diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index e2bd8727d1c4..f202dc01a5e7 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,148 +1,178 @@ + + keycloak -- Multiple security fixes + + + keycloak + 26.0.8 + + + + +

Keycloak reports:

+
+

This update includes 2 security fixes:

+
    +
  • CVE-2024-11734: Unrestricted admin use of system and environment variables
    • +
  • CVE-2024-11736: Denial of Service in Keycloak Server via Security Headers
    • +
+
+ + + + CVE-2024-11734 + CVE-2024-11736 + + + 2025-01-13 + 2025-01-13 + + + asterisk - path traversal asterisk18 18.26.20 asterisk20 20.11.0

cve@mitre.org reports:

An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal.

 CVE-2024-53566 https://nvd.nist.gov/vuln/detail/CVE-2024-53566 2024-12-02 2025-01-12 redis,valkey -- Denial-of-service valnerability due to malformed ACL selectors redis 7.0.07.4.2 redis72 7.2.7 valkey 8.0.2

Redis core team reports:

An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service.The problem exists in Redis 7.0.0 or newer.

CVE-2024-51741 https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9 2025-01-06 2025-01-10 redis,valkey -- Remote code execution valnerability redis 7.4.2 redis72 7.2.7 redis62 6.2.17 valkey 8.0.2

Redis core team reports:

An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting.

CVE-2024-46981 https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c 2025-01-06 2025-01-10 Gitlab -- Vulnerabilities gitlab-ce gitlab-ee 17.7.017.7.1 17.6.017.6.3 11.0.017.5.5

Gitlab reports:

Possible access token exposure in GitLab logs

Cyclic reference of epics leads resource exhaustion

Unauthorized user can manipulate status of issues in public projects

Instance SAML does not respect external_provider configuration

 CVE-2025-0194 CVE-2024-6324 CVE-2024-12431 CVE-2024-13041 https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/ 2025-01-08 2025-01-08