RedHat: RHSA-2022-7692:01 Moderate: xmlrpc-c security update | Linu...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: xmlrpc-c security update
Advisory ID:       RHSA-2022:7692-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:7692
Issue date:        2022-11-08
CVE Names:         CVE-2021-46143 CVE-2022-22822 CVE-2022-22823 
                   CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 
                   CVE-2022-22827 
=====================================================================

1. Summary:

An update for xmlrpc-c is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode
its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide
a network protocol to allow a client program to make a simple RPC (remote
procedure call) over the Internet. It converts an RPC into an XML document,
sends it to a remote server using HTTP, and gets back the response in XML.

Security Fix(es):

* expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)

* expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)

* expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)

* expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)

* expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)

* expat: Integer overflow in nextScaffoldPart in xmlparse.c
(CVE-2022-22826)

* expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.7 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2044455 - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
2044457 - CVE-2022-22822 expat: Integer overflow in addBinding in xmlparse.c
2044464 - CVE-2022-22823 expat: Integer overflow in build_model in xmlparse.c
2044467 - CVE-2022-22824 expat: Integer overflow in defineAttribute in xmlparse.c
2044479 - CVE-2022-22825 expat: Integer overflow in lookup in xmlparse.c
2044484 - CVE-2022-22826 expat: Integer overflow in nextScaffoldPart in xmlparse.c
2044488 - CVE-2022-22827 expat: Integer overflow in storeAtts in xmlparse.c

6. Package List:

Red Hat Enterprise Linux BaseOS (v. 8):

Source:
xmlrpc-c-1.51.0-8.el8.src.rpm

aarch64:
xmlrpc-c-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-apps-debuginfo-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-c++-debuginfo-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-client++-debuginfo-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-client-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-client-debuginfo-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-debuginfo-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-debugsource-1.51.0-8.el8.aarch64.rpm

ppc64le:
xmlrpc-c-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-apps-debuginfo-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-c++-debuginfo-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-client++-debuginfo-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-client-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-client-debuginfo-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-debuginfo-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-debugsource-1.51.0-8.el8.ppc64le.rpm

s390x:
xmlrpc-c-1.51.0-8.el8.s390x.rpm
xmlrpc-c-apps-debuginfo-1.51.0-8.el8.s390x.rpm
xmlrpc-c-c++-debuginfo-1.51.0-8.el8.s390x.rpm
xmlrpc-c-client++-debuginfo-1.51.0-8.el8.s390x.rpm
xmlrpc-c-client-1.51.0-8.el8.s390x.rpm
xmlrpc-c-client-debuginfo-1.51.0-8.el8.s390x.rpm
xmlrpc-c-debuginfo-1.51.0-8.el8.s390x.rpm
xmlrpc-c-debugsource-1.51.0-8.el8.s390x.rpm

x86_64:
xmlrpc-c-1.51.0-8.el8.i686.rpm
xmlrpc-c-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-apps-debuginfo-1.51.0-8.el8.i686.rpm
xmlrpc-c-apps-debuginfo-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-c++-debuginfo-1.51.0-8.el8.i686.rpm
xmlrpc-c-c++-debuginfo-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-client++-debuginfo-1.51.0-8.el8.i686.rpm
xmlrpc-c-client++-debuginfo-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-client-1.51.0-8.el8.i686.rpm
xmlrpc-c-client-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-client-debuginfo-1.51.0-8.el8.i686.rpm
xmlrpc-c-client-debuginfo-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-debuginfo-1.51.0-8.el8.i686.rpm
xmlrpc-c-debuginfo-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-debugsource-1.51.0-8.el8.i686.rpm
xmlrpc-c-debugsource-1.51.0-8.el8.x86_64.rpm

