Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by John Helmert III
Re: CVE-2023-34059 - File Descriptor Hijack vulnerability in open-vm-tools
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Sun, 26 Nov 2023 11:38:50 -0800 On Fri, Oct 27, 2023 at 11:57:46AM +0200, Matthias Gerstner wrote: Hello list, I want to share my full report for this finding, please find it below. Introduction ============ During a routine review of the setuid-root binary "vmware-user-suid-wrapper" from the open-vm-tools [1] repository I discovered the vulnerability described in this report.
Re: CVE-2023-49068: Apache DolphinScheduler: Information Leakage Vulnerability
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Sat, 25 Nov 2023 12:07:41 -0800 On Fri, Nov 24, 2023 at 05:29:43AM +0000, Zihao Xiang wrote: Severity: important Affected versions: - Apache DolphinScheduler before 3.2.1 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: 3.2.1. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Sun, 7 May 2023 11:11:47 -0700 On Wed, May 03, 2023 at 03:41:26PM -0400, Jeffrey Walton wrote: Actually, Gentoo is NOT a CNA, and thus cannot issue CVEs. Attachment: signature.asc Description: Current thread: Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules, (continued) Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Reid Sutherland...
Re: sudo: double free with per-command chroot sudoers rules
oss-sec mailing list archives Re: sudo: double free with per-command chroot sudoers rules From: John Helmert III <ajak () gentoo org> Date: Tue, 28 Feb 2023 19:55:43 -0600 Has a CVE been requeested? On Tue, Feb 28, 2023 at 07:31:11AM -0700, Todd C. Miller wrote: A flaw exists in sudo's per-command chroot feature that could result in the variable that stores the command being freed more than once. I believe this is a fairly low-impact bug as the per-command chroot feature is not widely used.
Re: CVE-2023-0122: Linux kernel: Pre-Auth Remote DoS in NVMe
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Thu, 12 Jan 2023 13:24:38 -0600 On Thu, Jan 12, 2023 at 06:10:23PM +0100, Greg KH wrote: This information used to be available for "reserved" CVEs in the JSON data in [1], but now that that's retired I'm not sure this is made public anywhere.
Re: Type Confusion in Linux Kernel
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Tue, 10 Jan 2023 08:03:44 -0600 On Mon, Jan 09, 2023 at 03:09:22PM -0700, Kyle Zeng wrote: You haven't really elaborated on the security implications, but you can request a CVE at cveform.mitre.org I guess. MITRE tends to be prickley regarding kernel issues, though. Attachment: signature.asc Description: Current thread: Type Confusion in Linux Kernel
Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Tue, 3 Jan 2023 14:58:22 -0600 On Mon, Jan 02, 2023 at 12:51:04PM +0100, Arnout Engelen wrote: Great! Can you add that as a reference to the CVE and note the fixed version in the description? Ideally, please also do this for future CVEs/advisories too, so remediation is clear to everyone.
Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Sat, 31 Dec 2022 11:42:45 -0600 On Sat, Dec 31, 2022 at 10:54:00AM +0100, Arnout Engelen wrote: Does it fix CVE-2022-22728? Whether or not it does isn't clear from the changelog [1], and I can't find a reference to the CVE elsewhere in the source tree.
Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption
oss-sec mailing list archives Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption From: John Helmert III <ajak () gentoo org> Date: Fri, 30 Dec 2022 15:53:48 -0600 On Thu, Dec 29, 2022 at 10:50:26AM +0100, Salvatore Bonaccorso wrote: Hi, On Fri, Aug 26, 2022 at 11:01:23AM -0500, John Helmert III wrote: On Thu, Aug 25, 2022 at 02:09:16PM +0000, Joe Orton wrote: Severity: important Description: A flaw in libapreq2 versions 2.16 and earlier could cause a buffer...
Re: [patch] proc.5: tell how to parse /proc/*/stat correctly
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Wed, 28 Dec 2022 12:36:24 -0600 On Wed, Dec 28, 2022 at 01:02:35PM -0500, Demi Marie Obenour wrote: Handling a new binary format is not 'one more thing' added?
Re: Details on this supposed Linux Kernel ksmbd RCE
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Fri, 23 Dec 2022 10:50:32 -0600 On Fri, Dec 23, 2022 at 05:19:06PM +0100, Marcus Meissner wrote: SUSE is a CNA. Wouldn't you be able to oassign a CVE via the SUSE CNA without going through MITRE? Relatedly, I find it very frustrating how little visibility there is into the world's interactions with cveform.mitre.org.
Re: [ADVISORY] LLDP underflow while parsing malformed Auto Attach TLV (Open vSwitch)
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Tue, 20 Dec 2022 15:46:28 -0600 On Tue, Dec 20, 2022 at 10:39:23PM +0100, Ilya Maximets wrote: Has a CVE been requested?
