FAIL › dossier
fedoraproject
VENDORDossier not yet built — the RAG curator builds one for players with ≥2 failure events. The failure history and sentiment below are live.
FAILURE HISTORY · 45
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2024-04-25 | CVE-2024-22373 | high | CVE-2024-22373: An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStream |
| 2023-07-20 | CVE-2023-38408 | critical | CVE-2023-38408: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently t |
| 2022-11-22 | CVE-2022-36227 | critical | CVE-2022-36227: In libarchive before 3.6.2, the software does not check for an error after calli |
| 2022-10-24 | CVE-2021-46848 | critical | CVE-2021-46848: GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affe |
| 2022-10-21 | CVE-2022-37454 | critical | CVE-2022-37454: The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer ove |
| 2022-08-05 | CVE-2022-37434 | critical | CVE-2022-37434: zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in infl |
| 2022-07-07 | CVE-2022-32207 | critical | CVE-2022-32207: When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes |
| 2022-06-06 | CVE-2022-32511 | critical | CVE-2022-32511: jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation w |
| 2022-02-18 | CVE-2022-25315 | critical | CVE-2022-25315: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNa |
| 2022-02-16 | CVE-2022-25235 | critical | CVE-2022-25235: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of e |
| 2022-01-17 | CVE-2022-23304 | critical | CVE-2022-23304: The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before |
| 2022-01-17 | CVE-2022-23303 | critical | CVE-2022-23303: The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 |
| 2021-12-10 | CVE-2021-44228 | critical | CVE-2021-44228: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12 |
| 2021-09-23 | CVE-2021-22945 | critical | CVE-2021-22945: When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some |
| 2021-09-16 | CVE-2021-40438 | critical | CVE-2021-40438: A crafted request uri-path can cause mod_proxy to forward the request to an orig |
| 2021-05-25 | CVE-2021-33574 | critical | CVE-2021-33574: The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 h |
| 2021-03-23 | CVE-2021-21344 | medium | CVE-2021-21344: XStream is a Java library to serialize objects to XML and back again. In XStream |
| 2021-03-23 | CVE-2021-21345 | medium | CVE-2021-21345: XStream is a Java library to serialize objects to XML and back again. In XStream |
| 2021-03-23 | CVE-2021-21346 | medium | CVE-2021-21346: XStream is a Java library to serialize objects to XML and back again. In XStream |
| 2021-03-23 | CVE-2021-21347 | medium | CVE-2021-21347: XStream is a Java library to serialize objects to XML and back again. In XStream |
| 2021-03-23 | CVE-2021-21351 | medium | CVE-2021-21351: XStream is a Java library to serialize objects to XML and back again. In XStream |
| 2021-03-23 | CVE-2021-21342 | medium | CVE-2021-21342: XStream is a Java library to serialize objects to XML and back again. In XStream |
| 2021-03-23 | CVE-2021-21350 | medium | CVE-2021-21350: XStream is a Java library to serialize objects to XML and back again. In XStream |
| 2021-03-12 | CVE-2021-20231 | critical | CVE-2021-20231: A flaw was found in gnutls. A use after free issue in client sending key_share e |
| 2021-03-12 | CVE-2021-20232 | critical | CVE-2021-20232: A flaw was found in gnutls. A use after free issue in client_send_params in lib/ |
| 2021-01-19 | CVE-2021-3177 | critical | CVE-2021-3177: Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callpro |
| 2020-10-22 | CVE-2020-27619 | critical | CVE-2020-27619: In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec test |
| 2020-02-24 | CVE-2020-1938 | critical | CVE-2020-1938: When using the Apache JServ Protocol (AJP), care must be taken when trusting inc |
| 2020-01-29 | CVE-2019-20444 | critical | CVE-2019-20444: HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a |
| 2020-01-29 | CVE-2019-20445 | critical | CVE-2019-20445: HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to |
| 2019-12-23 | CVE-2019-11049 | medium | CVE-2019-11049: In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom h |
| 2019-10-01 | CVE-2019-16942 | critical | CVE-2019-16942: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th |
| 2019-10-01 | CVE-2019-16943 | critical | CVE-2019-16943: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th |
| 2019-09-16 | CVE-2019-5481 | critical | CVE-2019-5481: Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. |
| 2019-09-16 | CVE-2019-5482 | critical | CVE-2019-5482: Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. |
| 2019-09-15 | CVE-2019-16335 | critical | CVE-2019-16335: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2 |
| 2019-09-15 | CVE-2019-14540 | critical | CVE-2019-14540: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2 |
| 2019-07-29 | CVE-2019-14379 | critical | CVE-2019-14379: SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles de |
| 2019-06-07 | CVE-2019-10160 | critical | CVE-2019-10160: A security regression of CVE-2019-9636 was discovered in python since commit d53 |
| 2019-05-30 | CVE-2019-8457 | critical | CVE-2019-8457: SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound re |
| 2019-03-23 | CVE-2019-9948 | critical | CVE-2019-9948: urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes |
| 2019-03-21 | CVE-2019-3862 | high | CVE-2019-3862: An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH |
| 2019-03-21 | CVE-2019-3859 | critical | CVE-2019-3859: An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh |
| 2019-03-21 | CVE-2019-3858 | medium | CVE-2019-3858: An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a special |
| 2019-03-08 | CVE-2019-9636 | critical | CVE-2019-9636: Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handl |
SENTIMENT · TRUSTED SOURCES
synthesissevere-fallout-0.60
Incomplete fix for prior vulnerability led to new side-channel attack vector in widely used wireless security components.
synthesisneutral+0.00
No sentiment expressed; sources are CVE databases or generic advisories without commentary on vendor response.
synthesissevere-fallout-0.60
CVE-2020-27619 in Fedora's Python test suite used eval() on HTTP content, a severe security flaw that could allow remote code execution if exploited, though it was in test code and not production, sti
Neutral; Vulnedia is a CVE reference site with no commentary on vendor response.
Neutral; CVE Find is a database with no commentary on vendor response.
Neutral; OpenCVE is a CVE database with no commentary on vendor response.
Neutral; Secure Blink is a threat feed provider with no commentary on vendor response.
Incomplete remediation of prior CVE allowed new side-channel vulnerability in hostapd and wpa_supplicant.
"NOTE: this issue exists because of an incomplete fix for CVE-2019-9494."
Neutral; GitLab Advisory Database is a dependency scanning database with no commentary on vendor response.
Neutral; CVE database entry with no commentary on vendor handling.
Neutral; Fedora advisories page with no specific commentary on CVE-2022-23304.
CVE-2020-27619 was a critical vulnerability in Fedora's Python test suite using eval() on HTTP content, widely criticized for allowing potential remote code execution, though limited to test code.
"In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP."
No substantive coverage; only a technical error from a local bridge, providing no sentiment or stance toward Fedora.