Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 492
Alerts This Week
Warning Icon 1 492

Stay Secure with the Latest Linux Advisories

Debian Large Esm H800
Debian

Debian Linux Major Privilege Escalation Denial of Service Issues DSA-6393-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE 2026-3139-1 sssd Important Privilege Escalation and Bypass

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE LibreOffice Important Security Issues and Updates 2026-3140-1

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H800
Ubuntu

Ubuntu 20.04 Linux Kernel Critical Privilege Escalation Issues USN-8576-1

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H900
Ubuntu

Ubuntu 22.04 Linux Kernel Critical Issues Addressed USN-8575-1

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu 24.04 LTS Linux-GCP FIPS Major Threat Update 2026-8574-1

Calendar White Jul 21, 2026
Critical
Rockylinux Esm H800
Rocky

Rocky Linux webkit2gtk3 Important Security Issues RLSA-2026-42088

Calendar White Jul 21, 2026
Important
Rockylinux Esm H900
Rocky

Rocky Linux glib2 Important Integer Underflow Threat RLSA-2026-42090

Calendar White Jul 21, 2026
Important
Debianlts Large Esm H900
Debian LTS

Debian LTS Samba Important Access Bypass Denial of Service DLA-4692-1

Calendar White Jul 21, 2026
Important
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 79 articles for you...
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisorycriticaldebian

Debian 9 Stretch DLA-2812-1 Critical Botan1.10 Cache Attack

One security issue has been discovered in botan1.10: a C++ cryptography library. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2812-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Anton Gladky November 08, 2021 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : botan1.10 Version : 1.10.17-1+deb9u1 CVE ID : CVE-2017-14737 One security issue has been discovered in botan1.10: a C++ cryptography library. An attacker of a local or a cross-VM may be able to recover bits of secret exponents as used in RSA, DH, etc. with help of cache analysis. https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/wang-shuai For Debian 9 stretch, this problem has been fixed in version 1.10.17-1+deb9u1. We recommend that you upgrade your botan1.10 packages. For the detailed security status of botan1.10 please refer to its security tracker page at: Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . An internal or remote adversary could leverage the cache leak vulnerability in botan1.10 to extract confidential values. Immediate upgrade suggested.. Debian Botan1.10, Cache Analysis, Cryptography Update. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Nov 08, 2021 •Critical Debian LTS
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryfedoraupdate

Fedora 31 mbedtls Update 2.16.7: Critical Cache Attack Notice

- Update to 2.16.7 Security advisory: . --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-5b60029fe2 2020-07-23 01:17:08.656086 --------------------------------------------------------------------------------Name : mbedtls Product : Fedora 31 Version : 2.16.7 Release : 1.fc31 URL : https://www.trustedfirmware.org/projects/mbed-tls/ Summary : Light-weight cryptographic and SSL/TLS library Description : Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. FOSS License Exception: https://www.trustedfirmware.org/projects/mbed-tls/ --------------------------------------------------------------------------------Update Information: - Update to 2.16.7 Security advisory: --------------------------------------------------------------------------------ChangeLog: * Tue Jul 14 2020 Morten Stevens - 2.16.7-1 - Update to 2.16.7 - Security Advisory 2020-07 --------------------------------------------------------------------------------References: [ 1 ] Bug #1851867 - CVE-2020-10941 mbedtls: cache attack against RSA key import in SGX https://bugzilla.redhat.com/show_bug.cgi?id=1851867 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-5b60029fe2' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . The recent update to Fedora's mbedtls tackles a significant vulnerability in RSA key importation, effectively addressing a severe cache attack in version 2.16.7.. Mbedtls Update, Fedora 31, Security Fix, RSA Cache Attack, Lightweight Cryptography. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Jul 22, 2020 •Critical Fedora
Banner 3 1028x280 1708121785 1771599793
202
Ls Advisories Opensuse Esm H240
Price Tag%201security advisorymoderatesecurity update

