Skip to content
OpenAdvisories
High WID-SEC-2022-0456 7 CVEs

tribe29 checkmk: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Jun 23, 2022 · Updated Dec 7, 2022 · Revision 6 · de-DE

Vendor: Red Hat Vendor: SUSE Vendor: Tribe29 Vendor: Ubuntu Product: Checkmk Product: checkmk < 2.0.0p27 Product: checkmk < 2.1.0p4 Product: checkmk < 2.2.0i1 Product: Enterprise Linux Product: Linux Product: Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in tribe29 checkmk ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Checkmk ist eine IT-Monitoring-Software.

Vulnerabilities 7

  • High 7.5
    CVE-2020-25658

    Timing attacks in python-rsa

    It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.

    Sybren A. Stüvel python-rsa rsa python-rsa Debian Ubuntu PyPI
  • High 7.5
    CVE-2021-41495

    NumPy NULL Pointer Dereference

    Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct …

    numpy numpy numpy numpy Debian Ubuntu Azure Linux PyPI
  • High 7.5
    CVE-2022-30595

    Buffer over-flow in Pillow

    libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.

    pillow pillow py3-pillow Debian Alpine PyPI
  • High 7.4
    CVE-2022-29217

    Key confusion through non-blocklisted public key formats in PyJWT

    PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT library requires that the application chooses what algorith…

    jpadilla pyjwt pyjwt pyjwt Debian Ubuntu Azure Linux Alpine PyPI
  • Medium 5.5
    CVE-2021-41496

    Buffer Copy without Checking Size of Input in NumPy

    Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability…

    numpy numpy numpy numpy Debian Ubuntu Azure Linux PyPI
  • Medium 5.3
    CVE-2021-34141

    Incorrect Comparison in NumPy

    An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless…

    numpy numpy numpy Debian Ubuntu PyPI
  • Unscored —
    CVE-2022-29361 Public exploit

    Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggli…

    werkzeug py3-werkzeug Alpine PyPI

Revision history

  1. #6

    Neue Updates von Red Hat aufgenommen

  2. #5

    Neue Updates von SUSE aufgenommen

  3. #4

    Neue Updates von Ubuntu aufgenommen

  4. #3

    Neue Updates von Ubuntu aufgenommen

  5. #2

    CHECKMK Referenz aufgenommen

  6. #1

    Initiale Fassung

References