Re: Linux Kernel: UAF in Bluetooth L2CAP Handshake
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Thu, 15 Dec 2022 14:36:03 -0600 On Thu, Dec 15, 2022 at 03:23:29PM -0500, Rafael Correa De Ysasi wrote: Please include CVEs in reports to oss-security when they are assigned.
Re: CVE-2022-4170: rxvt-unicode code execution via background OSC
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Wed, 7 Dec 2022 18:22:21 -0600 On Mon, Dec 05, 2022 at 10:22:33PM +1100, David Leadbeater wrote: Can this CVE be made public (ie, not "reserved" according to [1])? [1] https://github.com/CVEProject/cvelist/blob/master/2022/4xxx/CVE-2022-4170.json Attachment: signature.asc Description: Current thread: CVE-2022-4170: rxvt-unicode code execution via background OSC
Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Mon, 7 Nov 2022 11:35:04 -0600 Copying Apache's CNA address and original sender. The new CVE is now public. On Fri, Nov 04, 2022 at 03:54:46PM -0500, John Helmert III wrote: Attachment: signature.asc Description: Current thread: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing Gary D.
Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Fri, 4 Nov 2022 15:54:46 -0500 On Fri, Nov 04, 2022 at 05:35:34PM +0000, Gary D. Gregory wrote: This appears to be a duplicate of CVE-2022-34169 (also issued by the Apache CNA), and previously discussed on this list at [1]. It was eventually reported to the list that the vulnerability was actually in bcel [2].
Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Wed, 2 Nov 2022 18:41:13 -0500 On Wed, Nov 02, 2022 at 11:24:08AM -0700, Kurt H Maier wrote: I don't read it (Hanno's point) as a 'dunk', some information on how this kind of thing might be prevented in the future certainly has value here.
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Tue, 13 Sep 2022 09:55:29 -0500 On Mon, Aug 29, 2022 at 01:26:49PM +0200, Carlos Alberto Lopez Perez wrote: Apple's released new security advisories yesterday, with 4 WebKit security fixes, two of which are code execution issues, but all 4 of which have public bugzilla bugs and public patches, since as early as late June (https://support.apple.com/en-us/HT213442): https://bugs.webkit.org/show_bug.cgi?id=242278...
Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Fri, 26 Aug 2022 11:01:23 -0500 On Thu, Aug 25, 2022 at 02:09:16PM +0000, Joe Orton wrote: Is there a fixed version or patch or upstream issue?
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Fri, 26 Aug 2022 00:01:40 -0500 On Thu, Aug 25, 2022 at 11:34:04PM +0200, Carlos Alberto Lopez Perez wrote: According to Apple's security advisories for this (e.g. [1]), this issue is tracked on the Webkit Bugzilla as 243557 [2] which was opened on 2022-08-04.
Re: Apache mod_dav off-by-one
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Wed, 10 Aug 2022 13:34:34 -0500 On Tue, Aug 09, 2022 at 02:50:34PM +0300, Evgeny Legerov wrote: Has anyone reported it upstream? Has anyone requested a CVE (seems unlikely, given the last CVE for mod_dav is one from 2013)?
Re: Exim < 4.95 heap overflow
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Sat, 6 Aug 2022 15:59:14 -0500 On Sat, Aug 06, 2022 at 10:46:42PM +0300, Evgeny Legerov wrote: Why do you say it hasn't been recognized as a security issue? Distros don't usually have a way of knowing about a vulnerability that needs patching without a CVE. Have you requested a CVE? That commit does not seem like an original report.
Re: Exim 4.95 invalid free
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Sat, 6 Aug 2022 09:47:05 -0500 Hi, please keep in mind the list content guidelines: "At least the most essential part of your message (e.g., vulnerability detail and/or exploit) should be directly included in the message itself (and in plain text), rather than only included by reference to an external resource.
Re: CVE Request: heap buffer overflow in gdk-pixbuf
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Sat, 23 Jul 2022 11:51:53 -0500 On Sat, Jul 23, 2022 at 07:35:42PM +0700, Pedro Ribeiro wrote: Hi, according to the oss-security Openwall wiki page [1], CVEs need to be requested via MITRE's web form [2].
Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Tue, 19 Jul 2022 14:21:40 -0500 On Tue, Jul 19, 2022 at 05:37:46PM +0000, Mark J. Cox wrote: Hi, is there any available patch or bug report? The reference here only seems to be a discussion of the retirement of xalan-j, rather than the vulnerability.
Re: CVE-2022-21449 and version reporting
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Sun, 1 May 2022 09:38:01 -0500 On Sat, Apr 30, 2022 at 09:09:16PM +0200, Christian Fischer wrote: Their April 2022 CPU (Critical Patch Update) Advisory, which is a reference of CVE-2022-21449, is pretty comprehensive: https://www.oracle.com/security-alerts/cpuapr2022.html#AppendixJAVA Supported versions affected: "Oracle Java SE:...
