fence-agents-ibm-powervs vulnerabilities (AlmaLinux)
30 vulnerabilities.
fence-agents-ibm-powervsAlmaLinuxPyJWT BOM Bypass7.4 Highfence-agents-ibm-powervsAlmaLinuxPyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard7.4 Highfence-agents-ibm-powervsAlmaLinuxPyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard9.1 Criticalfence-agents-ibm-powervsAlmaLinuxPyJWT: PyJWKClient follows redirects when fetching JWKS7.4 Highfence-agents-ibm-powervsAlmaLinuxPyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation7.4 Highfence-agents-ibm-powervsAlmaLinuxpyasn1: Uncontrolled resource consumption when converting decoded REAL values7.5 Highfence-agents-ibm-powervsAlmaLinuxhttplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling7.5 Highfence-agents-ibm-powervsAlmaLinuxPyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed7.4 Highfence-agents-ibm-powervsAlmaLinuxurllib3: Sensitive headers forwarded across origins in proxied low-level redirects8.2 Highfence-agents-ibm-powervsAlmaLinuxpyasn1 Vulnerable to Denial of Service via Unbounded Recursion7.5 Highfence-agents-ibm-powervsAlmaLinuxPyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)7.5 Highfence-agents-ibm-powervsAlmaLinuxcryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves8.2 Highfence-agents-ibm-powervsAlmaLinuxpyasn1 has a DoS vulnerability in decoder7.5 Highfence-agents-ibm-powervsAlmaLinuxurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)8.9 Highfence-agents-ibm-powervsAlmaLinuxurllib3 Streaming API improperly handles highly compressed data8.9 Highfence-agents-ibm-powervsAlmaLinuxurllib3 allows an unbounded number of links in the decompression chain8.9 Highfence-agents-ibm-powervsAlmaLinuxRequests vulnerable to .netrc credentials leak via malicious URLs5.3 Mediumfence-agents-ibm-powervsAlmaLinuxsetuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write7.7 Highfence-agents-ibm-powervsAlmaLinuxJinja has a sandbox breakout through indirect reference to format method5.4 Mediumfence-agents-ibm-powervsAlmaLinuxJinja has a sandbox breakout through malicious filenames5.4 Mediumfence-agents-ibm-powervsAlmaLinuxRemote Code Execution in pypa/setuptools8.8 Highfence-agents-ibm-powervsAlmaLinuxProxy-Authorization request header isn't stripped during cross-origin redirects in urllib34.4 Mediumfence-agents-ibm-powervsAlmaLinuxJinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter5.4 Mediumfence-agents-ibm-powervsAlmaLinuxJinja vulnerable to Cross-Site Scripting (XSS)5.4 Mediumfence-agents-ibm-powervsAlmaLinuxPyCryptodome and pycryptodomex side-channel leakage for OAEP decryption5.9 Mediumfence-agents-ibm-powervsAlmaLinuxRequest body not stripped after redirect in urllib34.2 Mediumfence-agents-ibm-powervsAlmaLinux`Cookie` HTTP header isn't stripped on cross-origin redirects5.9 Mediumfence-agents-ibm-powervsAlmaLinuxCertifi's removal of e-Tugra root certificate7.5 Highfence-agents-ibm-powervsAlmaLinuxOAuthLib vulnerable DoS when attacker provides malicious IPV6 URI5.7 Mediumfence-agents-ibm-powervsAlmaLinuxfence-agents bug fix and enhancement updateNo score