Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -1 articles for you...
98
security advisorydenial of serviceRed HatRed Hat 4.2.7 Moderate: RHSA-2022-5029-01 Eclipse Vert.x Denial Of Service
An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat build of Eclipse Vert.x 4.2.7 security update Advisory ID: RHSA-2022:5029-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2022:5029 Issue date: 2022-06-23 CVE Names: CVE-2020-36518 CVE-2022-25647 ==================================================================== 1. Summary: An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE pages listed in the References section. 2. Description: This release of Red Hat build of Eclipse Vert.x 4.2.7 GA includes security updates. For more information, see the release notes listed in the References section. Security Fix(es): * jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518) * com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson (CVE-2022-25647) For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a downloadlink for the update. You must be logged in to download the update. 4. Bugs fixed (https://bugzilla.redhat.com/): 2064698 - CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects 2080850 - CVE-2022-25647 com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson 5. References: https://access.redhat.com/security/cve/CVE-2020-36518 https://access.redhat.com/security/cve/CVE-2022-25647 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.eclipse.vertx&version=4.2.7 https://access.redhat.com/documentation/en-us/red_hat_build_of_eclipse_vert.x/4.2/html/release_notes_for_eclipse_vert.x_4.2/index 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYrRWD9zjgjWX9erEAQhySBAAlXKnG1+57IQ9cKGQWzpLWKFWJVqsyrGb hI/qVXa3T2DnslKYD061oBjY6FEBYwVqOrZLkv+9bSuW5CqdworRqzW+ozpPUJw4 1IKqO//OXQ/2UAB9FSKjhcyIB/d6af3urm47rtbeplt8WBF3fh4+Zo+sVxpTRbhX Kmy+z7YIEKkstR5AQR05mt9KHjpKkj4p2xMwtz3p+VJ0sff0O6gSMdA3oPKoSbms b43OhcBeiO5eqXryTgtIauRC2tzOk1lGryfDoWI24x4RFPhgK9r67Vv8r6j6psFi 6mBcJvzCpynJSnVOR75KQl9E3t7yuIJR14M6p+PndlcrncMg7S7nlhVvRgdun+Dj JuL5Kd8QDqu/UQiqLYCpCoZUkyDpg3ztVgR84Y0AFWMH7Q4o+K/dlWBwE1ejrxx0 klurqysi86Ra0UKwk5zzfvNi/r/Cm/7xdMliNrx8pozuZiFK4nW4y9a6Uvu7AH8v nA4cC5zeM9DWFntZiCn3bfigSRcTdZlfhnvk6Csgzu/HhYR9p2QGnY76ZSgaVq45 ptqT37TDFHFhJSKhR7GLxwrVogT5HjrHV3OMpH2P7p/pO7MkKJovDY+YG5xk1TB8 gdBYMYiSGhlIRrdIeoLGIkqcOs0cEP86+UO1yeYjvIssG6dArotiSJt3LTN/mLzf LEg430ARk3s=qurb -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Jun 23, 2022
Red Hat
89
security advisorysecurity updateFedoraFedora 35 Dotnet3.1 Security Update FEDORA-2022-62c0ec2d98
Upstream release notes: https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.25/3.1.25.md. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-62c0ec2d98 2022-06-05 01:26:55.202282 --------------------------------------------------------------------------------Name : dotnet3.1 Product : Fedora 35 Version : 3.1.419 Release : 1.fc35 URL : https://github.com/dotnet/ Summary : .NET Core Runtime and SDK Description : .NET Core is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET Core contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. --------------------------------------------------------------------------------Update Information: Upstream release notes: https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.25/3.1.25.md --------------------------------------------------------------------------------ChangeLog: * Thu May 26 2022 Omair Majid - 3.1.419-1 - Update to .NET SDK 3.1.419 and Runtime 3.1.25 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-62c0ec2d98' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list
Jun 04, 2022
•Important
Fedora
98