Red Hat CodeReady Linux Builder (v. 8):

aarch64:
xmlrpc-c-apps-debuginfo-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-c++-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-c++-debuginfo-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-client++-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-client++-debuginfo-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-client-debuginfo-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-debuginfo-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-debugsource-1.51.0-8.el8.aarch64.rpm
xmlrpc-c-devel-1.51.0-8.el8.aarch64.rpm

ppc64le:
xmlrpc-c-apps-debuginfo-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-c++-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-c++-debuginfo-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-client++-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-client++-debuginfo-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-client-debuginfo-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-debuginfo-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-debugsource-1.51.0-8.el8.ppc64le.rpm
xmlrpc-c-devel-1.51.0-8.el8.ppc64le.rpm

s390x:
xmlrpc-c-apps-debuginfo-1.51.0-8.el8.s390x.rpm
xmlrpc-c-c++-1.51.0-8.el8.s390x.rpm
xmlrpc-c-c++-debuginfo-1.51.0-8.el8.s390x.rpm
xmlrpc-c-client++-1.51.0-8.el8.s390x.rpm
xmlrpc-c-client++-debuginfo-1.51.0-8.el8.s390x.rpm
xmlrpc-c-client-debuginfo-1.51.0-8.el8.s390x.rpm
xmlrpc-c-debuginfo-1.51.0-8.el8.s390x.rpm
xmlrpc-c-debugsource-1.51.0-8.el8.s390x.rpm
xmlrpc-c-devel-1.51.0-8.el8.s390x.rpm

x86_64:
xmlrpc-c-apps-debuginfo-1.51.0-8.el8.i686.rpm
xmlrpc-c-apps-debuginfo-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-c++-1.51.0-8.el8.i686.rpm
xmlrpc-c-c++-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-c++-debuginfo-1.51.0-8.el8.i686.rpm
xmlrpc-c-c++-debuginfo-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-client++-1.51.0-8.el8.i686.rpm
xmlrpc-c-client++-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-client++-debuginfo-1.51.0-8.el8.i686.rpm
xmlrpc-c-client++-debuginfo-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-client-debuginfo-1.51.0-8.el8.i686.rpm
xmlrpc-c-client-debuginfo-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-debuginfo-1.51.0-8.el8.i686.rpm
xmlrpc-c-debuginfo-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-debugsource-1.51.0-8.el8.i686.rpm
xmlrpc-c-debugsource-1.51.0-8.el8.x86_64.rpm
xmlrpc-c-devel-1.51.0-8.el8.i686.rpm
xmlrpc-c-devel-1.51.0-8.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-46143
https://access.redhat.com/security/cve/CVE-2022-22822
https://access.redhat.com/security/cve/CVE-2022-22823
https://access.redhat.com/security/cve/CVE-2022-22824
https://access.redhat.com/security/cve/CVE-2022-22825
https://access.redhat.com/security/cve/CVE-2022-22826
https://access.redhat.com/security/cve/CVE-2022-22827
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY2pSTdzjgjWX9erEAQiDfRAAmj50JYZkSqq4Y57nQvXRqPdFwkfMdgR5
Vot+lbhYR4m2oFhZ0F6Ow4hi60EddVBoyULspeJky1ReuEDn2ou5iw9ScdHFs1nG
LF9Wjz+VSNr/619VhHsBRIjlMO7GRa3DYyjJ8LCFdOOcl5IJb6p5wGIQmkEaQo/5
K/kxbNW4XsuVu2p6JkI54pjTyiEoYFxnd2O+cb97aAcnyqxMexV463bkrOCJ0leU
JOVf4PXyRaCt5a2AawgJ3yDXhVGWnex+wotylt9F2gttOyLoAKbe73aOYCFszeA8
0z7Bb0GTyKX5OBQltrtJvt+m4bQvQPfTryEDQGeUQv4mnnsUvRkQ7BfoyRLDWuOd
IlV+PrQesSsUi3L3VjtZr0MJCNV6A1s7uqC8piac7n1Vrod/pY6ZOxrSUvzoSbgZ
XaVZ5Ay/n2TafyxxJ5iZCUm+FOtW28fH8VnTrZeQoLy9xLlAmSH+uS3EEiy+OsxI
nv73jUqWLIbgJGTcOgWg24BMmL+ICNaCOjBXkUuA5WGMfLMdtVTN1gKniJ2dPp6Y
qKJ4S8aUQ0Ecq0q7HkJ29zatTHystEo60HWOl54pMLQUjIGaITxWaY8aJcvCDQZ7
uOxWKJyMgNeyNZc7UYvZW0UFWnzXBtcwEjyZJDg3u3/IR8RU9ARX0cF73Fm40c5S
ZzcPNNMPHw0=
=wFwS
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-7692:01 Moderate: xmlrpc-c security update

