Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 494
Alerts This Week
Warning Icon 1 494

Stay Secure with the Latest Linux Advisories

Mageia Large Esm H800
Mageia

Mageia 10 tig Important Editor Command Injection Issue Advisory 2026-0287

Calendar White Jul 21, 2026
Important
Mageia Large Esm H900
Mageia

Mageia 10 mageia-theme Important Bugfix Security Fix 2026-0059

Calendar White Jul 21, 2026
Important
Debian Large Esm H900
Debian

Debian Linux Major Privilege Escalation Denial of Service Issues DSA-6393-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H800
openSUSE

openSUSE 2026-3139-1 sssd Important Privilege Escalation and Bypass

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE LibreOffice Important Security Issues and Updates 2026-3140-1

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu 20.04 Linux Kernel Critical Privilege Escalation Issues USN-8576-1

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H800
Ubuntu

Ubuntu 22.04 Linux Kernel Critical Issues Addressed USN-8575-1

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu 24.04 LTS Linux-GCP FIPS Major Threat Update 2026-8574-1

Calendar White Jul 21, 2026
Critical
Rockylinux Esm H900
Rocky

Rocky Linux webkit2gtk3 Important Security Issues RLSA-2026-42088

Calendar White Jul 21, 2026
Important
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 15 articles for you...
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisoryDoSUbuntu

Ubuntu 25.10 Perl Critical Denial of Service Fix USN-8467-2

Several security issues were fixed in Perl.. ========================================================================== Ubuntu Security Notice USN-8467-2 July 02, 2026 perl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 Summary: Several security issues were fixed in Perl. Software Description: - perl: Practical Extraction and Report Language Details: USN-8467-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 25.10. Original advisory details: It was discovered that Perl's Archive::Tar module incorrectly handled symlink and hardlink targets during extraction. An attacker could use this issue to read or overwrite arbitrary files outside the extraction directory. (CVE-2026-42496) It was discovered that Perl had a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2026-8376) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 libperl-dev 5.40.1-6ubuntu0.1 libperl5.40 5.40.1-6ubuntu0.1 perl 5.40.1-6ubuntu0.1 perl-base 5.40.1-6ubuntu0.1 perl-debug 5.40.1-6ubuntu0.1 perl-modules-5.40 5.40.1-6ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8467-2 https://ubuntu.com/security/notices/USN-8467-1 CVE-2026-42496, CVE-2026-8376 Package Information: https://launchpad.net/ubuntu/+source/perl/5.40.1-6ubuntu0.1 . Critical Perl security update for Ubuntu 25.10 addresses multiple issues including DoS and file access vulnerabilities.. Ubuntu Perl Update, Security Fix, Denial of Service, FileAccess Issues. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Jul 03, 2026 •Important Ubuntu
219
Ls Advisories Rockylinux Esm H240
Price Tag%201security advisoryimportantpath traversal

Rocky Linux RLSA-2026 perl-Archive-Tar Important Path Traversal Threat

Important: perl-Archive-Tar security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2026:30856", "synopsis": "Important: perl-Archive-Tar security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for perl-Archive-Tar.\nThis update affects Rocky Linux 9.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files.\n\nSecurity Fix(es):\n\n* perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 9"], "fixes": [{"ticket": "2481314", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "description": ""}], "cves": [{"name": "CVE-2026-42496", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496", "cvss3ScoringVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "cvss3BaseScore": "8.2", "cwe": "CWE-22"}], "references": [], "publishedAt": "2026-07-01T12:03:26.775911Z", "rpms": {"Rocky Linux 9": {"nvras": ["perl-Archive-Tar-0:2.38-6.el9_8.1.noarch.rpm", "perl-Archive-Tar-0:2.38-6.el9_8.1.src.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Important perl-Archive-Tar security update for Rocky Linux 9 addresses path traversal issue. Stay safe with updates.. Rocky Linux, Archive Tar, security update, important patch, file access flaw. . Severity:Important. LinuxSecurity.com Team

Calendar%202 Jul 01, 2026 •Important Rocky Linux
Banner 4 1028x280 1708121825 1771600306
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisoryUbuntuimportant

Ubuntu 22.04 OWSLib Important Info Exposure Vuln USN-8247-1 CVE-2023-27476

OWSLib could be made to expose sensitive information.. ========================================================================== Ubuntu Security Notice USN-8247-1 May 07, 2026 owslib vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: OWSLib could be made to expose sensitive information. Software Description: - owslib: Client library for Open Geospatial (OGC) web services Details: It was discovered that OWSLib did not properly disable entity resolution within its XML parser. An attacker could possibly use this issue to read arbitrary files via a crafted XML payload. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS python3-owslib 0.25.0-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS python3-owslib 0.19.1-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS python-owslib 0.16.0-1ubuntu0.1~esm1 Available with Ubuntu Pro python3-owslib 0.16.0-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS python-owslib 0.10.3-1ubuntu0.1~esm1 Available with Ubuntu Pro python3-owslib 0.10.3-1ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8247-1 CVE-2023-27476 . Ubuntu OWSLib security update fixes sensitive info exposure issue. Ensure systems are updated to prevent data leaks.. OWSLib security, Ubuntu update, file access, sensitive data, security fix. . Severity: Important.LinuxSecurity.com Team

Calendar%202 May 07, 2026 •Important Ubuntu
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisorycriticaldebian

Debian 11 node-tar Critical Memory Crash and Access Flaws DLA-4552-1

Multiple vulnerabilities have been discovered in node-tar, a Node.js module to read and write portable tar archives. CVE-2024-28863 Generating a large number of sub-folders can consume memory on the system and even crash the Node.js client within a few seconds using. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4552-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Daniel Leidert April 29, 2026 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : node-tar Version : 6.0.5+ds1+~cs11.3.9-1+deb11u3 CVE ID : CVE-2024-28863 CVE-2026-23745 CVE-2026-24842 CVE-2026-26960 CVE-2026-29786 CVE-2026-31802 Multiple vulnerabilities have been discovered in node-tar, a Node.js module to read and write portable tar archives. CVE-2024-28863 Generating a large number of sub-folders can consume memory on the system and even crash the Node.js client within a few seconds using a path with too many sub-folders inside. CVE-2026-23745 When preservePaths is false, the linkpath of Link (hardlink) and SymbolicLink entries fail to be sanitized, allowing malicious archives to bypass the extraction root restriction, leading to arbitrary file overwrites via hardlinks and symlink poisoning via absolute symlink targets. The fix for this issue introduces multiple of the following vulnerabilties. CVE-2026-24842 The security check for hardlink entries allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. CVE-2026-26960 An attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. CVE-2026-29786 Anattacker-controlled archive can create a hardlink that points outside the extraction directory by using a drive-relative link target. CVE-2026-31802 An attacker-controlled archive can create a hardlink that points outside the extraction directory by using a drive-relative link target. For Debian 11 bullseye, these problems have been fixed in version 6.0.5+ds1+~cs11.3.9-1+deb11u3. We recommend that you upgrade your node-tar packages. For the detailed security status of node-tar please refer to its security tracker page at: https://security-tracker.debian.org/tracker/node-tar Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Multiple critical vulnerabilities in node-tar fixed to prevent memory issues and unauthorized file access in Debian.. node-tar vulnerabilities, Debian LTS, security update, tar archive security. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Apr 29, 2026 •Critical Debian LTS
Banner 4 1028x280 1708121825 1771600306
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisoryUbuntuevolution-data-server

Ubuntu 25.10 USN-8055-1 Evolution Data Server Medium File Removal Risk

Evolution Data Server could be made to remove files.. ========================================================================== Ubuntu Security Notice USN-8055-1 February 23, 2026 evolution-data-server vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Evolution Data Server could be made to remove files. Software Description: - evolution-data-server: Evolution suite data server Details: It was discovered that Evolution Data Server incorrectly handled removing local cache files. An attacker could possibly use this issue to cause Evolution Data Server to remove arbitrary files. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 evolution-data-server 3.56.2-3ubuntu0.1 evolution-data-server-common 3.56.2-3ubuntu0.1 libcamel-1.2-64t64 3.56.2-3ubuntu0.1 libebackend-1.2-11t64 3.56.2-3ubuntu0.1 libebook-1.2-21t64 3.56.2-3ubuntu0.1 libebook-contacts-1.2-4t64 3.56.2-3ubuntu0.1 libecal-2.0-3 3.56.2-3ubuntu0.1 libedata-book-1.2-27t64 3.56.2-3ubuntu0.1 libedata-cal-2.0-2t64 3.56.2-3ubuntu0.1 libedataserver-1.2-27t64 3.56.2-3ubuntu0.1 libedataserverui-1.2-4t64 3.56.2-3ubuntu0.1 libedataserverui4-1.0-0t64 3.56.2-3ubuntu0.1 Ubuntu 24.04 LTS evolution-data-server 3.52.3-0ubuntu1.2 evolution-data-server-common 3.52.3-0ubuntu1.2 libcamel-1.2-64t64 3.52.3-0ubuntu1.2 libebackend-1.2-11t64 3.52.3-0ubuntu1.2 libebook-1.2-21t64 3.52.3-0ubuntu1.2 libebook-contacts-1.2-4t64 3.52.3-0ubuntu1.2 libecal-2.0-3 3.52.3-0ubuntu1.2 libedata-book-1.2-27t64 3.52.3-0ubuntu1.2 libedata-cal-2.0-2t64 3.52.3-0ubuntu1.2 libedataserver-1.2-27t64 3.52.3-0ubuntu1.2 libedataserverui-1.2-4t64 3.52.3-0ubuntu1.2 libedataserverui4-1.0-0t64 3.52.3-0ubuntu1.2 Ubuntu 22.04 LTS evolution-data-server 3.44.4-0ubuntu1.2 evolution-data-server-common 3.44.4-0ubuntu1.2 libcamel-1.2-63 3.44.4-0ubuntu1.2 libebackend-1.2-10 3.44.4-0ubuntu1.2 libebook-1.2-20 3.44.4-0ubuntu1.2 libebook-contacts-1.2-3 3.44.4-0ubuntu1.2 libecal-2.0-1 3.44.4-0ubuntu1.2 libedata-book-1.2-26 3.44.4-0ubuntu1.2 libedata-cal-2.0-1 3.44.4-0ubuntu1.2 libedataserver-1.2-26 3.44.4-0ubuntu1.2 libedataserverui-1.2-3 3.44.4-0ubuntu1.2 After a standard system update you need to restart your session to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8055-1 CVE-2026-2604 Package Information: https://launchpad.net/ubuntu/+source/evolution-data-server/3.56.2-3ubuntu0.1 https://launchpad.net/ubuntu/+source/evolution-data-server/3.52.3-0ubuntu1.2 https://launchpad.net/ubuntu/+source/evolution-data-server/3.44.4-0ubuntu1.2 . Explore the Evolution Data Server issue allowing file removal with this Ubuntu update. Critical security patch needed!. Evolution Data Server, Ubuntu security patch, file access issue. . Severity: Medium. LinuxSecurity.com Team

Calendar%202 Feb 23, 2026 •Medium Ubuntu
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorycriticalUbuntu

Ubuntu 25.10 jaraco.context Critical File Overwrite Threat USN-7979-1

jaraco.context could be made to overwrite files.. ========================================================================== Ubuntu Security Notice USN-7979-1 January 27, 2026 jaraco.context vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 Summary: jaraco.context could be made to overwrite files. Software Description: - jaraco.context: context managers extending functionality of Python's contextlib Details: It was discovered that jaraco.context incorrectly handled certain zip file paths. An attacker could possibly use this issue to extract arbitrary files outside of the intented extraction directory. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 python3-jaraco.context 6.0.1-1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7979-1 CVE-2026-23949 Package Information: https://launchpad.net/ubuntu/+source/jaraco.context/6.0.1-1ubuntu0.1 . A critical file overwriting flaw in jaraco.context impacts Ubuntu 25.10. Immediate updates required to ensure security.. Ubuntu security, jaraco.context update, file access issues, Python context managers. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Jan 27, 2026 •Critical Ubuntu
Banner 4 1028x280 1708121825 1771600306
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisorysecurity issuered hat

Red Hat OpenStack Platform 13.0: RHSA-2023:1278-01 Critical Security Update

An update for openstack-nova is now available for Red Hat OpenStack Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenStack Platform (openstack-nova) security update Advisory ID: RHSA-2023:1278-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2023:1278 Issue date: 2023-03-15 CVE Names: CVE-2022-47951 ==================================================================== 1. Summary: An update for openstack-nova is now available for Red Hat OpenStack Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 13.0 - ELS - noarch Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server - noarch Red Hat OpenStack Platform 16.1 - noarch Red Hat OpenStack Platform 16.2 - noarch 3. Description: OpenStack Compute (codename Nova) is open source software designed to provision and manage large networks of virtual machines, creating a redundant and scalable cloud computing platform. It gives you the software, control panels, and APIs required to orchestrate a cloud, including running instances, managing networks, and controlling access through users and projects.OpenStack Compute strives to be both hardware and hypervisor agnostic, currently supporting a variety of standard hardware configurations and seven major hypervisors. Security Fix(es): * Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951) For more details about the securityissue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2161812 - CVE-2022-47951 openstack: Arbitrary file access through custom VMDK flat descriptor 6. Package List: Red Hat OpenStack Platform 13.0 - ELS: Source: python-oslo-utils-3.35.1-5.el7ost.src.rpm noarch: python-oslo-utils-lang-3.35.1-5.el7ost.noarch.rpm python2-oslo-utils-3.35.1-5.el7ost.noarch.rpm Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server: Source: openstack-nova-17.0.13-40.el7ost.src.rpm python-oslo-utils-3.35.1-5.el7ost.src.rpm noarch: openstack-nova-17.0.13-40.el7ost.noarch.rpm openstack-nova-api-17.0.13-40.el7ost.noarch.rpm openstack-nova-cells-17.0.13-40.el7ost.noarch.rpm openstack-nova-common-17.0.13-40.el7ost.noarch.rpm openstack-nova-compute-17.0.13-40.el7ost.noarch.rpm openstack-nova-conductor-17.0.13-40.el7ost.noarch.rpm openstack-nova-console-17.0.13-40.el7ost.noarch.rpm openstack-nova-migration-17.0.13-40.el7ost.noarch.rpm openstack-nova-network-17.0.13-40.el7ost.noarch.rpm openstack-nova-novncproxy-17.0.13-40.el7ost.noarch.rpm openstack-nova-placement-api-17.0.13-40.el7ost.noarch.rpm openstack-nova-scheduler-17.0.13-40.el7ost.noarch.rpm openstack-nova-serialproxy-17.0.13-40.el7ost.noarch.rpm openstack-nova-spicehtml5proxy-17.0.13-40.el7ost.noarch.rpm python-nova-17.0.13-40.el7ost.noarch.rpm python-nova-tests-17.0.13-40.el7ost.noarch.rpm python-oslo-utils-lang-3.35.1-5.el7ost.noarch.rpm python2-oslo-utils-3.35.1-5.el7ost.noarch.rpm Red Hat OpenStack Platform 13.0 -ELS: Source: openstack-nova-17.0.13-40.el7ost.src.rpm python-oslo-utils-3.35.1-5.el7ost.src.rpm noarch: openstack-nova-17.0.13-40.el7ost.noarch.rpm openstack-nova-api-17.0.13-40.el7ost.noarch.rpm openstack-nova-cells-17.0.13-40.el7ost.noarch.rpm