security advisorysecurity issueRed HatRed Hat Thorntail 2.7.2 RHSA-2020:5361-01 Important Security Fixes
An update is now available for Red Hat build of Thorntail. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat build of Thorntail 2.7.2 security and bug fix update Advisory ID: RHSA-2020:5361-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2020:5361 Issue date: 2020-12-16 CVE Names: CVE-2020-14299 CVE-2020-14338 CVE-2020-14340 CVE-2020-25638 CVE-2020-25649 ==================================================================== 1. Summary: An update is now available for Red Hat build of Thorntail. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section. 2. Description: This release of Red Hat build of Thorntail 2.7.2 includes security updates, bug fixes, and enhancements. For more information, see the release notes listed in the References section. Security Fix(es): * picketbox: JBoss EAP reload to admin-only mode allows authentication bypass (CVE-2020-14299) * xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS (CVE-2020-14340) * wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl (CVE-2020-14338) * hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used (CVE-2020-25638) * jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerableto XML external entity (XXE) (CVE-2020-25649) For more details about the security issues and their impact, the CVSS score, acknowledgements, and other related information, see the CVE pages listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. 4. Bugs fixed (https://bugzilla.redhat.com/): 1848533 - CVE-2020-14299 picketbox: JBoss EAP reload to admin-only mode allows authentication bypass 1860054 - CVE-2020-14338 wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl 1860218 - CVE-2020-14340 xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS 1881353 - CVE-2020-25638 hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used 1887664 - CVE-2020-25649 jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE) 5. References: https://access.redhat.com/security/cve/CVE-2020-14299 https://access.redhat.com/security/cve/CVE-2020-14338 https://access.redhat.com/security/cve/CVE-2020-14340 https://access.redhat.com/security/cve/CVE-2020-25638 https://access.redhat.com/security/cve/CVE-2020-25649 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.thorntail&version=2.7.2 https://access.redhat.com/documentation/en-us/red_hat_build_of_thorntail/2.7/html/release_notes_for_thorntail_2.7/ 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBX9m1btzjgjWX9erEAQhymw/9GVJAqvDxXMVLGHLycRkvz1TnlJ3SHVkV pKhYPMmvtYhqoEImQw/0+TRSdrMuhQ03S3rrYjD++Y/i/miBmhsMrM3LN2f42EN/ 6HAhBaN9DY4OsX2wVp5ZqrSDeI/YTueg2J5udOgdmtnwM7RmlWAqYYbuB7VFC4kA CL92g6fgsY3zhOyiHmWQRtptzgSVW2uzfiV1TGGTK2nlu53gh5X+D/sAZElv8UhZ pISFuShVc8BVC9xOGKdwW8EMIn+zJaK6lHDdB2JtGoHqUiAS1dDghcfKYBx0CeO/ V2GSu3cYnciKqEhkCZo5pYhvhw2OH5DSigRPcDCqvyJ8yD2i4qcaiqV+XPT0W9FS DF4P4DhQAir9JDgbFt7bU1pgzRPZSsZzDCdmJ5VVJRmT+L7NezjaVJV7gh3ifwVJ YXh5bwo45t5oIohZ8fEPIhtu6/mf9gDT5CUNUqj97mQ0XwTcwxyYNFb0EITWLws/ Nm84KrxPliKkmW8mfK9Zfps2L79UK/VRIInfgbQJgv3qEuVJnbzkiaZq6UE7Adct 7Rjsqb2saIDQzI1+zRV+UqCvy6V+4CYExhtNZfLiYkf7IFqFrptUpBzRIs7Qm77A s3bPjhfwWPJ8XDlp2Hgrao/Al5oulpqQVEIgXTffgpnkVM4K4KEbPtwIggZJ1YHW 0mkEgkalde0=tnio -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Dec 16, 2020
•Important
Red Hat
98
security advisorysecurity issueRed HatRed Hat: RHSA-2020:2905-01 Important: Thorntail Security Fix
