Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
As the Apache Log4j vulnerability continues to wreak havoc, Google and Code Intelligence have jumped…Google’s OSS-Fuzz Tool Now Detects “Log4Shell” Via Jazzer…
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers wi…
UPDATE— The severity score of CVE-2021-45046, originally classified as a DoS bug, has since been revised from 3.7 to 9.0, to reflect the fact that an attacker …
Security researchers have warned users that attackers are attempting to exploit a critical vulnerability in the Java logging library Apache Log4j. Log4j is a w…
A highly critical vulnerability affecting the Apache Log4j library has potentially shaken the internet. This…Critical 'Log4Shell' Zero-Day Vulnerability Wreaks…
A highly critical vulnerability affecting the Apache Log4j library has potentially shaken the internet. This…Critical ‘Log4Shell’ Zero-Day Vulnerability Wreaks…
The Apache Software Foundation has released fixes to contain anactivelyexploitedzero-day vulnerability affecting the widely-used Apache Log4j Java-based loggin…
Apache Santuario - XML Security for Java is vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a…
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protec…
This update addresses CVE-2021-42013. It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path …
Apache Santuario, XML Security for Java, is vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a…
Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server, which could result in denial of service, HTTP request smu…
Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 8 zip release for RHEL 7, RHEL 8 and Microsoft Windows is available. Red Hat Product Securit…
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox Apache PDFBox version 2.0.22 and prior 2.0.x…
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account …
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this,…
Updated ant packages fix security vulnerability: As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so tha…
Upstream version 3.4.5. See http://mail-archives.apache.org/mod_mbox/www- announce/202103.mbox/%3cd028983e-bad3-854b-ec9a-e8b0f922d627@apache.org%3e for detail…
Apache HTTP Server versions before 2.4.32 uses src:uwsgi where a flaw was discovered. The uwsgi protocol does not let us serialize more than 16K of HTTP header…
This release includes the latest stable version of Apache **httpd**, version **2.4.46**. A security issue is addressed in this update: * **CVE-2020-11984** mod…
This update includes the latest stable release of `mod_http2`, fixing various bugs. Two security vulnerabilities are addressed in this update: * **CVE-2020-119…
Updated tomcat packages fix security vulnerability: When using Apache Tomcat versions 9.0.0.M1 to 9.0.34, if a) an attacker is able to control the contents and…
A vulnerability was discovered in Apache Traffic Server, a reverse and forward proxy server, which could result in denial of service via malformed HTTP/2 heade…
This update includes a rebase from 9.0.34 up to 9.0.36 which resolves one CVE along with various other bugs/features: * rhbz#1838964 CVE-2020-9484 tomcat: Apac…
