Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
New SkidMap Malware Attacking Wide Range of Linux Distributions
According to recent reports, there have been instances of threat actors using malware called ''SkidMap'' to exploit vulnerable Redis systems.
TeamTNT's Silentbob Botnet Infecting 196 Hosts in Cloud Attack Campaign
As many as 196 hosts have been infected as part of an aggressive cloud campaign mounted by the TeamTNT group calledSilentbob."The botnet run by TeamTNT has set…
GoBruteforcer: New Golang-Based Malware Breaches Web Servers via Brute-Force Attacks
A new Golang-based malware dubbedGoBruteforcerhas been found targeting web servers running phpMyAdmin, MySQL, FTP, and Postgres to corral the devices into a bo…
RedHat: RHSA-2023-0759:01 Moderate: Red Hat Virtualization security and bug
An update for ovirt-ansible-collection, ovirt-engine, and postgresql-jdbc is now available for Red Hat Virtualization 4 Tools for Red Hat Enterprise Linux 8, R…
Malicious PyPI Packages Using Cloudflare Tunnels to Sneak Through Firewalls
In yet another campaign targeting the Python Package Index (PyPI) repository, six malicious packages have been found deploying information stealers on develope…
Debian LTS: DLA-3218-1: libpgjava security update
pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `Prepa…
Fedora 35: galera 2022-333df1c4aa
**MariaDB 10.5.18 & Galera 26.4.13** Release notes: https://mariadb.com/kb/en/mdb-10-5-18-rn/
RedHat: RHSA-2022-7238:01 Important: Red Hat OpenStack Platform
An update for puppet-mysql is now available for Red Hat OpenStack Platform 13.0 (Queens), 16.1 (Train), 16.2 (Train) and 17.0 (Wallaby). Red Hat Product Securi…
Debian LTS: DLA-3140-1: libpgjava security update
It was discovered that there was a potential SQL injection vulnerability in libpgjava, a Java library for connecting to PostgreSQL databases.
Debian: DSA-5196-1: libpgjava security update
Several security vulnerabilities have been found in libpgjava, the official PostgreSQL JDBC Driver. CVE-2020-13692
Debian LTS: DLA-3018-1: libpgjava security upda
It was found that libpgjava, the official PostgreSQL JDBC Driver, would be vulnerable if an attacker controlled jdbc url or properties. The JDBC driver did not…
Mageia 2022-0190: python-django security upda
Potential SQL injection in QuerySet.annotate(), aggregate(), and extra() (CVE-2022-28346) Potential SQL injection via QuerySet.explain(**options) on PostgreSQL…
Fedora 35: galera 2022-03350936
**MariaDB 10.5.15** Release notes: https://mariadb.com/kb/en/mariadb-10515-release-notes/
Debian: DSA-5101-1: libphp-adodb security upda
Emmet Leahy reported that libphp-adodb, a PHP database abstraction layer library, allows to inject values into a PostgreSQL connection string. Depending on how…
Debian LTS: DLA-2922-1: pgbouncer security upda
It was found that PgBouncer, a PostgreSQL connection pooler, was susceptible to an arbitrary SQL injection attack if a man-in-the-middle could inject data when…
Mageia 2022-0056: php-adodb security upda
Security hotfix release addressing a critical vulnerability in PostgreSQL connections (CVE-2021-3850) Additional fixes: Fix usage of get_magic_* functions #619…
Debian LTS: DLA-2912-1: libphp-adodb security upda
It was found that in libphp-adodb, a PHP database abstraction layer library, an attacker can inject values into the PostgreSQL connection string by bypassing a…
Fedora 35: pgbouncer 2021-761cda0b
Update to 1.16.1, per changes decribed at: http://www.pgbouncer.org/changelog.html#pgbouncer-116x Fixes multiple security vulnerabilities related to PostgreSQL…
Debian LTS: DLA-2857-2: postgis regression upda
The regression of postgresql-9.6-postgis-2.3-scripts being empty in 2.3.1+dfsg-2+deb9u1 has been fixed. For Debian 9 stretch, this problem has been fixed in ve…
Debian LTS: DLA-2857-1: postgis security upda
In PostGIS, which adds support for geographic objects to the PostgreSQL database, denial of service via crafted ST_AsX3D function input was fixed.
Fedora 34: php-symfony4 2021-0294e8ca
**Version 4.4.35** (2021-11-24) * security **CVE-2021-41270** [Serializer] Use single quote to escape formulas (jderusse) * bug #44232 [Cache] fix connecting t…
Fedora 35: php-symfony4 2021-10fd47b3
**Version 4.4.35** (2021-11-24) * security **CVE-2021-41270** [Serializer] Use single quote to escape formulas (jderusse) * bug #44232 [Cache] fix connecting t…
Fedora 33: php 2021-c8043fa0
**PHP version 7.4.26** (18 Nov 2021) **Core:** * Fixed bug php#81518 (Header injection via default_mimetype / default_charset). (cmb) **Date:** * Fixed bug php…
Fedora 34: php 2021-88ba46f2
**PHP version 7.4.26** (18 Nov 2021) **Core:** * Fixed bug php#81518 (Header injection via default_mimetype / default_charset). (cmb) **Date:** * Fixed bug php…