An update is now available for Red Hat build of Thorntail. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat build of Thorntail 2.7.0 security and bug fix update Advisory ID: RHSA-2020:2905-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2020:2905 Issue date: 2020-07-23 CVE Names: CVE-2019-12423 CVE-2019-17573 CVE-2020-1695 CVE-2020-1697 CVE-2020-1698 CVE-2020-1714 CVE-2020-1718 CVE-2020-1719 CVE-2020-1724 CVE-2020-1727 CVE-2020-1732 CVE-2020-1744 CVE-2020-1745 CVE-2020-1757 CVE-2020-6950 CVE-2020-10688 CVE-2020-10705 CVE-2020-10719 ==================================================================== 1. Summary: An update is now available for Red Hat build of Thorntail. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section. 2. Description: This release of Red Hat build of Thorntail 2.7.0 includes security updates, bug fixes, and enhancements. For more information, see the release notes listed in the References section. Security Fix(es): * Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain (CVE-2020-1719) * cxf: reflected XSS in the services listing page (CVE-2019-17573) * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745) * Mojarra: Path traversal via eitherthe loc parameter or the con parameter, incomplete fix of CVE-2018-14371 (CVE-2020-6950) * resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class (CVE-2020-1695) * undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass (CVE-2020-1757) * keycloak: stored XSS in client settings via application links (CVE-2020-1697) * keycloak: problem with privacy after user logout (CVE-2020-1724) * keycloak: Password leak by logged exception in HttpMethod class (CVE-2020-1698) * cxf: OpenId Connect token service does not properly validate the clientId (CVE-2019-12423) * Soteria: security identity corruption across concurrent threads (CVE-2020-1732) * keycloak: missing input validation in IDP authorization URLs (CVE-2020-1727) * keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP (CVE-2020-1744) * keycloak: security issue on reset credential flow (CVE-2020-1718) * keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution (CVE-2020-1714) * RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack (CVE-2020-10688) * undertow: invalid HTTP request with large chunk size (CVE-2020-10719) * undertow: Memory exhaustion issue in HttpReadListener via "Expect: 100- continue" header (CVE-2020-10705) For more details about the security issues and their impact, the CVSS score, acknowledgements, and other related information, see the CVE pages listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. 4. Bugs fixed (https://bugzilla.redhat.com/): 1705975 - CVE-2020-1714 keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution 1730462 -CVE-2020-1695 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class 1752770 - CVE-2020-1757 undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass 1790292 - CVE-2020-1698 keycloak: Password leak by logged exception in HttpMethod class 1791538 - CVE-2020-1697 keycloak: stored XSS in client settings via application links 1796617 - CVE-2020-1719 Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain 1796756 - CVE-2020-1718 keycloak: security issue on reset credential flow 1797006 - CVE-2019-12423 cxf: OpenId Connect token service does not properly validate the clientId 1797011 - CVE-2019-17573 cxf: reflected XSS in the services listing page 1800527 - CVE-2020-1724 keycloak: problem with privacy after user logout 1800573 - CVE-2020-1727 keycloak: missing input validation in IDP authorization URLs 1801726 - CVE-2020-1732 Soteria: security identity corruption across concurrent threads 1803241 - CVE-2020-10705 undertow: Memory exhaustion issue in HttpReadListener via "Expect: 100-continue" header 1805006 - CVE-2020-6950 Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371 1805792 - CVE-2020-1744 keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP 1807305 - CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability 1814974 - CVE-2020-10688 RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack 1828459 - CVE-2020-10719 undertow: invalid HTTP request with large chunk size 5.References: https://access.redhat.com/security/cve/CVE-2019-12423 https://access.redhat.com/security/cve/CVE-2019-17573 https://access.redhat.com/security/cve/CVE-2020-1695 https://access.redhat.com/security/cve/CVE-2020-1697 https://access.redhat.com/security/cve/CVE-2020-1698 https://access.redhat.com/security/cve/CVE-2020-1714 https://access.redhat.com/security/cve/CVE-2020-1718 https://access.redhat.com/security/cve/CVE-2020-1719 https://access.redhat.com/security/cve/CVE-2020-1724 https://access.redhat.com/security/cve/CVE-2020-1727 https://access.redhat.com/security/cve/CVE-2020-1732 https://access.redhat.com/security/cve/CVE-2020-1744 https://access.redhat.com/security/cve/CVE-2020-1745 https://access.redhat.com/security/cve/CVE-2020-1757 https://access.redhat.com/security/cve/CVE-2020-6950 https://access.redhat.com/security/cve/CVE-2020-10688 https://access.redhat.com/security/cve/CVE-2020-10705 https://access.redhat.com/security/cve/CVE-2020-10719 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.thorntail&version=2.7.0 https://access.redhat.com/documentation/en-us/red_hat_build_of_thorntail/2.7/html/release_notes_for_thorntail_2.7/ 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXxk2rdzjgjWX9erEAQjSbQ//e0FG83JQFpQV7HUEsjPMB7+tT0UgoTXQ KnfasEPEP7wnPU07lZiVW94sxhUC/hAhce1KWIR3nT3uesMO4S+7o2vmgOwax1G7 yYsG1SRX4KK5Ma7Qvyx8lM+6TN0MNNrXGvFsqcYF1pJBL/1tfZfb/ciiqjrsR0Tp v20FKuNrNmn4IPRzN04AZafOG9tXQ8XMqkJaWxh8s4dupvElG4ywmYletwYLYMxS 5X+SVmQ9TtGSgJF6HUGoL0wsTbMtdlJPRrchhbjzAi00ZY5hElVa+MOzdyCFYygv ev0iz9m0foF1bXfbJTfpzbOnz/f3uJUTKCzz+mLf3voeqbvXnzUNn74MXZQynR8G LNFVpLo0U/d0wULkSSdFjqer+IxeUWRwcl2km1U42f+0BiCb4K3uHIjhkfAdRFFQ 7K8Nl/2GfJnLywD8693xSKi/6MeCHC2HhrYb9A89lXoebX/3WXkNUC4ReGL80+fg 3z7793xt6QzV9V+WOH8NbQS4SzpAOkusHMew7sQpLxU8r9uaF1KibshjUGq/rZlA YswTjYHqNLja7kx8GDejpO/RAhMq6asm38YtFzY+Qtipe8xcAxSrTiO6FLN+Xv0M YlvsaeWblymoLwbQ5ON59VoFFe1YgzIQP0CJEbWbnJl0UHdIldAbv22e4Trnw58t ZwsJot3fnjU=2k8f -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Jul 23, 2020
•Important
Red Hat
98
security advisoryred hatbug fixRedHat: RHSA-2020:2367-01 Important Update For Spring Boot 2.1.13
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat support for Spring Boot 2.1.13 security and bug fix update Advisory ID: RHSA-2020:2367-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2020:2367 Issue date: 2020-06-04 CVE Names: CVE-2019-14888 CVE-2020-1745 CVE-2020-1935 CVE-2020-1938 ==================================================================== 1. Summary: An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-03-23. The advisory is informational only; no files in the release have changed.] 2. Description: Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform. This release of Red Hat support for Spring Boot 2.1.13 serves as a replacement for Red Hat support for Spring Boot 2.1.12, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section. Security Fix(es): * undertow: possible Denial Of Service (DOS) in Undertow HTTPserver listening on HTTPS (CVE-2019-14888) * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745) * tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability (CVE-2020-1938) * tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling (CVE-2020-1935) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1772464 - CVE-2019-14888 undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS 1806398 - CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability 1806835 - CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling 1807305 - CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability 5. References: https://access.redhat.com/security/cve/CVE-2019-14888 https://access.redhat.com/security/cve/CVE-2020-1745 https://access.redhat.com/security/cve/CVE-2020-1935 https://access.redhat.com/security/cve/CVE-2020-1938 https://access.redhat.com/security/updates/classification#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.13 https://docs.redhat.com/en/documentation/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/index 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXtjzItzjgjWX9erEAQhRnBAAgpEgqMeB96HzQIjlr/B0OO6906+Xsy+g r7JiPWF9UCcRZuD/2Lrt8RFSY9ethRdehQJ+oJs3yUhvo0wXRZ/hr1gDCGUooWme blKnhyf5+J4avq+fJFLkhZzPJzYTCAGMLe5Wt/+Ze9TsdscVTwTbrha7ZEzIwKGe 7D6+T3LW9H0t/jveVD3gr5KkUL0SObKhAUz3YYLacP9HM4OxncVCs5MxSut++bT9 ayhIwflDbdmXNsTjUujkIY+v6aLMmFH3NqvGcQ5lNxR5lbxWcllK4ekFnYFHTBB1 hdk3FWqcgSdhn1axKhDvtpRZGw1f3Tf+USaL7Z+6bVOQN3xnf195grSzj6ReNcJQ PxHNh9cF4+JSbYNVAIC7ynTDbPV6XV+gHDZozdDRGEFkd2jiFK+tlF5PK3/FYBmj FOpj5n+/1OSegHykq/VXl8bEGtzkTMwnxLe3N0axZcx+xsanxNtEYjstftkUhlg7 WmhxBIxrV8ZQkg9BC9yt9hm0weODFDJjeExkQ6a3bqh9amT51AnCxctS3HW51VRV 9JWrlD1llJAOqYk6CxpF8xv61my2apUJ3qvxPF5Ut3f9hDUdB7/X/RhHxp2NQqHj i5JDpi0RkxnILYejIYuQQYLMe1PqOFhBH8KgABI0rljgYG9A0McYef/LgOHrJztn BWRTdLg2CuQ=tT0B -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Jun 04, 2020
•Important
Red Hat
98
security advisorymoderatered hatRed Hat OpenShift Runtimes Update: RHSA-2018-2938 Moderate Security Issues
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat OpenShift Application Runtimes Thorntail 2.2.0 security & bug fix update Advisory ID: RHSA-2018:2938-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2018:2938 Issue date: 2018-10-17 CVE Names: CVE-2018-1047 CVE-2018-7489 ==================================================================== 1. Summary: An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat OpenShift Application Runtimes provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform. This release of RHOAR Thorntail 2.2.0 serves as a replacement for RHOAR WildFly Swarm 7.1.0, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section. Security Fix(es): * undertow: Path traversal in ServletResourceManager class (CVE-2018-1047) * jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to theCVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1528361 - CVE-2018-1047 undertow: Path traversal in ServletResourceManager class 1549276 - CVE-2018-7489 jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries 5. References: https://access.redhat.com/security/cve/CVE-2018-1047 https://access.redhat.com/security/cve/CVE-2018-7489 https://access.redhat.com/security/updates/classification#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.wildFly.swarm&version=2.2.0 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW8czrtzjgjWX9erEAQgCNw/9EbNNow/AzpCR+b2hL8LzCpu0dio6neYI tmVv5ITJS+lA/bA55tRRRr4T+AD4lwHoUrrdN8gRNbu81T/RMZfjupkQHunO1bYj 5n4e/0mGsxNEBlIR4XeLmdFVJfdaqfzz0IiBhvXME9UcSjJQxQlLYIK0sXceFaWp HATkczYlzh2b0J3cgSDnaDrcW4hbX17gsTLbIkb+qoct/ZJOQINgg1I1lpSveejj uSWxQuwGhlm/ciNDkmJAFPU/DjthkoXiKrLKWpca1YmBoNgL1hVxgyR7apiPW5wy PxgqkDnjmZ6XSCBZyL6n6WU9YTiBHgZpJ8SbJx7WjtCoGZbyUJPSR8T2fhi+0sS2 u+Aezzi1G8iyIhaVtVWAfsVORuIlgngntT7tH7PoZtE9MI8dAa6IDEEaBeBzbFP0 x5v+Ds9vPQo4KPe95hmHsCgyNt+moPnI2tICKHL4ppSiLp4UPCHyRH8xhTvIU/Bx kUdGTjMHK+Xr/pkSmo4qfZ2pVPf7n871MzlR75diCTQ6kJ8aoFcRtrLARw16sNsa cYIIQdWHfB6a/GFuqjSiuO/ev4pHQY6EOQiLZYyqpQ5YKn+aOzxp7DYm6x0m5xsM V5TYHi6CgwzEJWztnR5DU/cgAwVAe/qUD8Qyj3GymXFXs1e7UM9szNgSsul0zCHp eM1VeQQvvOo=x5e8 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Oct 17, 2018
•Important
Red Hat
98
