A flaw was found in http-proxy-agent versions before 2.1.0. The http-proxy-agent passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).

References: https://hackerone.com/reports/321631

Patch: https://github.com/TooTallNate/node-http-proxy-agent/commit/b7b7cc793c3226aa83f820ce5c277e81862d32eb

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

Denial of Service Vulnerability in Action View

Impact ------ Specially crafted accept headers can cause the Action View template location code to consume 100% CPU, causing the server unable to process requests. This impacts all Rails applications that render views.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.

Workarounds ----------- This vulnerability can be mitigated by wrapping render calls with respondto blocks. For example, the following example is vulnerable:

ruby class UserController < ApplicationController def index render "index" end end

But the following code is not vulnerable:

ruby class UserController < ApplicationController def index respondto |format| format.html { render "index" } end end end

Implicit rendering is impacted, so this code is vulnerable:

ruby class UserController < ApplicationController def index end end

But can be changed this this:

ruby class UserController < ApplicationController def index respondto |format| format.html { render "index" } end end end

Alternatively to specifying the format, the following monkey patch can be applied in an initializer:

$ cat config/initializers/formatsfilter.rb frozenstringliteral: true

ActionDispatch::Request.prepend(Module.new do def formats super().select do |format| format.symbol || format.ref == "/" end end end)

Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Also note that the patches for this vulnerability are the same as CVE-2019-5418.

Credits ------- Thanks to John Hawthorn <john@hawthorn.email> of GitHub

Important: rh-postgresql13-postgresql security update

Important: rh-postgresql10-postgresql security update

Important: rh-postgresql12-postgresql security update

Important: rh-nodejs14 security update

Important: rh-varnish6-varnish security update

Important: httpd24-httpd security update

Important: rh-nodejs14 security update

Important: rh-git227-git security update

Important: httpd24-httpd security update

Important: rh-nodejs14-nodejs security update

Important: rh-varnish6-varnish security update

Important: rh-postgresql10-postgresql security update

Moderate: rh-mysql80-mysql security update

Moderate: rh-ruby27-ruby security, bug fix, and enhancement update

Moderate: devtoolset-12-binutils security update

Moderate: rh-nginx120-nginx security update

Moderate: rh-postgresql12-postgresql security update