openSUSE Leap 15.1: 2019:1432-1 Moderate: OpenSSL TLS Cache Attack

An update that solves one vulnerability and has one errata is now available.. openSUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:1432-1 Rating: moderate References: #1117951 #1127080 Cross-References: CVE-2019-1559 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for openssl-1_0_0 fixes the following issues: Security issues fixed: - The 9 Lives of Bleichenbacher's CAT: Cache Attacks on TLS Implementations (bsc#1117951) - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-1432=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libopenssl-1_0_0-devel-1.0.2p-lp151.5.3.1 libopenssl1_0_0-1.0.2p-lp151.5.3.1 libopenssl1_0_0-debuginfo-1.0.2p-lp151.5.3.1 libopenssl1_0_0-hmac-1.0.2p-lp151.5.3.1 openssl-1_0_0-1.0.2p-lp151.5.3.1 openssl-1_0_0-cavs-1.0.2p-lp151.5.3.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-lp151.5.3.1 openssl-1_0_0-debuginfo-1.0.2p-lp151.5.3.1 openssl-1_0_0-debugsource-1.0.2p-lp151.5.3.1 - openSUSE Leap 15.1 (noarch): openssl-1_0_0-doc-1.0.2p-lp151.5.3.1 - openSUSE Leap 15.1 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-lp151.5.3.1 libopenssl1_0_0-32bit-1.0.2p-lp151.5.3.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-lp151.5.3.1 libopenssl1_0_0-hmac-32bit-1.0.2p-lp151.5.3.1 References: https://www.suse.com/security/cve/CVE-2019-1559.html https://bugzilla.suse.com/1117951 https://bugzilla.suse.com/1127080 -- . Installation of the security patch for OpenSSL 1.0.0 is crucial as it tackles a significant vulnerability in openSUSE Leap 15.1, along with detailed installation steps.. OpenSSL Security, openSUSE Update, Cache Attack Fix, TLS Security Issues. . LinuxSecurity.com Team

Calendar%202 May 21, 2019 OpenSUSE
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisoryimportantinformation disclosure

