GHSA-7p9f-6x8j-gxxp: CRI-O: Maliciously structured checkpoint file can gain arbitrary node access

GHSA-hh33-46q4-hwm2: Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion

GHSA-rmv2-8jjc-23xw: TCPDF Local File Inclusion vulnerability

GHSA-w5rq-g9r6-vrcg: @dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling

GHSA-q4xm-6fjc-5f6w: sigstore-java has vulnerability with bundle verification

### Impact
RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability.

### Patches
update to jsrsasign 11.0.0.

### Workarounds
Find and replace RSA and RSAOAEP decryption with other crypto library.

### References
https://people.redhat.com/~hkario/marvin/
https://github.com/kjur/jsrsasign/issues/598


**Marvin Attack of RSA and RSAOAEP decryption in jsrsasign**

High severity GitHub Reviewed Published Jan 17, 2024 in kjur/jsrsasign • Updated Jan 19, 2024

Headline

GHSA-rh63-9qcf-83gf: Marvin Attack of RSA and RSAOAEP decryption in jsrsasign

Impact

Patches

Workarounds

References

ghsa: Latest News