ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Connected evidence

Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.

Saved searches 0

Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.

Threads

Related changes across sources
  1. The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 by… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  2. The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification. Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  3. In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field. Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  4. In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method. Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  5. The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  6. The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  7. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  8. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  9. follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a se… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  10. Impact: Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  11. Timing Side-Channel in AES-CCM Tag Verification in AWS-LC Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  12. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  13. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they re… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  14. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  15. CRL Distribution Point Scope Check Logic Error in AWS-LC Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  16. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  17. The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  18. Impact: Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  19. Impact: Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  20. kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without che… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  21. kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/jso… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  22. RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can ther… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  23. RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the de… Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  24. Impact: Advisory content revised2 linked entries across history · in Security Follow evidence and connection reasons
  25. OpenAI: Elevated ChatGPT Conversation Errors Service incident2 linked entries across history · in Other vendors Follow evidence and connection reasons
  26. Teamwork and communications (beta): 3 API change passages Graph announcement revised · 3 passages2 linked entries across history · in Identity & APIs Follow evidence and connection reasons
  27. Identity and access (beta): 7 API change passages Graph announcement revised · 7 passages2 linked entries across history · in Identity & APIs Follow evidence and connection reasons
  28. Device and app management (beta): 2 API change passages Graph announcement revised · 2 passages2 linked entries across history · in Identity & APIs Follow evidence and connection reasons
  29. Identity and access (v1.0): 1 API change passage Graph announcement revised · 1 passages2 linked entries across history · in Identity & APIs Follow evidence and connection reasons
  30. People and workplace intelligence (beta): 1 API change passage Graph announcement revised · 1 passages2 linked entries across history · in Identity & APIs Follow evidence and connection reasons
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 20:36 UTC · 274 of 275 readable · 270 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.