RedHat: RHSA-2019-1206-01 Important: rhvm-setup-plugins Side Channel Risk

An update for rhvm-setup-plugins is now available for Red Hat Virtualization 4.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: rhvm-setup-plugins security update Advisory ID: RHSA-2019:1206-01 Product: Red Hat Virtualization Advisory URL: https://access.redhat.com/errata/RHSA-2019:1206 Issue date: 2019-05-14 CVE Names: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 ==================================================================== 1. Summary: An update for rhvm-setup-plugins is now available for Red Hat Virtualization 4.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: RHV-M 4.2 - noarch 3. Description: The rhvm-setup-plugins package adds functionality exclusive only to Red Hat Virtualization Manager, and is not available for the upstream ovirt-engine. It includes the configuration of the Red Hat Support plugin, copying downstream-only artifacts to the ISO domain, and links to the knowledgebase and other support material. Security Fix(es): * A flaw was found in the implementation of the "fill buffer", a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130) * Modern Intelmicroprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126) * Microprocessors use a ‘load port’ subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPU’s pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127) * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 5. Bugs fixed (https://bugzilla.redhat.com/): 1646781 - CVE-2018-12126 hardware: Microarchitectural Store Buffer Data Sampling (MSBDS) 1646784 - CVE-2018-12130 hardware: Microarchitectural Fill Buffer Data Sampling (MFBDS) 1667782 - CVE-2018-12127 hardware: Micro-architectural Load Port Data Sampling -Information Leak (MLPDS) 1702717 - Upgrade rhvm-setup-plugins to 4.2.14 1705312 - CVE-2019-11091 hardware: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) 6. Package List: RHV-M 4.2: Source: rhvm-setup-plugins-4.2.14-1.el7ev.src.rpm noarch: rhvm-setup-plugins-4.2.14-1.el7ev.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-12126 https://access.redhat.com/security/cve/CVE-2018-12127 https://access.redhat.com/security/cve/CVE-2018-12130 https://access.redhat.com/security/cve/CVE-2019-11091 https://access.redhat.com/security/vulnerabilities/mds https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXNsvWtzjgjWX9erEAQjWJw/+NiOVyb6EWQ9XYpD5JwgZpBJsGAPQ68JH pumH9jpo6G/KtBYnNIg8vYfaITlAgmlvwwVo6ZJqC7vo7165tBSfmDISUwFWVySk T4ITPcbAiMclD/35SkbgNbpRFx4YJmndKlkdRb87cr3V8jU7Bvo7d8+u31g6nJPL 9E//qhPtyIIJxTlhjsNEvbvO3yJeRAt2RG+/AcsrRQxbk3WIk3I/q5MxU3HNdqwf 8R8EHq4+Nnm69xtovoTBFFl4ZHOiVnm5YVgXBANln1GaRWLSi3jF60pzawRgj8rW SKh4f+zk2M5VqqkIQykaAI2Heh6e0QSOUZEmKakUuyAOVDlV5H09FxDta/5ukXrg 6yn+koN04zaVutxhbxBwc0Y12zhpX7520o4Vt93x3BxPN+Z0O/E4u876UVxPhUDQ 4IFDQEm4DyRqnHU/BC/sQjUIrzDxtnW+9SxXy6iLuoYJrhT1Zy43l/gtDtkEkw+R k3YbQFRXs+qhQdd2FIWf1gX35eHkQ8a4U80e7AMzd2O8FEXEmK96jST7/BLeiIB3 Z1JMFy161CvmeeCzL1kkr804S5o+YOLMTJX8IhofuPV9ptTvs2izQoFymt/DpdnH C1xBrVVTj4/8OXJyw7gYHNXaMHnDd/WB+pUGFjiq3OFvvhjD4D6ODePEaiTUouc7 Ebm1z1lP5R0=dbMQ -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Red Hat Virtualization 4.2 security patch: Critical resolutions for rhvm-setup-utilities tackling several security vulnerabilities.. Red Hat Virtualization, rhvm-setup-plugins, security update,important fixes, microarchitectural attacks. . Severity: Important. LinuxSecurity.com Team

Calendar%202 May 14, 2019 •Important Red Hat
Banner 3 1028x280 1708121785 1771599793
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisoryRed Hatimportant