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0004
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Fri, 8 Apr 2022 12:31:18 -0500 The issue I described last time has come up again here [1]. 2.36.0 was released on March 21, almost three weeks ago now, and its WSA was released today. Why the long wait? Three of these issues are fixed in 2.36.0 and 2.34.7, but I can't find a release for 2.34.7 [2][3]. Is it released yet?
Re: zlib memory corruption on deflate (i.e. compress)
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Fri, 25 Mar 2022 08:59:35 -0500 On Wed, Mar 23, 2022 at 08:49:49PM -0700, Tavis Ormandy wrote: Greetings list, I was recently trying to track down a reproducible crash in a compressor. Believe it or not, it really was a bug in zlib-1.2.11 when compressing (not decompressing!) certain inputs.
Samba 4.15.5, 4.14.12, 4.13.17 Security Releases
oss-sec mailing list archives By Date By Thread Samba 4.15.5, 4.14.12, 4.13.17 Security Releases From: John Helmert III <jchelmert3 () posteo net> Date: Tue, 01 Feb 2022 02:23:33 +0000 CVE-2021-44142 is particularly nasty, "This vulnerability allows remote attackers to execute arbitrary code as root on affected Samba installations that use the VFS module vfs_fruit." ----- Forwarded message from Jule Anger via samba-announce <samba-announce () lists samba org> ----- Return-Path:...
WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
oss-sec mailing list archives By Date By Thread Re: WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001 From: John Helmert III <ajak () gentoo org> Date: Sat, 22 Jan 2022 22:02:46 -0600 In this case the advisory was published the same day as the release, but in general I notice that WebKit security advisories are published sometimes weeks after the releases, often with vague changelog notes like "Fix several crashes and rendering issues.".
Protobuf Java, Kotlin, JRuby DoS
oss-sec mailing list archives By Date By Thread Re: CVE-2021-22569: Protobuf Java, Kotlin, JRuby DoS From: John Helmert III <ajak () gentoo org> Date: Wed, 12 Jan 2022 14:37:04 -0600 On Wed, Jan 12, 2022 at 01:32:51PM +0100, Ana Oprea wrote: Summary A potential Denial of Service issue in protobuf-java was discovered in the parsing procedure for binary data. - Reporter: OSS-Fuzz [1] - Affected versions: All versions of Java Protobufs (including Kotlin and JRuby) prior to the versions listed below.
Ceph volume does not honour osd_dmcrypt_key_size
oss-sec mailing list archives By Date By Thread Re: CVE-2021-3979 ceph: Ceph volume does not honour osd_dmcrypt_key_size From: John Helmert III <ajak () gentoo org> Date: Tue, 11 Jan 2022 22:52:24 -0600 On Tue, Jan 11, 2022 at 04:10:06PM -0500, Ana McTaggart wrote: Hi all, The key length for encrypted devices created using ceph-volume is incorrect.
Re: Polipo: denial-of-service using range
oss-sec mailing list archives Re: Polipo: denial-of-service using range From: John Helmert III Date: Thu, 12 Aug 2021 20:35:28 +0000 I'm only able to reproduce such a heap overflow when specifying a Range header with a valid range, e.g. "2-3" whereas the original Perl script tested an invalid range of "3-2".
Re: Polipo: denial-of-service using range
oss-sec mailing list archives By Date By Thread Re: Polipo: denial-of-service using range From: John Helmert III <jchelmert3 () posteo net> Date: Sun, 18 Jul 2021 21:56:25 +0000 This was assigned CVE-2020-36420. Attachment: signature.asc Description: By Date By Thread Current thread: Re: Polipo: denial-of-service using range John Helmert III (Jul 18)
NULL pointer dereference on specially crafted HTTP/2 request
oss-sec mailing list archives By Date By Thread Re: CVE-2021-31618: Apache httpd: NULL pointer dereference on specially crafted HTTP/2 request From: John Helmert III <jchelmert3 () posteo net> Date: Thu, 10 Jun 2021 14:38:14 +0000 On Wed, Jun 09, 2021 at 11:11:00PM +0200, Christophe JAILLET wrote: CVE-2021-31618: NULL pointer dereference on specially crafted HTTP/2 request Severity: important Vendor: The Apache Software Foundation Versions Affected: 2.4.47 httpd Description: Apache HTTP...
PAM 1.5.0 has a auth bypass under some conditions
oss-sec mailing list archives By Date By Thread Re: Heads up: PAM 1.5.0 has a auth bypass under some conditions From: John Helmert III <jchelmert3 () posteo net> Date: Tue, 24 Nov 2020 12:02:52 -0600 On Tue, Nov 24, 2020 at 07:20:21PM +0100, Marcus Meissner wrote: Hi, (via IRC, spotted by Foxboron) PAM 1.5.0 had a potential auth bypass, if a user did not exist and the root password was empty (but root locked down).
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with John
Contact John, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack