Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
98
security advisoryRed Hatsecurity fixRedHat: RHSA-2023-3246-01 Important: Git Security Issues Addressed
An update for git is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: git security update Advisory ID: RHSA-2023:3246-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:3246 Issue date: 2023-05-22 CVE Names: CVE-2023-22490 CVE-2023-23946 CVE-2023-25652 CVE-2023-25815 CVE-2023-29007 ==================================================================== 1. Summary: An update for git is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection. Security Fix(es): * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (CVE-2023-25652) *git: arbitrary configuration injection when renaming or deleting a section from a configuration file (CVE-2023-29007) * git: data exfiltration with maliciously crafted repository (CVE-2023-22490) * git: git apply: a path outside the working tree can be overwritten with crafted input (CVE-2023-23946) * git: malicious placement of crafted messages when git was compiled with runtime prefix (CVE-2023-25815) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2168160 - CVE-2023-22490 git: data exfiltration with maliciously crafted repository 2168161 - CVE-2023-23946 git: git apply: a path outside the working tree can be overwritten with crafted input 2188333 - CVE-2023-25652 git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents 2188337 - CVE-2023-25815 git: malicious placement of crafted messages when git was compiled with runtime prefix 2188338 - CVE-2023-29007 git: arbitrary configuration injection when renaming or deleting a section from a configuration file 6. Package List: Red Hat Enterprise Linux AppStream (v.8): Source: git-2.39.3-1.el8_8.src.rpm aarch64: git-2.39.3-1.el8_8.aarch64.rpm git-core-2.39.3-1.el8_8.aarch64.rpm git-core-debuginfo-2.39.3-1.el8_8.aarch64.rpm git-credential-libsecret-2.39.3-1.el8_8.aarch64.rpm git-credential-libsecret-debuginfo-2.39.3-1.el8_8.aarch64.rpm git-daemon-2.39.3-1.el8_8.aarch64.rpm git-daemon-debuginfo-2.39.3-1.el8_8.aarch64.rpm git-debuginfo-2.39.3-1.el8_8.aarch64.rpm git-debugsource-2.39.3-1.el8_8.aarch64.rpm git-subtree-2.39.3-1.el8_8.aarch64.rpm noarch: git-all-2.39.3-1.el8_8.noarch.rpm git-core-doc-2.39.3-1.el8_8.noarch.rpm git-email-2.39.3-1.el8_8.noarch.rpm git-gui-2.39.3-1.el8_8.noarch.rpm git-instaweb-2.39.3-1.el8_8.noarch.rpm git-svn-2.39.3-1.el8_8.noarch.rpm gitk-2.39.3-1.el8_8.noarch.rpm gitweb-2.39.3-1.el8_8.noarch.rpm perl-Git-2.39.3-1.el8_8.noarch.rpm perl-Git-SVN-2.39.3-1.el8_8.noarch.rpm ppc64le: git-2.39.3-1.el8_8.ppc64le.rpm git-core-2.39.3-1.el8_8.ppc64le.rpm git-core-debuginfo-2.39.3-1.el8_8.ppc64le.rpm git-credential-libsecret-2.39.3-1.el8_8.ppc64le.rpm git-credential-libsecret-debuginfo-2.39.3-1.el8_8.ppc64le.rpm git-daemon-2.39.3-1.el8_8.ppc64le.rpm git-daemon-debuginfo-2.39.3-1.el8_8.ppc64le.rpm git-debuginfo-2.39.3-1.el8_8.ppc64le.rpm git-debugsource-2.39.3-1.el8_8.ppc64le.rpm git-subtree-2.39.3-1.el8_8.ppc64le.rpm s390x: git-2.39.3-1.el8_8.s390x.rpm git-core-2.39.3-1.el8_8.s390x.rpm git-core-debuginfo-2.39.3-1.el8_8.s390x.rpm git-credential-libsecret-2.39.3-1.el8_8.s390x.rpm git-credential-libsecret-debuginfo-2.39.3-1.el8_8.s390x.rpm git-daemon-2.39.3-1.el8_8.s390x.rpm git-daemon-debuginfo-2.39.3-1.el8_8.s390x.rpm git-debuginfo-2.39.3-1.el8_8.s390x.rpm git-debugsource-2.39.3-1.el8_8.s390x.rpm git-subtree-2.39.3-1.el8_8.s390x.rpm x86_64: git-2.39.3-1.el8_8.x86_64.rpm git-core-2.39.3-1.el8_8.x86_64.rpm git-core-debuginfo-2.39.3-1.el8_8.x86_64.rpm git-credential-libsecret-2.39.3-1.el8_8.x86_64.rpm git-credential-libsecret-debuginfo-2.39.3-1.el8_8.x86_64.rpm git-daemon-2.39.3-1.el8_8.x86_64.rpm git-daemon-debuginfo-2.39.3-1.el8_8.x86_64.rpm git-debuginfo-2.39.3-1.el8_8.x86_64.rpm git-debugsource-2.39.3-1.el8_8.x86_64.rpm git-subtree-2.39.3-1.el8_8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2023-22490 https://access.redhat.com/security/cve/CVE-2023-23946 https://access.redhat.com/security/cve/CVE-2023-25652 https://access.redhat.com/security/cve/CVE-2023-25815 https://access.redhat.com/security/cve/CVE-2023-29007 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZGskp9zjgjWX9erEAQg+FA/9ElsjepUm1G9LAUK1Z4rK77+saJMiwDyW VClqHoJweTw11uxSliOiO+3v3pVkBZp9H/Ch4Fp4nH6ENdt3QURL6pzS+qjojnFz a2jsAINVuV5yQqk48n84XhWVYFpUb6Eg9mNve6x3R7dLazRkPoYlnaenAJNgAmKT Juuemw3158ZyU7fotKhe+wHO91/7x7hpSzNJaRWfVkeLb/jpuNQ6pnW2um+B0PBu haFl+GLrPbDbVujS71ptjRHOfj/JqjAQ4RZa+FyS2n7chIgErkFJ/+4pyaY4E1sm t7biFPMoRIHkfc3iUos7PipSMcI3YPUiLX/Xc2vkrU758jjwbT0MBUnYDVGyPUL0 lZW5O4LclwMAn2mStBZNTbLekgUxpmVFABwssmER9+u6PYx1gKBXStUrZScaAcjA k1j6kcaG+uOFGsBu8JkF31pCeCU/rSXET3Tp9iApzxWWP9dhzkO3/iUrbvhwC1Jw H+kG7HlFcS+7atzuiN08bBqz70a+ZuP4wa3q3daKdnSUT7fZoIvPoArfIXsjPrOM 8xdPCEqKgBuKxpOVK2E1iBcK+fuJTZd1btQHMK8tuDmOxZFlfVUtRuh6NoROAlpH 0SPgznJy1/S187DMTMzOoZidlWtQxE5aej8q6rgdgXBGOvj8DAa5yxfLnL0Zuq8s ma1yODuZXwg=etdf -----END PGP SIGNATURE----- -- RHSA-announce mailing list