Red Hat Enterprise Linux 7.4: Important RHSA-2019-1184-01 libvirt Security

An update for libvirt is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: libvirt security update Advisory ID: RHSA-2019:1184-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:1184 Issue date: 2019-05-14 CVE Names: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 ==================================================================== 1. Summary: An update for libvirt is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux ComputeNode EUS (v. 7.4) - x86_64 Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4) - x86_64 Red Hat Enterprise Linux Server EUS (v. 7.4) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional EUS (v. 7.4) - ppc64, ppc64le, s390x, x86_64 3. Description: The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * A flaw was found in the implementation of the "fill buffer", a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively withincorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130) * Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126) * Microprocessors use a ‘load port’ subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPU’s pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127) * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, libvirtd will be restarted automatically. 5. Bugs fixed(https://bugzilla.redhat.com/): 1646781 - CVE-2018-12126 hardware: Microarchitectural Store Buffer Data Sampling (MSBDS) 1646784 - CVE-2018-12130 hardware: Microarchitectural Fill Buffer Data Sampling (MFBDS) 1667782 - CVE-2018-12127 hardware: Micro-architectural Load Port Data Sampling - Information Leak (MLPDS) 1705312 - CVE-2019-11091 hardware: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) 6. Package List: Red Hat Enterprise Linux ComputeNode EUS (v. 7.4): Source: libvirt-3.2.0-14.el7_4.13.src.rpm x86_64: libvirt-client-3.2.0-14.el7_4.13.i686.rpm libvirt-client-3.2.0-14.el7_4.13.x86_64.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.i686.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.x86_64.rpm libvirt-libs-3.2.0-14.el7_4.13.i686.rpm libvirt-libs-3.2.0-14.el7_4.13.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional EUS (v.7.4): x86_64: libvirt-3.2.0-14.el7_4.13.x86_64.rpm libvirt-admin-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-config-network-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-config-nwfilter-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-interface-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-lxc-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-network-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-nodedev-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-nwfilter-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-qemu-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-secret-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-core-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-disk-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-gluster-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-iscsi-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-logical-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-mpath-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-rbd-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-scsi-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-kvm-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-lxc-3.2.0-14.el7_4.13.x86_64.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.i686.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.x86_64.rpm libvirt-devel-3.2.0-14.el7_4.13.i686.rpm libvirt-devel-3.2.0-14.el7_4.13.x86_64.rpm libvirt-docs-3.2.0-14.el7_4.13.x86_64.rpm libvirt-lock-sanlock-3.2.0-14.el7_4.13.x86_64.rpm libvirt-login-shell-3.2.0-14.el7_4.13.x86_64.rpm libvirt-nss-3.2.0-14.el7_4.13.i686.rpm libvirt-nss-3.2.0-14.el7_4.13.x86_64.rpm Red Hat Enterprise Linux Server EUS (v.7.4): Source: libvirt-3.2.0-14.el7_4.13.src.rpm ppc64: libvirt-3.2.0-14.el7_4.13.ppc64.rpm libvirt-client-3.2.0-14.el7_4.13.ppc.rpm libvirt-client-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-config-network-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-config-nwfilter-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-interface-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-lxc-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-network-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-nodedev-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-nwfilter-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-qemu-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-secret-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-storage-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-storage-core-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-storage-disk-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-storage-iscsi-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-storage-logical-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-storage-mpath-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-driver-storage-scsi-3.2.0-14.el7_4.13.ppc64.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.ppc.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.ppc64.rpm libvirt-devel-3.2.0-14.el7_4.13.ppc.rpm libvirt-devel-3.2.0-14.el7_4.13.ppc64.rpm libvirt-docs-3.2.0-14.el7_4.13.ppc64.rpm libvirt-libs-3.2.0-14.el7_4.13.ppc.rpm libvirt-libs-3.2.0-14.el7_4.13.ppc64.rpm ppc64le: libvirt-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-client-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-config-network-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-config-nwfilter-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-interface-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-lxc-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-network-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-nodedev-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-nwfilter-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-qemu-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-secret-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-storage-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-storage-core-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-storage-disk-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-storage-iscsi-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-storage-logical-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-storage-mpath-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-driver-storage-scsi-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-kvm-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-devel-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-docs-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-libs-3.2.0-14.el7_4.13.ppc64le.rpm