An update for xmlrpc-c is now available for Red Hat Enterprise Linux 8

Summary

XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to a remote server using HTTP, and gets back the response in XML.
Security Fix(es):
* expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)
* expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)
* expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)
* expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)
* expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)
* expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)
* expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2021-46143 https://access.redhat.com/security/cve/CVE-2022-22822 https://access.redhat.com/security/cve/CVE-2022-22823 https://access.redhat.com/security/cve/CVE-2022-22824 https://access.redhat.com/security/cve/CVE-2022-22825 https://access.redhat.com/security/cve/CVE-2022-22826 https://access.redhat.com/security/cve/CVE-2022-22827 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index

Package List

Red Hat Enterprise Linux BaseOS (v. 8):
Source: xmlrpc-c-1.51.0-8.el8.src.rpm
aarch64: xmlrpc-c-1.51.0-8.el8.aarch64.rpm xmlrpc-c-apps-debuginfo-1.51.0-8.el8.aarch64.rpm xmlrpc-c-c++-debuginfo-1.51.0-8.el8.aarch64.rpm xmlrpc-c-client++-debuginfo-1.51.0-8.el8.aarch64.rpm xmlrpc-c-client-1.51.0-8.el8.aarch64.rpm xmlrpc-c-client-debuginfo-1.51.0-8.el8.aarch64.rpm xmlrpc-c-debuginfo-1.51.0-8.el8.aarch64.rpm xmlrpc-c-debugsource-1.51.0-8.el8.aarch64.rpm
ppc64le: xmlrpc-c-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-apps-debuginfo-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-c++-debuginfo-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-client++-debuginfo-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-client-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-client-debuginfo-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-debuginfo-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-debugsource-1.51.0-8.el8.ppc64le.rpm
s390x: xmlrpc-c-1.51.0-8.el8.s390x.rpm xmlrpc-c-apps-debuginfo-1.51.0-8.el8.s390x.rpm xmlrpc-c-c++-debuginfo-1.51.0-8.el8.s390x.rpm xmlrpc-c-client++-debuginfo-1.51.0-8.el8.s390x.rpm xmlrpc-c-client-1.51.0-8.el8.s390x.rpm xmlrpc-c-client-debuginfo-1.51.0-8.el8.s390x.rpm xmlrpc-c-debuginfo-1.51.0-8.el8.s390x.rpm xmlrpc-c-debugsource-1.51.0-8.el8.s390x.rpm
x86_64: xmlrpc-c-1.51.0-8.el8.i686.rpm xmlrpc-c-1.51.0-8.el8.x86_64.rpm xmlrpc-c-apps-debuginfo-1.51.0-8.el8.i686.rpm xmlrpc-c-apps-debuginfo-1.51.0-8.el8.x86_64.rpm xmlrpc-c-c++-debuginfo-1.51.0-8.el8.i686.rpm xmlrpc-c-c++-debuginfo-1.51.0-8.el8.x86_64.rpm xmlrpc-c-client++-debuginfo-1.51.0-8.el8.i686.rpm xmlrpc-c-client++-debuginfo-1.51.0-8.el8.x86_64.rpm xmlrpc-c-client-1.51.0-8.el8.i686.rpm xmlrpc-c-client-1.51.0-8.el8.x86_64.rpm xmlrpc-c-client-debuginfo-1.51.0-8.el8.i686.rpm xmlrpc-c-client-debuginfo-1.51.0-8.el8.x86_64.rpm xmlrpc-c-debuginfo-1.51.0-8.el8.i686.rpm xmlrpc-c-debuginfo-1.51.0-8.el8.x86_64.rpm xmlrpc-c-debugsource-1.51.0-8.el8.i686.rpm xmlrpc-c-debugsource-1.51.0-8.el8.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 8):
