A flaw was found in JBoss EAP. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in OidcSessionTokenStore when determining if a cached token should be used or not. This logic needs to be updated to take into account the new "provider-url" option in addition to the "realm" option.

Skip to content

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   Pricing

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  CVE-2023-6236

**WildFly Elytron: OIDC app attempting to access the second tenant, the user should be prompted to log**

High severity GitHub Reviewed Published Apr 10, 2024 to the GitHub Advisory Database • Updated Apr 10, 2024

**Package**

maven org.wildfly.security:wildfly-elytron-http-oidc (Maven)

**Affected versions**

<= 2.2.2

**Description**

Published to the GitHub Advisory Database

Apr 10, 2024

Last updated

Apr 10, 2024

GHSA-jpmx-996v-48fm: WildFly Elytron: OIDC app attempting to access the second tenant, the user should be prompted to log

Ubuntu Security Notice 6719-2 - USN-6719-1 fixed a vulnerability in util-linux. Unfortunately, it was discovered that the fix did not fully address the issue. This update removes the setgid permission bit from the wall and write utilities. Skyler Ferrante discovered that the util-linux wall command did not filter escape sequences from command line arguments. A local attacker could possibly use this issue to obtain sensitive information.

==========================================================================  
Ubuntu Security Notice USN-6719-2  
April 10, 2024

util-linux vulnerability  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10  
- Ubuntu 22.04 LTS  
- Ubuntu 20.04 LTS

Summary:

util-linux could be made to expose sensitive information.

Software Description:  
- util-linux: miscellaneous system utilities

Details:

USN-6719-1 fixed a vulnerability in util-linux. Unfortunately, it was  
discovered that the fix did not fully address the issue. This update  
removes the setgid permission bit from the wall and write utilities.

Original advisory details:

  Skyler Ferrante discovered that the util-linux wall command did not filter  
  escape sequences from command line arguments. A local attacker could  
  possibly use this issue to obtain sensitive information.

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 23.10:  
   util-linux                      2.39.1-4ubuntu2.2

Ubuntu 22.04 LTS:  
   util-linux                      2.37.2-4ubuntu3.4

Ubuntu 20.04 LTS:  
   util-linux                      2.34-0.1ubuntu9.6

In general, a standard system update will make all the necessary changes.

References:  
   https://ubuntu.com/security/notices/USN-6719-2  
   https://ubuntu.com/security/notices/USN-6719-1  
   CVE-2024-28085

Package Information:  
   https://launchpad.net/ubuntu/+source/util-linux/2.39.1-4ubuntu2.2  
   https://launchpad.net/ubuntu/+source/util-linux/2.37.2-4ubuntu3.4  
   https://launchpad.net/ubuntu/+source/util-linux/2.34-0.1ubuntu9.6

Ubuntu Security Notice USN-6719-2

Ubuntu Security Notice 6721-2 - USN-6721-1 fixed vulnerabilities in X.Org X Server. That fix was incomplete resulting in a regression. This update fixes the problem. It was discovered that X.Org X Server incorrectly handled certain data. An attacker could possibly use this issue to expose sensitive information.

==========================================================================  
Ubuntu Security Notice USN-6721-2  
April 09, 2024

xorg-server, xwayland regression  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10  
- Ubuntu 22.04 LTS  
- Ubuntu 20.04 LTS  
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)  
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)  
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

A regression was fixed in X.Org X Server.

Software Description:  
- xorg-server: X.Org X11 server  
- xwayland: X server for running X clients under Wayland

Details:

USN-6721-1 fixed vulnerabilities in X.Org X Server. That fix was incomplete  
resulting in a regression. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

 It was discovered that X.Org X Server incorrectly handled certain data.  
 An attacker could possibly use this issue to expose sensitive information.  
 (CVE-2024-31080, CVE-2024-31081, CVE-2024-31082)

 It was discovered that X.Org X Server incorrectly handled certain glyphs.  
 An attacker could possibly use this issue to cause a crash or expose sensitive  
 information. (CVE-2024-31083)

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 23.10:  
  xserver-xorg-core               2:21.1.7-3ubuntu2.9  
  xwayland                        2:23.2.0-1ubuntu0.6

Ubuntu 22.04 LTS:  
  xserver-xorg-core               2:21.1.4-2ubuntu1.7~22.04.10  
  xwayland                        2:22.1.1-1ubuntu0.13

Ubuntu 20.04 LTS:  
  xserver-xorg-core               2:1.20.13-1ubuntu1~20.04.17  
  xwayland                        2:1.20.13-1ubuntu1~20.04.17

Ubuntu 18.04 LTS (Available with Ubuntu Pro):  
  xserver-xorg-core               2:1.19.6-1ubuntu4.15+esm8  
  xwayland                        2:1.19.6-1ubuntu4.15+esm8

Ubuntu 16.04 LTS (Available with Ubuntu Pro):  
  xserver-xorg-core               2:1.18.4-0ubuntu0.12+esm13  
  xwayland                        2:1.18.4-0ubuntu0.12+esm13

Ubuntu 14.04 LTS (Available with Ubuntu Pro):  
  xserver-xorg-core               2:1.15.1-0ubuntu2.11+esm12

After a standard system update you need to restart -APP- to make  
all the necessary changes.

