fence-agents-nutanix-ahv vulnerabilities (AlmaLinux)
16 vulnerabilities.
fence-agents-nutanix-ahvAlmaLinuxPyJWT BOM Bypass7.4 Highfence-agents-nutanix-ahvAlmaLinuxPyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard7.4 Highfence-agents-nutanix-ahvAlmaLinuxPyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard9.1 Criticalfence-agents-nutanix-ahvAlmaLinuxPyJWT: PyJWKClient follows redirects when fetching JWKS7.4 Highfence-agents-nutanix-ahvAlmaLinuxPyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation7.4 Highfence-agents-nutanix-ahvAlmaLinuxpyasn1: Uncontrolled resource consumption when converting decoded REAL values7.5 Highfence-agents-nutanix-ahvAlmaLinuxhttplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling7.5 Highfence-agents-nutanix-ahvAlmaLinuxPyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed7.4 Highfence-agents-nutanix-ahvAlmaLinuxurllib3: Sensitive headers forwarded across origins in proxied low-level redirects8.2 Highfence-agents-nutanix-ahvAlmaLinuxpyasn1 Vulnerable to Denial of Service via Unbounded Recursion7.5 Highfence-agents-nutanix-ahvAlmaLinuxPyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)7.5 Highfence-agents-nutanix-ahvAlmaLinuxcryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves8.2 Highfence-agents-nutanix-ahvAlmaLinuxpyasn1 has a DoS vulnerability in decoder7.5 Highfence-agents-nutanix-ahvAlmaLinuxurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)8.9 Highfence-agents-nutanix-ahvAlmaLinuxurllib3 Streaming API improperly handles highly compressed data8.9 Highfence-agents-nutanix-ahvAlmaLinuxurllib3 allows an unbounded number of links in the decompression chain8.9 High