s390x: libvirt-3.2.0-14.el7_4.13.s390x.rpm libvirt-client-3.2.0-14.el7_4.13.s390.rpm libvirt-client-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-config-network-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-config-nwfilter-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-interface-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-lxc-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-network-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-nodedev-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-nwfilter-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-secret-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-storage-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-storage-core-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-storage-disk-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-storage-iscsi-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-storage-logical-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-storage-mpath-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-driver-storage-scsi-3.2.0-14.el7_4.13.s390x.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.s390.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.s390x.rpm libvirt-devel-3.2.0-14.el7_4.13.s390.rpm libvirt-devel-3.2.0-14.el7_4.13.s390x.rpm libvirt-docs-3.2.0-14.el7_4.13.s390x.rpm libvirt-libs-3.2.0-14.el7_4.13.s390.rpm libvirt-libs-3.2.0-14.el7_4.13.s390x.rpm x86_64: libvirt-3.2.0-14.el7_4.13.x86_64.rpm libvirt-client-3.2.0-14.el7_4.13.i686.rpm libvirt-client-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-config-network-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-config-nwfilter-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-interface-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-lxc-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-network-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-nodedev-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-nwfilter-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-qemu-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-secret-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-core-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-disk-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-gluster-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-iscsi-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-logical-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-mpath-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-rbd-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-driver-storage-scsi-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-kvm-3.2.0-14.el7_4.13.x86_64.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.i686.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.x86_64.rpm libvirt-devel-3.2.0-14.el7_4.13.i686.rpm libvirt-devel-3.2.0-14.el7_4.13.x86_64.rpm libvirt-docs-3.2.0-14.el7_4.13.x86_64.rpm libvirt-libs-3.2.0-14.el7_4.13.i686.rpm libvirt-libs-3.2.0-14.el7_4.13.x86_64.rpm Red Hat Enterprise Linux Server Optional EUS (v.7.4): ppc64: libvirt-admin-3.2.0-14.el7_4.13.ppc64.rpm libvirt-daemon-lxc-3.2.0-14.el7_4.13.ppc64.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.ppc.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.ppc64.rpm libvirt-lock-sanlock-3.2.0-14.el7_4.13.ppc64.rpm libvirt-login-shell-3.2.0-14.el7_4.13.ppc64.rpm libvirt-nss-3.2.0-14.el7_4.13.ppc.rpm libvirt-nss-3.2.0-14.el7_4.13.ppc64.rpm ppc64le: libvirt-admin-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-daemon-lxc-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-lock-sanlock-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-login-shell-3.2.0-14.el7_4.13.ppc64le.rpm libvirt-nss-3.2.0-14.el7_4.13.ppc64le.rpm s390x: libvirt-admin-3.2.0-14.el7_4.13.s390x.rpm libvirt-daemon-lxc-3.2.0-14.el7_4.13.s390x.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.s390.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.s390x.rpm libvirt-login-shell-3.2.0-14.el7_4.13.s390x.rpm libvirt-nss-3.2.0-14.el7_4.13.s390.rpm libvirt-nss-3.2.0-14.el7_4.13.s390x.rpm x86_64: libvirt-admin-3.2.0-14.el7_4.13.x86_64.rpm libvirt-daemon-lxc-3.2.0-14.el7_4.13.x86_64.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.i686.rpm libvirt-debuginfo-3.2.0-14.el7_4.13.x86_64.rpm libvirt-lock-sanlock-3.2.0-14.el7_4.13.x86_64.rpm libvirt-login-shell-3.2.0-14.el7_4.13.x86_64.rpm libvirt-nss-3.2.0-14.el7_4.13.i686.rpm libvirt-nss-3.2.0-14.el7_4.13.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2018-12126 https://access.redhat.com/security/cve/CVE-2018-12127 https://access.redhat.com/security/cve/CVE-2018-12130 https://access.redhat.com/security/cve/CVE-2019-11091 https://access.redhat.com/security/vulnerabilities/mds https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2019 Red Hat, Inc. -----BEGIN PGPSIGNATURE----- Version: GnuPG v1 iQIVAwUBXNsSodzjgjWX9erEAQj/3w//So1VcknJIPstdtULm08SltMzU/ylZLIL Ppm+qLTxVCOxwFPZqzVxGfIBbBNfMAvAPWwli3FRI+EM7Uv3tSW0fCyS0SpjgLdJ 19+4h9LD1uKIC/t+pM2PjEnVO3sJBhbwBM78qRrQjNE6uMCnkialhcDqz9K3zuLk Uk8LBitt+MJ4l/M0Q/VoEYGCxT0lSIBnsh5K4ASGKm6PEf3zos6E2kREuhD/YDYe SrO/y3c3ZsmqCFALSmh2jaMVwbZEr3WP6SNeKeBX6dFkt5cwJCMwU0mtFWs6tZt6 bFeTjM2Ydhw6HDr2UqiITQwoxF7K7pP+fKB6YTeKNBpsw7IhgYfN7ZLaGDM4LLgm CKsbCEsKFFJZybrjivLBR9A5FVfUsPsrw2idW6ZSu0PJQpGIp54M1jg2RdEyibwB Whg64i6Y42kIL6wm8aXgBxy6607SYepGRZnPUlLrm2ybj+2hApyoQnK1NMLkH7Sj AP6/K7S2CTmKr+X6SfhqGW/tPyYAbJEYMGGcWpyK8KaOEzTRTq+2w2jANBpYpOjP DSJ6PmBlhlMxKhwaJcHkki6f5daVfzeuh6atMbwijzbgSdh5mE63Yh7g7udbK098 t0/nOAWqdEdF51vkFHeOFltE0AqY2g8LharQCYJ8NephCgk1ZbelQJljxKawgqqv s6amgeBifZU=b2LT -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Crucial announcement regarding libvirt addressing major security vulnerabilities affecting Red Hat Enterprise Linux 7.4 platforms.. libvirt update, Red Hat security, data breach, security measures. . Severity: Important. LinuxSecurity.com Team