References:  
  https://ubuntu.com/security/notices/USN-6721-2  
  https://ubuntu.com/security/notices/USN-6721-1  
  https://launchpad.net/bugs/2060354

Package Information:  
  https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.7-3ubuntu2.9  
  https://launchpad.net/ubuntu/+source/xwayland/2:23.2.0-1ubuntu0.6  
  https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.4-2ubuntu1.7~22.04.10  
  https://launchpad.net/ubuntu/+source/xwayland/2:22.1.1-1ubuntu0.13  
  https://launchpad.net/ubuntu/+source/xorg-server/2:1.20.13-1ubuntu1~20.04.17

Ubuntu Security Notice USN-6721-2

Joomla SP Page Builder component version 5.2.7 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : SP Page Builder 5.2.7 Sql injection Vulnerability                                                                  || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               || # Vendor    : https://extensions.joomla.org/extension/sp-page-builder/                                                           |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /index.php?option=com_sppagebuilder&view=page&id=22&Itemid=251 <===== inject here[+] http://127.0.0.1/cdgi36fr/index.php?option=com_sppagebuilder&view=page&id=22&Itemid=251Greetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

Joomla SP Page Builder 5.2.7 SQL Injection

Red Hat Security Advisory 2024-1750-03 - An update for unbound is now available for Red Hat Enterprise Linux 9.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1750.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: unbound security updateAdvisory ID:        RHSA-2024:1750-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:1750Issue date:         2024-04-10Revision:           03CVE Names:          CVE-2024-1488====================================================================Summary: An update for unbound is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impact ofImportant. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.Security Fix(es):* A vulnerability was found in Unbound due to incorrect default permissions,allowing any process outside the unbound group to modify the unbound runtimeconfiguration. The default combination of the \"control-use-cert: no\" option witheither explicit or implicit use of an IP address in the \"control-interface\"option could allow improper access. If a process can connect over localhost toport 8953, it can alter the configuration of unbound.service. This flaw allowsan unprivileged local process to manipulate a running instance, potentiallyaltering forwarders, allowing them to track all queries forwarded by the localresolver, and, in some cases, disrupting resolving altogether.To mitigate the vulnerability, a new file\"/etc/unbound/conf.d/remote-control.conf\" has been added and included in themain unbound configuration file, \"unbound.conf\". The file contains twodirectives that should limit access to unbound.conf:    control-interface: \"/run/unbound/control\"    control-use-cert: \"yes\"For details about these directives, run \"man unbound.conf\".Updating to the version of unbound provided by this advisory should, in mostcases, address the vulnerability. To verify that your configuration is notvulnerable, use the \"unbound-control status | grep control\" command. If theoutput contains \"control(ssl)\" or \"control(namedpipe)\", your configuration isnot vulnerable. If the command output returns only \"control\", the configurationis vulnerable because it does not enforce access only to the unbound groupmembers. To fix your configuration, add the line \"include:/etc/unbound/conf.d/remote-control.conf\" to the end of the file\"/etc/unbound/unbound.conf\". If you use a custom\"/etc/unbound/conf.d/remote-control.conf\" file, add the new directives to thisfile. (CVE-2024-1488)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVE page(s)listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-1488References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2264183

Red Hat Security Advisory 2024-1750-03

Red Hat Security Advisory 2024-1747-03 - An update for kernel is now available for Red Hat Enterprise Linux 7.6 Advanced Update Support. Issues addressed include a use-after-free vulnerability.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1747.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: kernel security updateAdvisory ID:        RHSA-2024:1747-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:1747Issue date:         2024-04-10Revision:           03CVE Names:          CVE-2023-4623====================================================================Summary: An update for kernel is now available for Red Hat Enterprise Linux 7.6 Advanced Update Support.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:The kernel packages contain the Linux kernel, the core of any Linux operating system.Security Fix(es):* kernel: net/sched: fix use-after-free in HFSC qdisc (CVE-2023-4623)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2023-4623References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2237757

Red Hat Security Advisory 2024-1747-03

Red Hat Security Advisory 2024-1746-03 - An update for kernel is now available for Red Hat Enterprise Linux 7.7 Advanced Update Support. Issues addressed include a use-after-free vulnerability.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1746.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: kernel security updateAdvisory ID:        RHSA-2024:1746-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:1746Issue date:         2024-04-10Revision:           03CVE Names:          CVE-2022-42896====================================================================Summary: An update for kernel is now available for Red Hat Enterprise Linux 7.7 Advanced Update Support.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:The kernel packages contain the Linux kernel, the core of any Linux operating system.Security Fix(es):* kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)* kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)* Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2022-42896References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2147364https://bugzilla.redhat.com/show_bug.cgi?id=2187308https://bugzilla.redhat.com/show_bug.cgi?id=2237757

Red Hat Security Advisory 2024-1746-03

Red Hat Security Advisory 2024-1722-03 - An update for edk2 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.2 Telecommunications Update Service. Issues addressed include a buffer overflow vulnerability.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1722.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: edk2 security updateAdvisory ID:        RHSA-2024:1722-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:1722Issue date:         2024-04-09Revision:           03CVE Names:          CVE-2023-45234====================================================================Summary: An update for edk2 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.2 Telecommunications Update Service.Red Hat Product Security has rated this update as having a security impact ofImportant. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.Security Fix(es):* edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message (CVE-2023-45234)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2023-45234References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2258697

Red Hat Security Advisory 2024-1722-03

Red Hat Security Advisory 2024-1719-03 - An update for rear is now available for Red Hat Enterprise Linux 8.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1719.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: rear security updateAdvisory ID:        RHSA-2024:1719-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:1719Issue date:         2024-04-09Revision:           03CVE Names:          CVE-2024-23301====================================================================Summary: An update for rear is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:Relax-and-Recover is a recovery and system migration utility. The utility produces a bootable image and restores from backup using this image. It allows to restore to different hardware and can therefore be also used as a migration utility.Security Fix(es):* rear: creates a world-readable initrd (CVE-2024-23301)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-23301References:https://access.redhat.com/security/updates/classification/#moderatehttps://bugzilla.redhat.com/show_bug.cgi?id=2258396

Red Hat Security Advisory 2024-1719-03

By cybernewswire
Tel Aviv, Israel, April 10th, 2024, CyberNewsWire Cyber GRC software company Cypago has announced a new automation solution…
This is a post from HackRead.com Read the original post: Cypago Announces New Automation Support for AI Security and Governance

**Tel Aviv, Israel, April 10th, 2024, CyberNewsWire**

Cyber GRC software company Cypago has announced a new automation solution for artificial intelligence (AI) governance, risk management and compliance. This includes implementation of NIST AI RMF and ISO/IEC 42001, the newest AI security and governance frameworks. With more and more companies integrating new AI tools into their business processes, daily operations, and customer-facing products and services, safe and compliant use of AI has become a pivotal challenge.

Enterprises are adopting AI-powered tools and solutions at a staggering pace, thanks to the increasing power and democratization of AI platforms, and the extensive benefits that artificial intelligence can bring to business operations. However, AI also brings many dangers, including the potential for leaking private data, lack of transparency, and increasingly complex cyber threats. Organizations also need to prepare themselves for more legislation regulating the use and application of AI in business settings. 

The best way to protect against these dangers and stay ahead of AI regulations is through adherence to best practices for cyber GRC governance, which are in a constant state of flux. By providing comprehensive risk management, automated 24/7 monitoring, and cybersecurity governance tailored to AI solutions, Cypago enables companies to seamlessly secure their AI initiatives. 

“The world of AI is changing quickly, with new threats arising all the time and new regulations arriving frequently. We view it as our responsibility to help organizations maximize the benefits of AI while effectively mitigating the risks and ensuring compliance with best practices and good governance,” said Arik Solomon, CEO of Cypago. “These latest features ensure that Cypago supports the newest AI and cyber governance frameworks, enabling GRC and cybersecurity teams to automate GRC with the most up-to-date requirements.” 

Cypago delivers ongoing visibility into all the organization’s tools, applications, and models, while automating many processes needed for effective risk assessment and threat detection. Its heightened security measures for AI-based systems help keep data and software secure, reducing the risk of cyber threats, data breaches and regulatory violations. 

What’s more, Cypago is no stranger to the implementation of safe AI, having adopted natural language models and generative AI command prompts as part of its product in 2023.

The platform streamlines security, risk management and compliance gap detection and remediation processes, enabling teams to respond more effectively to emerging threats and vulnerabilities, while ensuring compliance with international, national, and industry-specific regulations. This empowers companies to navigate the complex compliance landscape, which now encompasses the use of AI, with confidence. 

**About Cypago**

Cypago’s revolutionary SaaS-based Cyber GRC Automation (CGA) platform redefines the three lines model by eliminating friction and bridging the gap between management, security, and operations. It transforms GRC initiatives into automated processes, enabling in-depth visibility, streamlining enforcement, and significantly reducing overall costs. The platform leverages innovative technologies, including advanced analysis and correlation engines, GenAI, and NLP models, designed to support any security framework in any IT environment, both in the cloud and on-premises. Cypago was founded in 2020 by tech leaders and cybersecurity veterans with decades of combined experience in the development, operations, and commercialization of cybersecurity solutions. For more information, visit https://cypago.com/. 

**Contact**

**PR**  
**Dan Edelstein**  
**InboundJunction**  
**\[email protected\]**

Tag

#vulnerability