openstack-nova-common-17.0.13-40.el7ost.noarch.rpm openstack-nova-compute-17.0.13-40.el7ost.noarch.rpm openstack-nova-conductor-17.0.13-40.el7ost.noarch.rpm openstack-nova-console-17.0.13-40.el7ost.noarch.rpm openstack-nova-migration-17.0.13-40.el7ost.noarch.rpm openstack-nova-network-17.0.13-40.el7ost.noarch.rpm openstack-nova-novncproxy-17.0.13-40.el7ost.noarch.rpm openstack-nova-placement-api-17.0.13-40.el7ost.noarch.rpm openstack-nova-scheduler-17.0.13-40.el7ost.noarch.rpm openstack-nova-serialproxy-17.0.13-40.el7ost.noarch.rpm openstack-nova-spicehtml5proxy-17.0.13-40.el7ost.noarch.rpm python-nova-17.0.13-40.el7ost.noarch.rpm python-nova-tests-17.0.13-40.el7ost.noarch.rpm python-oslo-utils-lang-3.35.1-5.el7ost.noarch.rpm python2-oslo-utils-3.35.1-5.el7ost.noarch.rpm Red Hat OpenStack Platform 13.0 - ELS: Source: python-oslo-utils-3.35.1-5.el7ost.src.rpm noarch: python-oslo-utils-lang-3.35.1-5.el7ost.noarch.rpm python2-oslo-utils-3.35.1-5.el7ost.noarch.rpm Red Hat OpenStack Platform 13.0 - ELS: Source: python-oslo-utils-3.35.1-5.el7ost.src.rpm noarch: python-oslo-utils-lang-3.35.1-5.el7ost.noarch.rpm python2-oslo-utils-3.35.1-5.el7ost.noarch.rpm Red Hat OpenStack Platform 13.0 - ELS: Source: python-oslo-utils-3.35.1-5.el7ost.src.rpm noarch: python-oslo-utils-lang-3.35.1-5.el7ost.noarch.rpm python2-oslo-utils-3.35.1-5.el7ost.noarch.rpm Red Hat OpenStack Platform16.1: Source: openstack-nova-20.4.1-1.20221005193231.1ee93b9.el8ost.src.rpm python-oslo-utils-3.41.6-1.20230130153634.f4deaad.el8ost.src.rpm noarch: openstack-nova-20.4.1-1.20221005193231.1ee93b9.el8ost.noarch.rpm openstack-nova-api-20.4.1-1.20221005193231.1ee93b9.el8ost.noarch.rpm openstack-nova-common-20.4.1-1.20221005193231.1ee93b9.el8ost.noarch.rpm openstack-nova-compute-20.4.1-1.20221005193231.1ee93b9.el8ost.noarch.rpm openstack-nova-conductor-20.4.1-1.20221005193231.1ee93b9.el8ost.noarch.rpm openstack-nova-console-20.4.1-1.20221005193231.1ee93b9.el8ost.noarch.rpm openstack-nova-migration-20.4.1-1.20221005193231.1ee93b9.el8ost.noarch.rpm openstack-nova-novncproxy-20.4.1-1.20221005193231.1ee93b9.el8ost.noarch.rpm openstack-nova-scheduler-20.4.1-1.20221005193231.1ee93b9.el8ost.noarch.rpm openstack-nova-serialproxy-20.4.1-1.20221005193231.1ee93b9.el8ost.noarch.rpm openstack-nova-spicehtml5proxy-20.4.1-1.20221005193231.1ee93b9.el8ost.noarch.rpm python-oslo-utils-lang-3.41.6-1.20230130153634.f4deaad.el8ost.noarch.rpm python3-nova-20.4.1-1.20221005193231.1ee93b9.el8ost.noarch.rpm python3-oslo-utils-3.41.6-1.20230130153634.f4deaad.el8ost.noarch.rpm Red Hat OpenStack Platform16.2: Source: openstack-nova-20.6.2-2.20221005185231.6786e96.el8ost.src.rpm python-oslo-utils-3.41.6-2.20230130154947.f4deaad.el8ost.src.rpm noarch: openstack-nova-20.6.2-2.20221005185231.6786e96.el8ost.noarch.rpm openstack-nova-api-20.6.2-2.20221005185231.6786e96.el8ost.noarch.rpm openstack-nova-common-20.6.2-2.20221005185231.6786e96.el8ost.noarch.rpm openstack-nova-compute-20.6.2-2.20221005185231.6786e96.el8ost.noarch.rpm openstack-nova-conductor-20.6.2-2.20221005185231.6786e96.el8ost.noarch.rpm