Calendar%202 May 14, 2019 •Important Red Hat
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisoryRed Hat Enterprise Linuximportant

RedHat: RHSA-2019-1176-01 Important: Kernel-RT Information Disclosure Risk

An update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: kernel-rt security update Advisory ID: RHSA-2019:1176-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:1176 Issue date: 2019-05-14 CVE Names: CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091 ==================================================================== 1. Summary: An update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Realtime (v. 7) - noarch, x86_64 Red Hat Enterprise Linux for Real Time for NFV (v. 7) - noarch, x86_64 3. Description: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * A flaw was found in the implementation of the "fill buffer", a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130) * Modern Intel microprocessorsimplement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126) * Microprocessors use a ‘load port’ subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPU’s pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127) * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1646781 - CVE-2018-12126 hardware: Microarchitectural Store Buffer Data Sampling (MSBDS) 1646784 - CVE-2018-12130 hardware: Microarchitectural Fill Buffer Data Sampling (MFBDS) 1667782 - CVE-2018-12127 hardware:Micro-architectural Load Port Data Sampling - Information Leak (MLPDS) 1705312 - CVE-2019-11091 hardware: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) 6. Package List: Red Hat Enterprise Linux for Real Time for NFV (v. 7): Source: kernel-rt-3.10.0-957.12.2.rt56.929.el7.src.rpm noarch: kernel-rt-doc-3.10.0-957.12.2.rt56.929.el7.noarch.rpm x86_64: kernel-rt-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-debug-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-debug-debuginfo-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-debug-devel-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-debug-kvm-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-debug-kvm-debuginfo-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-debuginfo-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-debuginfo-common-x86_64-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-devel-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-kvm-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-kvm-debuginfo-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-trace-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-trace-debuginfo-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-trace-devel-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-trace-kvm-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-trace-kvm-debuginfo-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm Red Hat Enterprise Linux Realtime (v.7): Source: kernel-rt-3.10.0-957.12.2.rt56.929.el7.src.rpm noarch: kernel-rt-doc-3.10.0-957.12.2.rt56.929.el7.noarch.rpm x86_64: kernel-rt-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-debug-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-debug-debuginfo-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-debug-devel-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-debuginfo-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-debuginfo-common-x86_64-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-devel-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-trace-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-trace-debuginfo-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm kernel-rt-trace-devel-3.10.0-957.12.2.rt56.929.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2018-12126 https://access.redhat.com/security/cve/CVE-2018-12127 https://access.redhat.com/security/cve/CVE-2018-12130 https://access.redhat.com/security/cve/CVE-2019-11091 https://access.redhat.com/security/vulnerabilities/mds https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXNsSXtzjgjWX9erEAQisChAAphgL0L4e6Xzk2h2pKJLR89eB0OxGes/0 h1lLwf2axpZuNcAfAnzkErQfb6t3Wh9VkYlOm3GuhjWwupxmqRnXLKUrz4efzHak hgcaVhXxq0av8/Jp4OGlMZdqIrbUC7ZQYzTa8vtCW2EBIzoIrWvkGerzOWdAzB3w uVYlN7zJ8wxgJgyRTrrVQBDb3LTu8oAZSZ5xeR1/kcz3pQ0+txEdZFXp5vDmWrhn INezukVZ8BVWaPRznAZS84CfZpe1WP5H29vTgYQxxuA+QZvIVP8NP24lTxIIL4e6 5abDRMrWvAp5AokKuMvBWpxCS7u8gPlTWD3Gz6QIhxq8bEgLObuERXZpkQ/3IbbG Sa96QIA5RwioIsrgzNx7uPsoq7QRFEkytZCircL0jTC+yZE5XCJve1jxydcm4hPc PhUOP06TRsPVDvntSug+g6zlPzYR5s/6wSZhShTCp6IYfrMgBjU3fzwFZyfOGuJ7 8Ny/M0dRHtodd+MF2zKRmNUKd4pVlGp1G9RzDirqh8Scln/YPTX9SViC5VP7l21N xUxh3Sq5xiGiqTiMYtfd2DkT/b8e+eytAcMbkmGwl8euG2sVGMZwKj64UjqmNO4M XGmOXhS18jBhXNzV32woFHec7jh/lo3q7ob51Wn9FhyTQlE7fQcf4iT8mnV5ZPxC RpDW4Jgil4w=AO2w -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Crucial update released for kernel-rt in Red Hat Enterprise Linux 7, addressing multiple vulnerabilities such as information exposure.. Red Hat, kernel-rt, security update, information disclosure, side-channel attack. . Severity: Important. LinuxSecurity.com Team

