Library for working with virtual machines

pkgs.libvirt-glib.x86_64-darwin

Library for working with virtual machines

pkgs.libvirt-glib.aarch64-darwin

Library for working with virtual machines

pkgs.prometheus-libvirt-exporter

Prometheus metrics exporter for libvirt

pkgs.prometheus-libvirt-exporter.x86_64-linux

Prometheus metrics exporter for libvirt

pkgs.prometheus-libvirt-exporter.aarch64-linux

Prometheus metrics exporter for libvirt

pkgs.prometheus-libvirt-exporter.x86_64-darwin

Prometheus metrics exporter for libvirt

pkgs.prometheus-libvirt-exporter.aarch64-darwin

Prometheus metrics exporter for libvirt

pkgs.rubyPackages_3_4.ruby-libvirt.x86_64-linux

pkgs.rubyPackages_3_4.ruby-libvirt.aarch64-linux

pkgs.rubyPackages_3_4.ruby-libvirt.x86_64-darwin

pkgs.rubyPackages_3_4.ruby-libvirt.aarch64-darwin

Notify package maintainers: 4
CVE-2025-4969
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
created 9 hours ago
Libsoup: off-by-one out-of-bounds read in find_boundary() in soup-multipart.c

A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries (out-of-bounds read).

libsoup

pkgs.libsoup_2_4

HTTP client/server library for GNOME

pkgs.gnome.libsoup

HTTP client/server library for GNOME

pkgs.libsoup.x86_64-linux

HTTP client/server library for GNOME

pkgs.libsoup.aarch64-linux

HTTP client/server library for GNOME

pkgs.libsoup.x86_64-darwin

HTTP client/server library for GNOME

pkgs.libsoup.aarch64-darwin

HTTP client/server library for GNOME

pkgs.libsoup_3.x86_64-linux

HTTP client/server library for GNOME

pkgs.libsoup_3.aarch64-linux

HTTP client/server library for GNOME

pkgs.libsoup_3.x86_64-darwin

HTTP client/server library for GNOME

pkgs.libsoup_2_4.x86_64-linux

HTTP client/server library for GNOME

pkgs.libsoup_3.aarch64-darwin

HTTP client/server library for GNOME

pkgs.libsoup_2_4.aarch64-linux

HTTP client/server library for GNOME

pkgs.libsoup_2_4.x86_64-darwin

HTTP client/server library for GNOME

pkgs.libsoup_2_4.aarch64-darwin

HTTP client/server library for GNOME

pkgs.gnome2.libsoup.x86_64-linux

HTTP client/server library for GNOME

pkgs.gnome2.libsoup.aarch64-linux

HTTP client/server library for GNOME

pkgs.gnome2.libsoup.x86_64-darwin

HTTP client/server library for GNOME

pkgs.gnome2.libsoup.aarch64-darwin

HTTP client/server library for GNOME

pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4"

Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4

pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4".x86_64-linux

Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4

pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4".aarch64-linux

Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4

pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4".x86_64-darwin

Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4

pkgs.tests.pkg-config.defaultPkgConfigPackages."libsoup-gnome-2.4".aarch64-darwin

Test whether libsoup-2.74.3 exposes pkg-config modules libsoup-gnome-2.4
Notify package maintainers: 6
CVE-2024-8354
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 9 hours ago
Qemu-kvm: usb: assertion failure in usb_ep_get()

A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.

qemu
qemu-kvm
qemu-kvm-ma
virt:av/qemu-kvm
virt:rhel/qemu-kvm

pkgs.qemu_xen

Generic and open source machine emulator and virtualizer

pkgs.qemu-user

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu_xen_4_15

A generic and open source machine emulator and virtualizer

pkgs.ubootQemuX86_64

Boot loader for embedded systems

pkgs.qemu.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu.aarch64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu.x86_64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu.aarch64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_xen_4_15-light

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_xen.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.python313Packages.qemu

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.qemu-user.x86_64-linux

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu_full.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.aarch64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.x86_64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_test.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu-user.aarch64-linux

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu-utils.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_full.aarch64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_full.x86_64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.aarch64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_test.aarch64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_test.x86_64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu-utils.aarch64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu-utils.x86_64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_full.aarch64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_test.aarch64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu-utils.aarch64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_xen_4_15.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_xen_4_15-light.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.armTrustedFirmwareQemu.aarch64-linux

A reference implementation of secure world software for ARMv8-A
Notify package maintainers: 13
CVE-2024-7409 created 9 hours ago
Qemu: denial of service via improper synchronization in qemu nbd server during socket closure

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.