openstack-nova-console-20.6.2-2.20221005185231.6786e96.el8ost.noarch.rpm openstack-nova-migration-20.6.2-2.20221005185231.6786e96.el8ost.noarch.rpm openstack-nova-novncproxy-20.6.2-2.20221005185231.6786e96.el8ost.noarch.rpm openstack-nova-scheduler-20.6.2-2.20221005185231.6786e96.el8ost.noarch.rpm openstack-nova-serialproxy-20.6.2-2.20221005185231.6786e96.el8ost.noarch.rpm openstack-nova-spicehtml5proxy-20.6.2-2.20221005185231.6786e96.el8ost.noarch.rpm python-oslo-utils-lang-3.41.6-2.20230130154947.f4deaad.el8ost.noarch.rpm python3-nova-20.6.2-2.20221005185231.6786e96.el8ost.noarch.rpm python3-oslo-utils-3.41.6-2.20230130154947.f4deaad.el8ost.noarch.rpm Red Hat OpenStack Platform 16.1: Source: python-oslo-utils-3.41.6-1.20230130153634.f4deaad.el8ost.src.rpm noarch: python-oslo-utils-lang-3.41.6-1.20230130153634.f4deaad.el8ost.noarch.rpm python3-oslo-utils-3.41.6-1.20230130153634.f4deaad.el8ost.noarch.rpm Red Hat OpenStack Platform 16.2: Source: python-oslo-utils-3.41.6-2.20230130154947.f4deaad.el8ost.src.rpm noarch: python-oslo-utils-lang-3.41.6-2.20230130154947.f4deaad.el8ost.noarch.rpm python3-oslo-utils-3.41.6-2.20230130154947.f4deaad.el8ost.noarch.rpm Red Hat OpenStack Platform 16.1: Source: python-oslo-utils-3.41.6-1.20230130153634.f4deaad.el8ost.src.rpm noarch: python-oslo-utils-lang-3.41.6-1.20230130153634.f4deaad.el8ost.noarch.rpm python3-oslo-utils-3.41.6-1.20230130153634.f4deaad.el8ost.noarch.rpm Red Hat OpenStack Platform16.2: Source: python-oslo-utils-3.41.6-2.20230130154947.f4deaad.el8ost.src.rpm noarch: python-oslo-utils-lang-3.41.6-2.20230130154947.f4deaad.el8ost.noarch.rpm python3-oslo-utils-3.41.6-2.20230130154947.f4deaad.el8ost.noarch.rpm Red Hat OpenStack Platform 16.2: Source: python-oslo-utils-3.41.6-2.20230130154947.f4deaad.el8ost.src.rpm noarch: python-oslo-utils-lang-3.41.6-2.20230130154947.f4deaad.el8ost.noarch.rpm python3-oslo-utils-3.41.6-2.20230130154947.f4deaad.el8ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-47951 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZBI1RtzjgjWX9erEAQiFTA/8DCpGWRVtF82+lBizwoswP091Zt+VGmCF KN7LNLDB6ruGPbz7pptYPCzsGIpcYOTJ8Yq9kGdsO+uxiOpew/ipA/OEFKW1KD9Q 3RutwrGEyFDf4s9UFLfA1Hk8iq8P+r8mrgLhYSVY3mLJDT1URz9AKIwcP+YicpAT eOfjoVsriG8PBofQLPRhn/tEaoxhdL4Ygsrtrw2SdKJPys90A5x9dB4mTw7vvCcS wWjNKYZWskBPwd0yOHTOErVjDz2fU9aDtqn4sKGrbu3vB7VUZFNkrsMmFgBS6Tkd +uHJ/jWrhyT6HKPIGDSw0pC//vLjbETsPi2711DKsYKTdrzElUjqDJ0VepReY548 SZqtVT8tKlfdFiYDs1K0fQnpSJUph+T0Afam8zH3+KDNYWH8+cQnQZEqI+6rfnVX GIm1423Q+eU2AL5s5uVCIi24wcGzuJU2UC8zxkhkrOB1/kXr2tw4It2lT77u0Gi8 DvdNh2nAyxl51VfhgFWaRS6O3eaAF2GqVSjtOzwHx+3sl01dpxtfonlkFLw9GNBJ aDx0y+ifMgA4y6KpPnyRzFJYD3lVJRmGbe/lPey21X+bt5jOXcNuwjTptlviiUbv Q3GmPcQvqdieNx2KTbcHzexWQwz99Zhd0P4Y1iXszJ43nx8lxBM8HJes90t6oF3D 8mDXqkOVhBY=Qo2j -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Critical patch released for Red Hat OpenStack Platform concerning vulnerability in openstack-nova.. openstack platform, file access, red hat, important security update. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Mar 15, 2023 •Important Red Hat
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisorysecurity fixarbitrary file access

Red Hat OpenStack 16.2: RHSA-2023-1279-01 Important: Arbitrary File Access

An update for openstack-cinder is now available for Red Hat OpenStack Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Synopsis: Red Hat OpenStack Platform (openstack-cinder) security update Advisory ID: RHSA-2023:1279-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2023:1279 Issue date: 2023-03-15 CVE Names: CVE-2022-47951 ==================================================================== 1. Summary: An update for openstack-cinder is now available for Red Hat OpenStack Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 13.0 - ELS - noarch Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server - noarch Red Hat OpenStack Platform 16.1 - noarch Red Hat OpenStack Platform 16.2 - noarch 3. Description: Cinder is the replacement of nova-volume in Folsom and beyond, used for block storage. Security Fix(es): * Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2161812 -CVE-2022-47951 openstack: Arbitrary file access through custom VMDK flat descriptor 6. Package List: Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server: Source: openstack-cinder-12.0.10-27.el7ost.src.rpm noarch: openstack-cinder-12.0.10-27.el7ost.noarch.rpm python-cinder-12.0.10-27.el7ost.noarch.rpm Red Hat OpenStack Platform 13.0 - ELS: Source: openstack-cinder-12.0.10-27.el7ost.src.rpm noarch: openstack-cinder-12.0.10-27.el7ost.noarch.rpm python-cinder-12.0.10-27.el7ost.noarch.rpm Red Hat OpenStack Platform 16.1: Source: openstack-cinder-15.4.0-1.20230206163350.58f0e73.el8ost.src.rpm noarch: openstack-cinder-15.4.0-1.20230206163350.58f0e73.el8ost.noarch.rpm python3-cinder-15.4.0-1.20230206163350.58f0e73.el8ost.noarch.rpm Red Hat OpenStack Platform 16.2: Source: openstack-cinder-15.6.1-2.20221003154726.87578a0.el8ost.src.rpm noarch: openstack-cinder-15.6.1-2.20221003154726.87578a0.el8ost.noarch.rpm python3-cinder-15.6.1-2.20221003154726.87578a0.el8ost.noarch.rpm Red Hat OpenStack Platform 16.1: Source: openstack-cinder-15.4.0-1.20230206163350.58f0e73.el8ost.src.rpm noarch: openstack-cinder-15.4.0-1.20230206163350.58f0e73.el8ost.noarch.rpm python3-cinder-15.4.0-1.20230206163350.58f0e73.el8ost.noarch.rpm Red Hat OpenStack Platform 16.2: Source: openstack-cinder-15.6.1-2.20221003154726.87578a0.el8ost.src.rpm noarch: openstack-cinder-15.6.1-2.20221003154726.87578a0.el8ost.noarch.rpm python3-cinder-15.6.1-2.20221003154726.87578a0.el8ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-47951 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBZBI1Q9zjgjWX9erEAQgWHA//fDrcgA8DihNs3YVBif6Uom/9FjQADyGo 69Sk7Cv171AEls5gqs0GZ+8Yu06+C1j9gpU0a1NsAje0blNeI7x3tKKWY9oNRhMa 1brx1gbeRlzCCpGz4NHOmTX0Zime8cH90iGbkKYw3J8/uDzW0Sgxt6jhyxKaT6fr UvrPIzh8SvjJV/IhU0r3sHr2p70iVsDH/FrJUfJL+RzvJSxfQMbOqBwZ96LRcqaQ gLlGQ9ZVPIlFouOSjpWEA3vOae21aYBwdW6vg42sqLmQjUvNDfexmQCYC8N7DtHx H8/Ans6lxsdIpNnxTgX3sANSuESI7awjgaN0Bf+kPvGKVYCIIXadAbAssz0atl4N uJ4K7m/8SCbx6OZdWj+VmxwbtvirXEC8Ob2tDWF+Hpp0n45uWio0l7mbthYKQACz +0jJ9QkBLg6ujqbq90XeTZvPGXkKnIbdk2U2ovpNn0N788aMhxODwD0pzY5zn3lJ VkEvt3crqXjWRrLdOOpYFg27qlz4eXZyxQyLVgW6SUI9CQeOFk7yYvJCC44qK1JW 0XdXvw/S0Eo3ozVjf6qU8/HCZIfsYrjbVI+VAFstE97UXIQw0tN0mNHvqyB9Sr9d 5/8tg8LQx+pAhi6xYXsuQJyd19Zt/04HiG6SII250MaAaH575mgeocXqaFl3l6nU H5vEvvCYiaY=loIU -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Red Hat OpenStack Platform announces a critical patch for openstack-cinder to rectify major security vulnerabilities. Discover further details.. Red Hat OpenStack, security update, openstack-cinder, important advisory. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Mar 15, 2023 •Important Red Hat
Banner 4 1028x280 1708121825 1771600306
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics