by BlackRabbitZ
Für Drupal Core erscheint am Abend des Mittwochs, 20. Mai, ein dringendes Sicherheitsupdate. Admins sollten es zügig installieren.
CMS Drupal: Hochkritisches Drupal-Core-Update für den 20. Mai angekündigt
RabbitZ INFO
- -
- RabbitZ-CyberSecurity Community
- -
- Events
- -
- Eigene Labore
- -
- Cyber Broadcast
- -
- Eigene Skripte
- -
- Lernumgebungen
- -
- NEWS
- -
- Discord
- -
- Teamspeak 3 & 6
- -
- CyberQuiz
- -
- Ethical Hacking
- -
CMS Drupal: Hochkritisches Drupal-Core-Update für den 20. Mai angekündigt
Home / CMS Drupal: Hochkritisches Drupal-Core-Update für den 20. Mai angekündigt
Mai
20
20
Neuste News
- CVE-2024-36137 A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the –allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a „read-only“ file descriptor to change the owner and permissions of a file.
- Endlich billiger? Apple Music soll günstiges Einstiegs-Abo bekommen
- CVE-2024-22018 A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the –allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
- Acer Swift Air 14: MacBook-Neo-Konkurrent startet für ca. 800 Euro mit Wildcat Lake
- CVE-2017-3736 There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.