security advisorysecurity issueDoS threatRed Hat OpenShift Moderate Advisory: RHSA-2018-1786-01 Jackson-Databind DoS
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat OpenShift Application Runtimes security and bug fix update Advisory ID: RHSA-2018:1786-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2018:1786 Issue date: 2018-06-04 CVE Names: CVE-2018-7489 ==================================================================== 1. Summary: An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat Openshift Application Runtimes provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform. The RHOAR Eclipse Vert.x 3.5.1 release serves as a replacement for RHOAR Eclipse Vert.x 3.4.2, and includes bug fixes and enhancements. For a detailed list of issues resolved in the community Eclipse Vert.x 3.5.1 release, see the release notes in the References section. Security Fix(es): * jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Beforeapplying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1549276 - CVE-2018-7489 jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries 5. JIRA issues fixed (https://redhat.atlassian.net/jira/projects): ENTVTX-155 - CVE-2018-7489 jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries [vertx-3.4.2] 6. References: https://access.redhat.com/security/cve/CVE-2018-7489 https://access.redhat.com/security/updates/classification#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.eclipse.vertx&version=3.5.1 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBWxUfs9zjgjWX9erEAQgiUBAAjTx7dgqLTOawfGm+r1rZftfPY+IX7tHG dy8M2emTiyKo8+zixguDg2O5NiC7lXtxDx1b0j7qACBAHmYYeKZdqOv9UPdMRrT6 f9SzH4RmhGedDaBhU/HV8TD+gqQJWJ12YxOax7oXg7J+GN4qXyIQQ7DG0wpAXHCG KDzD2MZyVoB8gji8MFBEr7KFV/g13U5+WhNsXARJGu1XPcuCl5GMGBV3SVIJ69HS SDT5Rb9QibHbTvbemlyU4ah9hAYj/c0oz6Dg8+8R5fLK/MeoqEVkZEtzE+ADW+MZ a0BMkq7u/2QImV3TI1NwhHKSnWv2FvPPF6D2nT3mgpq+Y4EjO5up8q18veQSYE9c xPdguFXcgQ9/DCKPYzMbvtldM9x5odChz2PTci9h/DPLn4OTbH2nrpILR+hR/SYa TrDYho/oNW8evjb69R+pfTI13khnSkeUQScBBPxusclwew8wqcNfQ0YeuQoaWD3n tmXc0TXLYWAijkcANVJZ6VB6HSR2WwviQN3jPLvZqGSN8zMdUnSk1CiFVNxaxc8r NVJ8llTG8EuJwT9ojtLx6ONfn9ZLlSvGpKSrVEQjJljTutVW79HQUYDTVPO81PjM XCB9oXObUnucC97/0Q2/3jaTpcemqM6pG8xQWTTaQJGYtGzGwhboilbY8wZdpTxR vhv8weeVXwE=T0Yq -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Jun 04, 2018
Red Hat
89
security advisorymoderatefedoraFedora 22: 2015-04-22 Moderate Xulrunner Update Vulnerability Fix
Update to new upstream - 37.0.2 Bookmark rebuild - Bug 1210474. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-6629 2015-04-22 16:55:48 -------------------------------------------------------------------------------- Name : xulrunner Product : Fedora 22 Version : 37.0.2 Release : 1.fc22 URL : Summary : XUL Runtime for Gecko Applications Description : XULRunner is a Mozilla runtime package that can be used to bootstrap XUL+XPCOM applications that are as rich as Firefox and Thunderbird. It provides mechanisms for installing, upgrading, and uninstalling these applications. XULRunner also provides libxul, a solution which allows the embedding of Mozilla technologies in other projects and products. -------------------------------------------------------------------------------- Update Information: Update to new upstream - 37.0.2 Bookmark rebuild - Bug 1210474 -------------------------------------------------------------------------------- References: [ 1 ] Bug #1210474 - Update fedora-bookmarks for Fedora 22 https://bugzilla.redhat.com/show_bug.cgi?id=1210474 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update xulrunner' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Apr 24, 2015
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!