admin/nvd-json-data-feeds
1
0
Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2025-05-09 03:57:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2024-07-13T06:00:18.559644+00:00

Browse Source
This commit is contained in:
cad-safe-bot 2024-07-13 06:03:10 +00:00
parent 5efd292ab8
commit 24691064d0
3 changed files with 14 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
CVE-2024/CVE-2024-64xx/CVE-2024-6409.json
View File

@ -2,13 +2,13 @@
"id": "CVE-2024-6409",
"sourceIdentifier": "secalert@redhat.com",
"published": "2024-07-08T18:15:09.487",
"lastModified": "2024-07-12T14:15:16.917",
"lastModified": "2024-07-13T04:15:14.207",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A signal handler race condition vulnerability was found in OpenSSH's server (sshd) in Red Hat Enterprise Linux 9, where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). This issue leaves it vulnerable to a signal handler race condition on the cleanup_exit() function, which introduces the same vulnerability as CVE-2024-6387 in the unprivileged child of the SSHD server. As a consequence of a successful attack, in the worst case scenario, the attacker may be able to perform a remote code execution (RCE) within unprivileged user running the sshd server. This vulnerability affects only the sshd server shipped with Red Hat Enterprise Linux 9, while upstream versions of sshd are not impact by this flaw."
"value": "A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server."
},
{
"lang": "es",
@ -72,6 +72,10 @@
"url": "http://www.openwall.com/lists/oss-security/2024/07/10/2",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:4457",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-6409",
"source": "secalert@redhat.com"

11
README.md
View File

@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2024-07-13T04:00:17.759842+00:00
2024-07-13T06:00:18.559644+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2024-07-13T03:15:09.597000+00:00
2024-07-13T04:15:14.207000+00:00
```
### Last Data Feed Release
@ -38,16 +38,15 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### CVEs added in the last Commit
Recently added CVEs: `2`
Recently added CVEs: `0`
- [CVE-2023-39327](CVE-2023/CVE-2023-393xx/CVE-2023-39327.json) (`2024-07-13T03:15:09.347`)
- [CVE-2023-39329](CVE-2023/CVE-2023-393xx/CVE-2023-39329.json) (`2024-07-13T03:15:09.597`)
### CVEs modified in the last Commit
Recently modified CVEs: `0`
Recently modified CVEs: `1`
- [CVE-2024-6409](CVE-2024/CVE-2024-64xx/CVE-2024-6409.json) (`2024-07-13T04:15:14.207`)
## Download and Usage

6
_state.csv
View File

@ -229320,9 +229320,9 @@ CVE-2023-39323,0,0,d2da5a246500965f999a8d84c29008728f75c547f230a13d2193b126917ed
CVE-2023-39324,0,0,6ec2f79fc00f25fb9c6c7b8459112c051220341ced94e2f114cadb7ed5dacee0,2024-07-02T17:15:04.737000
CVE-2023-39325,0,0,58abd083daa7fb16a442cdfaef715883a0fb11da9a8652276862d7d26f2ab493,2024-04-28T04:15:09.877000
CVE-2023-39326,0,0,90a833293ecdbd92e4a1c1828cadca50fa959e82465478bc6c6b2b71065dacac,2024-01-20T04:15:07.890000
CVE-2023-39327,1,1,29d3f00941834ca86a70f55073ea3ba2373a6280635f30c2062f26a3d3b33c84,2024-07-13T03:15:09.347000
CVE-2023-39327,0,0,29d3f00941834ca86a70f55073ea3ba2373a6280635f30c2062f26a3d3b33c84,2024-07-13T03:15:09.347000
CVE-2023-39328,0,0,5cd27bf9c6b82a9f2de8b6f4e16a5adae2ea884e954b836f4416e9d86d703d2c,2024-07-09T18:19:14.047000
CVE-2023-39329,1,1,7b89aa566b14387890cd3786a1d72d46f6786a4e00abb5c5bf8e9e49dab43a3f,2024-07-13T03:15:09.597000
CVE-2023-39329,0,0,7b89aa566b14387890cd3786a1d72d46f6786a4e00abb5c5bf8e9e49dab43a3f,2024-07-13T03:15:09.597000
CVE-2023-3933,0,0,2d784fa3bad269d318314e0780fb5ab15203b6d9670481cab4bae609ef1ad2b5,2023-11-07T04:20:00.337000
CVE-2023-39331,0,0,0b3bb94930c7b603cf2498545fe912acbbb259488d38f9dc6f4da6943004dbbd,2024-06-18T15:09:45.857000
CVE-2023-39332,0,0,8b910ceea29382c3501406376a4083bac4d69f69380af431d3b75bb270bf2e58,2023-11-17T19:08:58.170000
@ -256832,7 +256832,7 @@ CVE-2024-6402,0,0,795485c4534407e246daec51c1daaa33b95f6651688fed743a8fb9054cdaed
CVE-2024-6403,0,0,e44b9cfa8d9ae367e624a8cdf179ef52ea1e98c2115d7a956299d17747a6a56b,2024-07-01T12:37:24.220000
CVE-2024-6405,0,0,fdb62e3d2213e21f6cf3d269e158ee31cc07c01f1a5a460b466ccce5203f82ee,2024-07-01T12:37:24.220000
CVE-2024-6407,0,0,12314028e09ddfd135bb748e0530e9ce4aee25dcaa6c2bae62524650d54b655f,2024-07-12T16:36:34.747000
CVE-2024-6409,0,0,fab7fae4fd82ab978d909560d846bfc072083f4a63c41c80f20dc651384a00de,2024-07-12T14:15:16.917000
CVE-2024-6409,0,1,8fa55f802f11c77e2275f285ff83d5eaaae068922e7ae02d6ce55866bda9f452,2024-07-13T04:15:14.207000
CVE-2024-6410,0,0,9db961a9e1824a35ea4ea0ac1b25800d120aafac2e5d4caf32d46e6051ad19d3,2024-07-11T13:05:54.930000
CVE-2024-6411,0,0,47c8df8c850420fccb0a9ac1089e4a10bdc49d8ecc38cd5ac33a449b2082a491,2024-07-11T13:05:54.930000
CVE-2024-6414,0,0,ae0d661be5f3239fdfe6f0d08030fef27c03212dc1e12675bcf532fd90369002,2024-07-01T12:37:24.220000

Can't render this file because it is too large.