Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
100
security advisorysoftware patchimportantSUSE: 2022:4150-1 Important: CNI Arbitrary Path Injection
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for cni ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4150-1 Rating: important References: #1181961 Cross-References: CVE-2021-20206 CVSS scores: CVE-2021-20206 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-20206 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise Module for Public Cloud 15 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server for SAP Applications 15 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cni fixes the following issues: - CVE-2021-20206: Fixed arbitrary path injection via type field in CNI configuration (bsc#1181961). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Public Cloud 15: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-2022-4150=1 Package List: - SUSE Linux Enterprise Module for Public Cloud 15 (x86_64): cni-0.7.1-150000.1.7.1 References: https://www.suse.com/security/cve/CVE-2021-20206.html https://bugzilla.suse.com/1181961 . SUSE Security Advisory on cnf addresses CVE-2021-20207 with critical assessment and setup guidelines. Maintain safety!. SUSE Security Update,CNI Fixes,Vulnerability Patching. . Severity: Important. LinuxSecurity.com Team
Nov 21, 2022
•Important
SuSE
98
security advisorymoderatesecurity updateRedHat: RHSA-2022-0492-01 Moderate: OpenShift Update, Threats Fixed
Red Hat OpenShift Container Platform release 4.7.43 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.7.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: OpenShift Container Platform 4.7.43 security update Advisory ID: RHSA-2022:0492-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2022:0492 Issue date: 2022-02-16 CVE Names: CVE-2021-3521 CVE-2021-4034 CVE-2021-20206 CVE-2022-20612 CVE-2022-20617 CVE-2022-21248 CVE-2022-21282 CVE-2022-21283 CVE-2022-21293 CVE-2022-21294 CVE-2022-21296 CVE-2022-21299 CVE-2022-21305 CVE-2022-21340 CVE-2022-21341 CVE-2022-21360 CVE-2022-21365 CVE-2022-23094 ==================================================================== 1. Summary: Red Hat OpenShift Container Platform release 4.7.43 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.7.43. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2022:0491 Space precludesdocumenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.7/html/release_notes/ocp-4-7-release-notes Security Fix(es): * containernetworking-cni: Arbitrary path injection via type field in CNI configuration (CVE-2021-20206) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. You may download the oc tool and use it to inspect release image metadata as follows: (For x86_64 architecture) $ oc adm release info quay.io/openshift-release-dev/ocp-release:4.7.43-x86_64 The image digest is sha256:45defc4b9ed55d539c50678387fe2d3e755c56f23afa210ea087b799d1138d48 (For s390x architecture) $ oc adm release info quay.io/openshift-release-dev/ocp-release:4.7.43-s390x The image digest is sha256:dc6363e8522ec44e852d2ab93209789a916b590d2185cffa1c4fb92d515376e9 (For ppc64le architecture) $ oc adm release info quay.io/openshift-release-dev/ocp-release:4.7.43-ppc64le The image digest is sha256:2bd16240cbc87f4d532bfae6d280742d986459a058a1f91f55f5b0e937f2cc03 All OpenShift Container Platform 4.7 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.7/html/updating_clusters/updating-cluster-cli 3. Solution: For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errataupdate: https://docs.redhat.com/en/documentation/openshift_container_platform/4.7/html/release_notes/ocp-4-7-release-notes Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.7/html/updating_clusters/updating-cluster-cli 4. Bugs fixed (https://bugzilla.redhat.com/): 1919391 - CVE-2021-20206 containernetworking-cni: Arbitrary path injection via type field in CNI configuration 2010831 - container_runtime_crio_operations_latency_microseconds does not have quantile anymore 2015427 - Backport CRI-O volume relabel skip for for super privileged containers2028967 - Whereabouts should reconcile stranded IP addresses 2034355 - The CNO should implement the Whereabouts IP reconciliation cron job 2042534 - Bump build-machinery-go for console-operator to pickup change in yaml-patch repository 2043677 - [OVN]After reboot egress node, lr-policy-list was not correct, some duplicate records or missed internal IPs 2046237 - aws-pod-identity-webhook go.mod version out of sync with build environment 5.References: https://access.redhat.com/security/cve/CVE-2021-3521 https://access.redhat.com/security/cve/CVE-2021-4034 https://access.redhat.com/security/cve/CVE-2021-20206 https://access.redhat.com/security/cve/CVE-2022-20612 https://access.redhat.com/security/cve/CVE-2022-20617 https://access.redhat.com/security/cve/CVE-2022-21248 https://access.redhat.com/security/cve/CVE-2022-21282 https://access.redhat.com/security/cve/CVE-2022-21283 https://access.redhat.com/security/cve/CVE-2022-21293 https://access.redhat.com/security/cve/CVE-2022-21294 https://access.redhat.com/security/cve/CVE-2022-21296 https://access.redhat.com/security/cve/CVE-2022-21299 https://access.redhat.com/security/cve/CVE-2022-21305 https://access.redhat.com/security/cve/CVE-2022-21340 https://access.redhat.com/security/cve/CVE-2022-21341 https://access.redhat.com/security/cve/CVE-2022-21360 https://access.redhat.com/security/cve/CVE-2022-21365 https://access.redhat.com/security/cve/CVE-2022-23094 https://access.redhat.com/security/updates/classification/#moderate 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYg0xBtzjgjWX9erEAQiAlBAAozNAeKxJTgirbSWX8t2CPf6HMqGHM5Fk wuPMlnOoTxO/2es1R6vvEUJD6fPFgOsZoL6/eiKQ/F/d9/zTEkFgcHDffvgAs03O FzeVluHPBz8r6H/aff1ARPlJr+tFL5Km8LH2vkAohIEOfv3DZbzrWipGlB96j8Sv 7iK43AoARgz+B3rxJEWeZSztCGM/0x4fV0xRp0AQzyOzXwo/1Iv6nXDxrc5E09mq UdlPSCuMw6yVoiI9Bpp4puK4munoohWX6Q6A65xKXaIaZV46E0SjaM0lijlkiPlh VBiCKVeTEzega5GBzKysMMr/kt8R9cnjkVNEdJi3TDltTn/BLHcZagpJRgDMspbx m5DGXCjo+V2u/KMmhTLzlksvV4LeR+ERpvh7J+ZnbHDS3/G6N2eFHu/W2i8t0OTh crHtqln+Q2sHwXI3Cr7W/eObDbH4/KMYa65qIKd3rzG4FrkCP3IBzzTOyJB7pmIM iTRhD0nMtsa6d5qkcPhPbYK/e2SV4OkCTOqfr/zsommaOhghyMDxNeoEp6ZvtxaG MXZW7dew+Wp38haggVj8erzMTsvodgzCzmgg2LE3BXVJbJjZyZKimKKnKCZqJSGX kQAB+1xkVFpy+nkZXD/RdT4feDTi9b2nRB2lFvlZ8v5YrQDHHLSapJnToqgrD1Or bz7RkQxhdAA=nbsc -----END PGP SIGNATURE----- -- RHSA-announce mailinglist
Feb 16, 2022
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!