Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Red Hat Quay 3.4.0 RHSA-2021:0420-02 Moderate Security Release

red hat
Calendar Grey February 4, 2021
Dist Redhat Esm H88
A crucial security patch for Red Hat Quay v3.4.0 is being released, tackling critical flaws within the software.
Red Hat Quay 3.4.0 is now available with bug fixes and various enhancements

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

Quay 3.4.0 release
Security Fix(es):
* waitress: HTTP request smuggling through LF vs CRLF handling (CVE-2019-16785)
* waitress: HTTP request smuggling through invalid Transfer-Encoding (CVE-2019-16786)
* waitress: HTTP Request Smuggling through Invalid whitespace characters in headers (CVE-2019-16789)
* python-pillow: Integer overflow leading to buffer overflow in ImagingLibTiffDecode (CVE-2020-5310)
* python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c (CVE-2020-5311)
* python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c (CVE-2020-5312)
* python-pillow: two buffer overflows in libImaging/TiffDecode.c due to small buffers allocated in ImagingLibTiffDecode() (CVE-2020-10379)
* python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2 (CVE-2020-11538)
* openstack-mistral: information disclosure in mistral log (CVE-2019-3866)
* python-pillow: uncontrolled resource consumption in FpxImagePlugin.py (CVE-2019-19911)
* PyYAML: command execution through python/object/apply constructor in FullLoader (CVE-2019-20477)
* python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images (CVE-2020-5313)
* yarn: Arbitrary filesystem write via tar expansion (CVE-2020-8131)
* golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)
* python-pillow: multiple out-of-bounds reads in libImaging/FliDecode.c (CVE-2020-10177)
* python-pillow: an out-of-bounds read in libImaging/PcxDecode.c can occur when reading PCX files (CVE-2020-10378)
* python-pillow: multiple out-of-bounds reads via a crafted JP2 file (CVE-2020-10994)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory moderate security update buffer overflow software fix information disclosure multiple threats Python HTTP smuggling Red Hat Quay

References

https://access.redhat.com/security/cve/CVE-2019-3866 https://access.redhat.com/security/cve/CVE-2019-16785 https://access.redhat.com/security/cve/CVE-2019-16786 https://access.redhat.com/security/cve/CVE-2019-16789 https://access.redhat.com/security/cve/CVE-2019-19911 https://access.redhat.com/security/cve/CVE-2019-20477 https://access.redhat.com/security/cve/CVE-2020-5310 https://access.redhat.com/security/cve/CVE-2020-5311 https://access.redhat.com/security/cve/CVE-2020-5312 https://access.redhat.com/security/cve/CVE-2020-5313 https://access.redhat.com/security/cve/CVE-2020-8131 https://access.redhat.com/security/cve/CVE-2020-10177 https://access.redhat.com/security/cve/CVE-2020-10378 https://access.redhat.com/security/cve/CVE-2020-10379 https://access.redhat.com/security/cve/CVE-2020-10994 https://access.redhat.com/security/cve/CVE-2020-11538 https://access.redhat.com/security/cve/CVE-2020-14040 https://access.redhat.com/security/updates/classification/#moderate

Package List


Advisory ID: RHSA-2021:0420-01
Product: Red Hat Quay
Advisory URL: https://access.redhat.com/errata/RHSA-2021:0420
Issue date: 2021-02-04

Topic

Red Hat Quay 3.4.0 is now available with bug fixes and variousenhancements.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate security update buffer overflow software fix information disclosure multiple threats Python HTTP smuggling Red Hat Quay

Relevant Releases Architectures

Bugs Fixed

1768731 - CVE-2019-3866 openstack-mistral: information disclosure in mistral log

1789532 - CVE-2020-5313 python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images

1789533 - CVE-2020-5312 python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c

1789535 - CVE-2020-5311 python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c

1789538 - CVE-2020-5310 python-pillow: Integer overflow leading to buffer overflow in ImagingLibTiffDecode

1789540 - CVE-2019-19911 python-pillow: uncontrolled resource consumption in FpxImagePlugin.py

1789807 - CVE-2019-16789 waitress: HTTP Request Smuggling through Invalid whitespace characters in headers1791415 - CVE-2019-16786 waitress: HTTP request smuggling through invalid Transfer-Encoding

1791420 - CVE-2019-16785 waitress: HTTP request smuggling through LF vs CRLF handling

1806005 - CVE-2019-20477 PyYAML: command execution through python/object/apply constructor in FullLoader

1816261 - CVE-2020-8131 yarn: Arbitrary filesystem write via tar expansion

1852814 - CVE-2020-11538 python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2

1852820 - CVE-2020-10994 python-pillow: multiple out-of-bounds reads via a crafted JP2 file

1852824 - CVE-2020-10177 python-pillow: multiple out-of-bounds reads in libImaging/FliDecode.c

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here