Aggregator

rabbitmq-server-4.0.9-7.fc43

Fedora Security Advisories
1 week 1 day ago
FEDORA-2026-ea1afc0a7b Packages in this update:
  • rabbitmq-server-4.0.9-7.fc43
Update description:

Security update: backport upstream RabbitMQ security fixes to 4.0.9.

Management UI and HTTP API: - CVE-2026-67421: HTML injection on the OAuth 2 login page via an attacker-controlled queue name; the error reason is now escaped and the default CSP gains base-uri 'none'. - CVE-2026-67239: stored XSS via TLS peer certificate fields in the stream connection page. - CVE-2026-66073, CVE-2026-67226, CVE-2026-67227: atom table exhaustion via the "node" field, the user tags list and global parameter names. - CVE-2026-61837: the AMQP 1.0 management GET /bindings endpoint now checks permissions like the other binding operations.

Authentication and authorisation: - CVE-2026-67223: LDAP user DN templates now RFC 4514-escape the username. - CVE-2026-44838, CVE-2026-67407: regex metacharacters (including "-") in topic permission variables are now escaped. - CVE-2026-67411: MQTT and Web MQTT behind a PROXY protocol frontend now check loopback_users against the real client address. - CVE-2026-67412: Federation upstream URIs now require access to the target virtual host. - CVE-2026-66071: OAuth 2 tag scopes no longer create new atoms. - CVE-2026-67222: AMQP URI auth_mechanism values are limited to known mechanisms and no longer create atoms.

Denial of service: - CVE-2026-67413: JMS topic exchange LIKE selectors run with regex match limits. - CVE-2026-67230: Web STOMP enforces the login timeout and a frame size limit before authentication. - CVE-2026-67225: the stream protocol rejects frames larger than the negotiated frame_max.

This update also includes the fixes from 4.0.9-6 (CVE-2026-67409, CVE-2026-67416, CVE-2026-67418, CVE-2026-67420).

Security update: backport upstream RabbitMQ security fixes to 4.0.9.

  • CVE-2026-67409: JWKS signing keys are now only replaced from a successful (HTTP 200), well-formed response, so an error reply from the OAuth 2 provider can no longer wipe the cached keys and deny all OAuth 2 logins.
  • CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
  • CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.
  • CVE-2026-67420: user tags are rebuilt on OAuth 2 credential refresh, so a revoked impersonator tag no longer survives on an existing connection.

rabbitmq-server-4.2.9-5.fc44

Fedora Security Advisories
1 week 1 day ago
FEDORA-2026-296b2865ba Packages in this update:
  • rabbitmq-server-4.2.9-5.fc44
Update description:

Fix for CVE-2026-67421

Security update: backport upstream RabbitMQ security fixes to 4.2.9.

  • CVE-2026-67414: an authenticated AMQP 1.0 client could exhaust broker memory with arrays of zero-width elements; such arrays are now kept as opaque values.
  • CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
  • CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.

Also includes the CVE-2026-67420 fix from 4.2.9-3 (stale impersonator tag kept after OAuth token refresh). CVE-2026-67409 and CVE-2026-67410 are fixed upstream in 4.2.9.

Fix for CVE-2026-67420 (RabbitMQ: unauthorized user impersonation via stale OAuth token refresh). On a JWT/OAuth token refresh, rabbit_access_control:update_state/2 discarded the refreshed user tags, so a revoked 'impersonator' tag could survive on an existing connection. Backported from upstream v4.3.x (commit 5de287d).

USN-9000-1: Twisted vulnerability

Ubuntu Security Advisories
1 week 1 day ago
It was discovered that Twisted's IMAP server mishandled wildcard patterns in mailbox list commands. An authenticated remote attacker could possibly use this issue to cause Twisted to use excessive resources, leading to a denial of service.

USN-8999-1: Pillow vulnerabilities

Ubuntu Security Advisories
1 week 1 day ago
It was discovered that Pillow incorrectly handled map stride values when loading certain McIdas AREA images. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-54058) It was discovered that Pillow did not properly check for decompression bombs when processing font files. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-54059, CVE-2026-54060, CVE-2026-55379) It was discovered that Pillow did not properly check for decompression bombs when loading GD image files. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-55380) It was discovered that Pillow incorrectly validated filter sizes in the rank filter implementation. An attacker could possibly use this issue to cause Pillow to crash or execute arbitrary code. (CVE-2026-59197) It was discovered that Pillow incorrectly handled image coordinate calculations. An attacker could possibly use this issue to cause Pillow to crash. (CVE-2026-59199) It was discovered that Pillow did not properly limit the size of decompressed PDF stream data. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-59200) It was discovered that Pillow incorrectly parsed EPS files containing a negative byte count in the BeginBinary directive. An attacker could possibly use this issue to cause Pillow to hang, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-59203) It was discovered that Pillow incorrectly accumulated JPEG2000 tile component widths. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-59204) It was discovered that Pillow incorrectly validated image mode compatibility in color management transforms. An attacker could possibly use this issue to cause Pillow to crash or execute arbitrary code. (CVE-2026-59205)

USN-8998-1: Squid vulnerability

Ubuntu Security Advisories
1 week 1 day ago
It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches.

USN-8997-1: Net-SNMP vulnerability

Ubuntu Security Advisories
1 week 1 day ago
It was discovered that Net-SNMP incorrectly handled newly accepted connections in the SMUX module. An unauthenticated remote attacker could possibly use this issue to cause Net-SNMP to block indefinitely, resulting in a denial of service.

USN-7530-2: ADOdb vulnerability

Ubuntu Security Advisories
1 week 1 day ago
USN-7530-1 fixed a vulnerability in ADOdb. This update provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. Original advisory details: It was discovered that ADOdb incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL commands.

USN-8996-1: APT vulnerability

Ubuntu Security Advisories
1 week 1 day ago
Max Justicz discovered that APT incorrectly handled hard links when encountering redirects and retrying package downloads. A remote on-path attacker could possibly use this issue to trick APT into installing an unverified package and achieve remote code execution with root privileges.

mongo-c-driver-2.5.8-1.fc45

Fedora Security Advisories
1 week 1 day ago
FEDORA-2026-4701fdc782 Packages in this update:
  • mongo-c-driver-2.5.8-1.fc45
Update description: libbson version 2.5.8

Fixes

  • Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954
libmongoc version 2.5.8

Fixes

  • Fix abort when parsing a cursor namespace without a dot separator.
  • Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
  • Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
  • Fix a missing bounds check when reading GridFS files. CVE-2026-120684
  • Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
  • Report writeConcernError consistently, as mandated by the CRUD spec.

mongo-c-driver-2.5.8-1.el10_4

Fedora Security Advisories
1 week 1 day ago
FEDORA-EPEL-2026-0da73d1b5b Packages in this update:
  • mongo-c-driver-2.5.8-1.el10_4
Update description: libbson version 2.5.8

Fixes

  • Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954
libmongoc version 2.5.8

Fixes

  • Fix abort when parsing a cursor namespace without a dot separator.
  • Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
  • Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
  • Fix a missing bounds check when reading GridFS files. CVE-2026-120684
  • Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
  • Report writeConcernError consistently, as mandated by the CRUD spec.