qemu
==7.2.0
==9.0.0
==8.2.0
rhcos
*
qemu-kvm
*
virt:rhel
*
qemu-kvm-ma
virt-devel:rhel
*
virt:av/qemu-kvm
virt:8.2/qemu-kvm
virt:rhel/qemu-kvm
virt-devel:av/qemu-kvm
virt-devel:8.2/qemu-kvm
virt-devel:rhel/qemu-kvm

pkgs.qemu_xen

Generic and open source machine emulator and virtualizer

pkgs.qemu-user

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu_xen_4_15

A generic and open source machine emulator and virtualizer

pkgs.ubootQemuX86_64

Boot loader for embedded systems

pkgs.qemu.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_xen_4_15-light

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_xen.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.python313Packages.qemu

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.qemu-user.x86_64-linux

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu_full.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.aarch64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.x86_64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_test.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu-user.aarch64-linux

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu-utils.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_full.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_full.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.aarch64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_test.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_test.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu-utils.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu-utils.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_full.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_test.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu-utils.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_xen_4_15.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_xen_4_15-light.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.armTrustedFirmwareQemu.aarch64-linux

A reference implementation of secure world software for ARMv8-A
Notify package maintainers: 13
CVE-2024-4467
7.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 9 hours ago
Qemu-kvm: 'qemu-img info' leads to host file read/write

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.

qemu
<9.1.0
virt:av
*
qemu-kvm
*
virt:8.2
*
virt:rhel
*
qemu-kvm-ma
virt-devel:av
*
virt-devel:rhel
*
virt:av/qemu-kvm
virt:rhel/qemu-kvm
container-native-virtualization/virt-cdi-operator-rhel9

pkgs.qemu_xen

Generic and open source machine emulator and virtualizer

pkgs.qemu-user

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu_xen_4_15

A generic and open source machine emulator and virtualizer

pkgs.ubootQemuX86_64

Boot loader for embedded systems

pkgs.qemu.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_xen_4_15-light

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_xen.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.python313Packages.qemu

Python tooling used by the QEMU project to build, configure, and test QEMU

pkgs.qemu-user.x86_64-linux

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu_full.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.aarch64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.x86_64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_test.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu-user.aarch64-linux

QEMU User space emulator - launch executables compiled for one CPU on another CPU

pkgs.qemu-utils.x86_64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_full.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu_full.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_kvm.aarch64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu_test.aarch64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_test.x86_64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu-utils.aarch64-linux

Generic and open source machine emulator and virtualizer

pkgs.qemu-utils.x86_64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_full.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_test.aarch64-darwin

A generic and open source machine emulator and virtualizer

pkgs.qemu-utils.aarch64-darwin

Generic and open source machine emulator and virtualizer

pkgs.qemu_xen_4_15.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.qemu_xen_4_15-light.x86_64-linux

A generic and open source machine emulator and virtualizer

pkgs.armTrustedFirmwareQemu.aarch64-linux

A reference implementation of secure world software for ARMv8-A
Notify package maintainers: 13
CVE-2024-28834
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 9 hours ago
Gnutls: vulnerable to minerva side-channel information leak

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

gnutls
*
==3.7.6-23

pkgs.gnutls.aarch64-linux

GNU Transport Layer Security Library

pkgs.gnutls.x86_64-darwin

GNU Transport Layer Security Library

pkgs.gnutls.aarch64-darwin

GNU Transport Layer Security Library

pkgs.guile-gnutls.x86_64-linux

Guile bindings for GnuTLS library

pkgs.guile-gnutls.aarch64-linux

Guile bindings for GnuTLS library

pkgs.guile-gnutls.x86_64-darwin

Guile bindings for GnuTLS library

pkgs.guile-gnutls.aarch64-darwin

Guile bindings for GnuTLS library

pkgs.python313Packages.python3-gnutls

Python wrapper for the GnuTLS library
Notify package maintainers: 3
CVE-2024-28835
5.0 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 9 hours ago
Gnutls: potential crash during chain building/verification

A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.

gnutls
*
==3.8.3

pkgs.gnutls.aarch64-linux

GNU Transport Layer Security Library

pkgs.gnutls.x86_64-darwin

GNU Transport Layer Security Library

pkgs.gnutls.aarch64-darwin

GNU Transport Layer Security Library

pkgs.guile-gnutls.x86_64-linux

Guile bindings for GnuTLS library

pkgs.guile-gnutls.aarch64-linux

Guile bindings for GnuTLS library

pkgs.guile-gnutls.x86_64-darwin

Guile bindings for GnuTLS library

pkgs.guile-gnutls.aarch64-darwin

Guile bindings for GnuTLS library

pkgs.python313Packages.python3-gnutls

Python wrapper for the GnuTLS library
Notify package maintainers: 3