aarch64: xmlrpc-c-apps-debuginfo-1.51.0-8.el8.aarch64.rpm xmlrpc-c-c++-1.51.0-8.el8.aarch64.rpm xmlrpc-c-c++-debuginfo-1.51.0-8.el8.aarch64.rpm xmlrpc-c-client++-1.51.0-8.el8.aarch64.rpm xmlrpc-c-client++-debuginfo-1.51.0-8.el8.aarch64.rpm xmlrpc-c-client-debuginfo-1.51.0-8.el8.aarch64.rpm xmlrpc-c-debuginfo-1.51.0-8.el8.aarch64.rpm xmlrpc-c-debugsource-1.51.0-8.el8.aarch64.rpm xmlrpc-c-devel-1.51.0-8.el8.aarch64.rpm
ppc64le: xmlrpc-c-apps-debuginfo-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-c++-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-c++-debuginfo-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-client++-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-client++-debuginfo-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-client-debuginfo-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-debuginfo-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-debugsource-1.51.0-8.el8.ppc64le.rpm xmlrpc-c-devel-1.51.0-8.el8.ppc64le.rpm
s390x: xmlrpc-c-apps-debuginfo-1.51.0-8.el8.s390x.rpm xmlrpc-c-c++-1.51.0-8.el8.s390x.rpm xmlrpc-c-c++-debuginfo-1.51.0-8.el8.s390x.rpm xmlrpc-c-client++-1.51.0-8.el8.s390x.rpm xmlrpc-c-client++-debuginfo-1.51.0-8.el8.s390x.rpm xmlrpc-c-client-debuginfo-1.51.0-8.el8.s390x.rpm xmlrpc-c-debuginfo-1.51.0-8.el8.s390x.rpm xmlrpc-c-debugsource-1.51.0-8.el8.s390x.rpm xmlrpc-c-devel-1.51.0-8.el8.s390x.rpm
x86_64: xmlrpc-c-apps-debuginfo-1.51.0-8.el8.i686.rpm xmlrpc-c-apps-debuginfo-1.51.0-8.el8.x86_64.rpm xmlrpc-c-c++-1.51.0-8.el8.i686.rpm xmlrpc-c-c++-1.51.0-8.el8.x86_64.rpm xmlrpc-c-c++-debuginfo-1.51.0-8.el8.i686.rpm xmlrpc-c-c++-debuginfo-1.51.0-8.el8.x86_64.rpm xmlrpc-c-client++-1.51.0-8.el8.i686.rpm xmlrpc-c-client++-1.51.0-8.el8.x86_64.rpm xmlrpc-c-client++-debuginfo-1.51.0-8.el8.i686.rpm xmlrpc-c-client++-debuginfo-1.51.0-8.el8.x86_64.rpm xmlrpc-c-client-debuginfo-1.51.0-8.el8.i686.rpm xmlrpc-c-client-debuginfo-1.51.0-8.el8.x86_64.rpm xmlrpc-c-debuginfo-1.51.0-8.el8.i686.rpm xmlrpc-c-debuginfo-1.51.0-8.el8.x86_64.rpm xmlrpc-c-debugsource-1.51.0-8.el8.i686.rpm xmlrpc-c-debugsource-1.51.0-8.el8.x86_64.rpm xmlrpc-c-devel-1.51.0-8.el8.i686.rpm xmlrpc-c-devel-1.51.0-8.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2022:7692-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:7692
Issued Date: : 2022-11-08
CVE Names: CVE-2021-46143 CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827

Topic

An update for xmlrpc-c is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

2044455 - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c

2044457 - CVE-2022-22822 expat: Integer overflow in addBinding in xmlparse.c

2044464 - CVE-2022-22823 expat: Integer overflow in build_model in xmlparse.c

2044467 - CVE-2022-22824 expat: Integer overflow in defineAttribute in xmlparse.c

2044479 - CVE-2022-22825 expat: Integer overflow in lookup in xmlparse.c

2044484 - CVE-2022-22826 expat: Integer overflow in nextScaffoldPart in xmlparse.c

2044488 - CVE-2022-22827 expat: Integer overflow in storeAtts in xmlparse.c

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.