ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. Amazon Web Services · AMAZON · us-west-2 Changed list9 linked entries across history · in Other vendors Follow evidence and connection reasons
  2. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct user… Advisory content revised7 linked entries across history · in Security Follow evidence and connection reasons
  3. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. Advisory content revised7 linked entries across history · in Security Follow evidence and connection reasons
  4. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. Advisory content revised7 linked entries across history · in Security Follow evidence and connection reasons
  5. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursi… Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  6. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and singl… Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  7. undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to ea… Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  8. undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key… Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  9. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  10. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  11. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can… Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  12. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  13. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  14. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  15. Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution… Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  16. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep pe… Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  17. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data.… Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  18. undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supp… Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  19. undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin stri… Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  20. undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a… Advisory content revised6 linked entries across history · in Security Follow evidence and connection reasons
  21. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size lim… Advisory content revised5 linked entries across history · in Security Follow evidence and connection reasons
  22. undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more th… Advisory content revised5 linked entries across history · in Security Follow evidence and connection reasons
  23. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN l… Advisory content revised5 linked entries across history · in Security Follow evidence and connection reasons
  24. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise truste… Advisory content revised5 linked entries across history · in Security Follow evidence and connection reasons
  25. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses con… Advisory content revised5 linked entries across history · in Security Follow evidence and connection reasons
  26. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEA… Advisory content revised5 linked entries across history · in Security Follow evidence and connection reasons
  27. Amazon Web Services · EC2 · us-west-2 Changed list5 linked entries across history · in Other vendors Follow evidence and connection reasons
  28. fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default opti… Advisory content revised4 linked entries across history · in Security Follow evidence and connection reasons
  29. serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controllin… Advisory content revised4 linked entries across history · in Security Follow evidence and connection reasons
  30. Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influ… Advisory content revised4 linked entries across history · in Security Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 19:32 UTC · 274 of 275 readable · 270 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.