Updated bluez packages fix security vulnerability: Adapter incorrectly restores Discoverable state after powered down (CVE-2021-3658). . MGASA-2021-0395 - Updated bluez packages fix security vulnerability Publication date: 06 Aug 2021 URL: https://advisories.mageia.org/MGASA-2021-0395.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-3658 Updated bluez packages fix security vulnerability: Adapter incorrectly restores Discoverable state after powered down (CVE-2021-3658). References: - https://bugs.mageia.org/show_bug.cgi?id=29323 - https://www.cve.org/CVERecord?id=CVE-2021-3658 SRPMS: - 8/core/bluez-5.55-3.2.mga8 . Fedora patches security flaw in openssl that impacts data encryption after system reboot.. bluez Update, Mageia Security, Security Patch, Package Security, Adapter Discoverability. . LinuxSecurity.com Team
This update fixes a bug where the adapter could be discoverable after turning it off and back on.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-ae7251c31b 2021-08-02 01:02:57.308713 --------------------------------------------------------------------------------Name : bluez Product : Fedora 34 Version : 5.60 Release : 2.fc34 URL : Summary : Bluetooth utilities Description : Utilities for use in Bluetooth applications: - avinfo - bluemoon - bluetoothctl - bluetoothd - btattach - btmon - hex2hcd - l2ping - l2test - mpris-proxy - rctest The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. --------------------------------------------------------------------------------Update Information: This update fixes a bug where the adapter could be discoverable after turning it off and back on. --------------------------------------------------------------------------------ChangeLog: * Tue Jul 27 2021 Bastien Nocera - 5.60-2 + bluez-5.60-2 - Fix for CVE-2021-3658 (rhbz#1986232) --------------------------------------------------------------------------------References: [ 1 ] Bug #1986232 - CVE-2021-3658 bluez: adapter incorrectly restores Discoverable state after powered down [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1986232 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-ae7251c31b' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
A security update is now available for Red Hat Single Sign-On 7.4.1 adapters for Red Hat JBoss Enterprise Application Platform 6 Red Hat Product Security has rated this update as having a security impact of. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: RH-SSO 7.4.1 adapters for Red Hat JBoss Enterprise Application Platform 6 Advisory ID: RHSA-2020:2816-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2020:2816 Issue date: 2020-07-02 CVE Names: CVE-2020-1714 ==================================================================== 1. Summary: A security update is now available for Red Hat Single Sign-On 7.4.1 adapters for Red Hat JBoss Enterprise Application Platform 6 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server - noarch Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server - noarch 3. Description: Packages: Red Hat Single Sign-On 7.4.1 adapters for Red Hat JBoss Enterprise Application Platform 6 Security Fix(es): * keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution (CVE-2020-1714) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed(https://bugzilla.redhat.com/): 1705975 - CVE-2020-1714 keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution 6. JIRA issues fixed (https://issues.redhat.com/): KEYCLOAK-13949 - Create RPMs for the RH-SSO 7.4.1 adapters for Red Hat JBoss Enterprise Application Platform 6 7. Package List: Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server: Source: keycloak-adapter-sso7_4-eap6-9.0.4-1.redhat_00001.1.ep6.el6.src.rpm noarch: keycloak-adapter-sso7_4-eap6-9.0.4-1.redhat_00001.1.ep6.el6.noarch.rpm keycloak-saml-adapter-sso7_4-eap6-9.0.4-1.redhat_00001.1.ep6.el6.noarch.rpm Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server: Source: keycloak-adapter-sso7_4-eap6-9.0.4-1.redhat_00001.1.ep6.el7.src.rpm noarch: keycloak-adapter-sso7_4-eap6-9.0.4-1.redhat_00001.1.ep6.el7.noarch.rpm keycloak-saml-adapter-sso7_4-eap6-9.0.4-1.redhat_00001.1.ep6.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2020-1714 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/ 9. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXv3vttzjgjWX9erEAQip+g//fUaBD88/9hlJWte4MlRqtgCZH1Bts3za Mad/Msagcj6UlFBHUg94bX6RItRornmSYDvspTUhQhAJ+9NEHlhBLBbxUB/p1rVf Y99XjUK6Z/p4HIgZYKid7P+3fGtWr8/RRClH3Zk2Po6XaQ7J0yZld0np94YFA5rm RiWX+6TBFVTNSommJzKxRU8fIkLtJ1JsL6yrUoc6KDIcHUuf01aZJINLpU+uYI5l z0P1QZG/Re94bnth6hO5Z0ykQxFRH2uKl52qzAmqBn3WZD2YpWz43SNcrWL8banM toLlBIGGP0XT4um/WE7RZrzGL3UeymF3p71sQ8A/VinIEygZyPB+Rkm4W0B3HJQd v+2ln4811QH/y0hRjAW9wS3d1G1zWLKBVy9jmCfEtm3FO0OdVXrhbaoIm/De63Gt Yx2jDPRinbEkkh2+whLflnwAvD8sIrgwlaobk5siCuRDr/5HzDzATjVWf6AGxdpq dWthvIQFHPlLUryUttcjFNVxLW8CxGfkT7OhsTCNVKoDdrIipNq12ulC2EDO5yk4 Hl2d14XP8u1qQ2zY6greVHZhinYkSH+d8SpKFOkmHmeKk/DI/xvJ5YSStFxtfGay Nv/DGhx0gETTZ8zA++rpGmubXlREX64greEemjF7V4nXW9U1gkJoa9dCta81YQXn XP76+/SEPWU=GwKJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sean Griffin discovered two vulnerabilities in the PostgreSQL adapter for Active Record which could lead to SQL injection. For the stable distribution (wheezy), these problems have been fixed in . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2982-1
Get the latest Linux and open source security news straight to your inbox.