May 22, 2023
•Important
Red Hat
98
security advisorysecurity impactnetwork serviceRed Hat OpenStack 13.0 RHSA-2021-3503-01 Critical dnsmasq Config Problem
An update for openstack-neutron is now available for Red Hat OpenStack Platform 13 (Queens). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenStack Platform 13.0 (openstack-neutron) security update Advisory ID: RHSA-2021:3503-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2021:3503 Issue date: 2021-09-13 CVE Names: CVE-2021-40085 ==================================================================== 1. Summary: An update for openstack-neutron is now available for Red Hat OpenStack Platform 13 (Queens). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 13.0 - ELS - noarch Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server - noarch 3. Description: Neutron is a virtual network service for OpenStack. Just like OpenStack Nova provides an API to dynamically request and configure virtual servers, Neutron provides an API to dynamically request and configure virtual networks. These networks connect "interfaces" from other OpenStack services (e.g., virtual NICs from Nova VMs). The Neutron API supports extensions to provide advanced network capabilities (e.g., QoS, ACLs, network, monitoring, etc.). Security Fix(es): * arbitrary dnsmasq reconfiguration via extra_dhcp_opts (CVE-2021-40085) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in theReferences section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1998052 - CVE-2021-40085 openstack-neutron: arbitrary dnsmasq reconfiguration via extra_dhcp_opts 6. Package List: Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server: Source: openstack-neutron-12.1.1-42.1.el7ost.src.rpm noarch: openstack-neutron-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-common-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-linuxbridge-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-macvtap-agent-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-metering-agent-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-ml2-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-openvswitch-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-rpc-server-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-sriov-nic-agent-12.1.1-42.1.el7ost.noarch.rpm python-neutron-12.1.1-42.1.el7ost.noarch.rpm Red Hat OpenStack Platform 13.0 - ELS: Source: openstack-neutron-12.1.1-42.1.el7ost.src.rpm noarch: openstack-neutron-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-common-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-linuxbridge-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-macvtap-agent-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-metering-agent-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-ml2-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-openvswitch-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-rpc-server-12.1.1-42.1.el7ost.noarch.rpm openstack-neutron-sriov-nic-agent-12.1.1-42.1.el7ost.noarch.rpm python-neutron-12.1.1-42.1.el7ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-40085 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hatsecurity contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYT8pz9zjgjWX9erEAQi2fA/9GInPUpeE/Z/wg2PzXfnVcJrhVpdf/JKZ etvyEnVsxQemEPrlFkzq6FZoNH2bB66azooPIK3ZvZWQoQeY2zZPYOob6M01g2nt 9t0/9VNR3rjQYsygDwYGTQ/M3Jlgx+5TiWz0FmNz/fPw4OxKcEzV8GrZ0auAhcCp UKWR2agbF1oqnsMo4lcPEY1K7dvWYPANpJiAQxb/1HrL5OrA8p7M8hfjeqQhur7s MaMoBcmV1vPr01Xr4HC8rqPeT1lgl6fJzbfIokNR/WW46p26LdXKpzpcpAceU3MQ PLpSSQZPfB2v+QDxVZeP4XeCEE8hoIjG2E+h/IVzf/CO1MB5CT5UUZtqAzmJoHKo 7SLhEz8czNJVF8NbooZYiBC6GbpJKauNwl5NnxVAZQEeTzR3GbCh0WPcdFO3vw8q dTXA50y26q1eDHfxQj7orJinbfvdvoC7IWJVfMu08kUxN0iheKa37UxD7FUHdaWK 6LH1zl0Mdm6HdrpC+sRKXsccMKzdwUSJBVXK85ohDpObze5K39WydYgxRb2rrCgb 4mdSMZTPO3l8VhrPw6EC6eLDPRpmD8s0nzQVuCBya1pdHJiEowSHjSD10jYzj7Ch XFvOe0biIcc7xzCV8kIfT66VePbQZKviSCW2vXtVpaVw0QgNjvzz35C4Armhv1sB Iex7MMh2m4E=hTCu -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 13, 2021
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!