#git

Red Hat has always been an advocate of growth at the intersection of open source and computing solutions–which is exactly where RISC-V can be found. RISC-V is one of those technologies where the future is both evident and inevitable. By integrating open source concepts with the hardware development process, it’s not hyperbole to say that RISC-V is disrupting the hardware industry.Our excitement around the unique value RISC-V brings to the hardware ecosystem as an open and collaborative instruction set architecture (ISA) is nothing new. Red Hat has been providing Fedora on RISC-V for severa

An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

By Waqas It's crucial to note that this sale of compromised AnyDesk accounts isn't connected to the security breach incident disclosed by the company on February 2, 2024. This is a post from HackRead.com Read the original post: Thousands of Stolen AnyDesk Login Credentials Sold on Dark Web

Plus: Russia was likely behind widespread GPS outages, Vault 7 leaker was sentenced, police claim to trace Monero cryptocurrency, and more.

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information. ## <a name="affected-software"></a>Affected software * Any .NET 6.0 application running on .NET 6.0.7 or earlier. * Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier. If your application uses the following package versions, ensure you update to the latest version of .NET. ### <a name=".NET Core 3.1"></a>.NET Core 3.1 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System.Security.Cryptography.Xml](http://system.security)| <=4.7.0| 4.7.1 [Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft....

### Impact A major blind SSRF has been found in `remark-images-download`, which allowed for requests to be made to neighboring servers on local IP ranges. The issue came from a loose filtering of URLs inside the module. Imagine a server running on a private network `192.168.1.0/24`. A private service serving images is running on `192.168.1.2`, and is not expected to be accessed by users. A machine is running `remark-images-download` on the neighboring `192.168.1.3` host. An user enters the following Markdown: ```markdown  ``` The image is downloaded by the server and included inside the resulting document. Hence, the user has access to the private image. It has been corrected by preventing images downloads from local IP ranges, both in IPv4 and IPv6. To avoid malicious domain names, resolved local IPs from are also forbidden inside the module. This vulnerability impact is moderate, as it is can allow access to unexposed documents on the local...

### Impact A minor Local File Inclusion vulnerability has been found in `zmarkdown`, which allowed for images with a known path on the host machine to be included inside a LaTeX document. To prevent it, a new option has been created that allow to replace invalid paths with a default image instead of linking the image on the host directly. `zmarkdown` has been updated to make this setting the default. Every user of `zmarkdown` is likely impacted, except if disabling LaTeX generation or images download. Here is an example of including an image from an invalid path: ```markdown  ``` Will effectively redownload and include the image found at `/tmp/img.png`. ### Patches The vulnerability has been patched in version 10.1.3. If impacted, you should update to this version as soon as possible. ### Workarounds Disable images downloading, or sanitize paths. ### For more information If you have any questions or comments about this advisory, open an issue in [ZMarkdown](...

### Impact The faulty nodes will reject transactions which calls `load_cell_data` syscall but the input cell is still in the mempool. They also ban other nodes and cause the network separation. ### Patches 0.35.2, 0.36.1, 0.37.1, 0.38.2

### Impact There's a bug in the pool statistics that when conflicting transactions are removed from the pool, they are not subtracted from the statics. Finally, the transaction pool keeps full and reject all transactions. ### Patches 0.39.2 ### Workarounds Restart the CKB node.

### Impact This GitHub Action use `set-env` runner commands which are processed via stdout related to GHSA-mfwh-5m23-j46w ### Patches The following versions use the recommended [Environment File Syntax](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files). - 2.1.1 - 1.1.1 ### Workarounds None, it is strongly suggested that you upgrade as soon as possible. ### For more information If you have any questions or comments about this advisory: * Open an issue in [rlespinasse/github-slug-action](https://github.com/rlespinasse/github-slug-action)