Calendar%202 May 14, 2019 •Important Red Hat
Banner 3 1028x280 1708121785 1771599793
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryFedorasecurity fix

Fedora 30 Security Advisory: Hostapd Cache Attacks and EAP-Pwd Issues

Update to version 2.7 from upstream Security fix for CVE-2019-9494 (cache attack against SAE) Security fix for CVE-2019-9495 (cache attack against EAP-pwd) Security fix for CVE-2019-9496 (SAE confirm missing state validation in hostapd/AP) Security fix for CVE-2019-9497 (EAP-pwd server not checking for reflection attack) Security fix for CVE-2019-9498 (EAP-pwd server missing commit. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-eba1109acd 2019-04-27 21:22:10.072127 --------------------------------------------------------------------------------Name : hostapd Product : Fedora 30 Version : 2.7 Release : 2.fc30 URL : http://w1.fi/hostapd/ Summary : IEEE 802.11 AP, IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator Description : hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd. --------------------------------------------------------------------------------Update Information: Update to version 2.7 from upstream Security fix for CVE-2019-9494 (cache attack against SAE) Security fix for CVE-2019-9495 (cache attack against EAP-pwd) Security fix for CVE-2019-9496 (SAE confirm missing state validation in hostapd/AP) Security fix for CVE-2019-9497 (EAP-pwd server not checking for reflection attack) Security fix for CVE-2019-9498 (EAP-pwd server missing commit validation for scalar/element) Security fix for CVE-2019-9499 (EAP-pwd peer missing commit validation for scalar/element) --------------------------------------------------------------------------------ChangeLog: * Fri Apr 12 2019 JohnW. Linville - 2.7-2 - Bump N-V-R for rebuild * Fri Apr 12 2019 John W. Linville - 2.7-1 - Update to version 2.7 from upstream - Remove obsolete patches for NL80211_ATTR_SMPS_MODE encoding and KRACK - Fix CVE-2019-9494 (cache attack against SAE) - Fix CVE-2019-9495 (cache attack against EAP-pwd) - Fix CVE-2019-9496 (SAE confirm missing state validation in hostapd/AP) - Fix CVE-2019-9497 (EAP-pwd server not checking for reflection attack) - Fix CVE-2019-9498 (EAP-pwd server missing commit validation for scalar/element) - Fix CVE-2019-9499 (EAP-pwd peer missing commit validation for scalar/element) --------------------------------------------------------------------------------References: [ 1 ] Bug #1699141 - CVE-2019-9494 wpa_supplicant: SAE Timing-based and Cache-based side-channel attack against WPA3's Dragonfly handshake https://bugzilla.redhat.com/show_bug.cgi?id=1699141 [ 2 ] Bug #1699149 - CVE-2019-9495 wpa_supplicant: EAP-pwd cache side-channel attack https://bugzilla.redhat.com/show_bug.cgi?id=1699149 [ 3 ] Bug #1699153 - CVE-2019-9496 hostapd: SAE confirm missing state validation in hostapd/AP https://bugzilla.redhat.com/show_bug.cgi?id=1699153 [ 4 ] Bug #1699164 - CVE-2019-9497 wpa_supplicant: EAP-pwd server not checking for reflection attack https://bugzilla.redhat.com/show_bug.cgi?id=1699164 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-eba1109acd' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announcemailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Security bulletin for Fedora 30 tackling vulnerabilities related to hostapd cache exploitation and EAP-pwd weaknesses, offering extensive solutions.. Hostapd Update, Fedora Security, Access Point Authentication, EAP-Pwd Server, Cache Attack. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Apr 27, 2019 •Critical Fedora
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryupdateFedora

Fedora 29: FEDORA-2019-f409af9fbe Moderate: Hostapd Cache Attacks

Update to version 2.7 from upstream Security fix for CVE-2019-9494 (cache attack against SAE) Security fix for CVE-2019-9495 (cache attack against EAP-pwd) Security fix for CVE-2019-9496 (SAE confirm missing state validation in hostapd/AP) Security fix for CVE-2019-9497 (EAP-pwd server not checking for reflection attack) Security fix for CVE-2019-9498 (EAP-pwd server missing commit. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-f409af9fbe 2019-04-23 20:13:25.293606 --------------------------------------------------------------------------------Name : hostapd Product : Fedora 29 Version : 2.7 Release : 2.fc29 URL : http://w1.fi/hostapd/ Summary : IEEE 802.11 AP, IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator Description : hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd. --------------------------------------------------------------------------------Update Information: Update to version 2.7 from upstream Security fix for CVE-2019-9494 (cache attack against SAE) Security fix for CVE-2019-9495 (cache attack against EAP-pwd) Security fix for CVE-2019-9496 (SAE confirm missing state validation in hostapd/AP) Security fix for CVE-2019-9497 (EAP-pwd server not checking for reflection attack) Security fix for CVE-2019-9498 (EAP-pwd server missing commit validation for scalar/element) Security fix for CVE-2019-9499 (EAP-pwd peer missing commit validation for scalar/element) --------------------------------------------------------------------------------ChangeLog: * Fri Apr 12 2019 JohnW. Linville - 2.7-2 - Bump N-V-R for rebuild * Fri Apr 12 2019 John W. Linville - 2.7-1 - Update to version 2.7 from upstream - Remove obsolete patches for NL80211_ATTR_SMPS_MODE encoding and KRACK - Fix CVE-2019-9494 (cache attack against SAE) - Fix CVE-2019-9495 (cache attack against EAP-pwd) - Fix CVE-2019-9496 (SAE confirm missing state validation in hostapd/AP) - Fix CVE-2019-9497 (EAP-pwd server not checking for reflection attack) - Fix CVE-2019-9498 (EAP-pwd server missing commit validation for scalar/element) - Fix CVE-2019-9499 (EAP-pwd peer missing commit validation for scalar/element) * Fri Feb 1 2019 Fedora Release Engineering - 2.6-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #1699141 - CVE-2019-9494 wpa_supplicant: SAE Timing-based and Cache-based side-channel attack against WPA3's Dragonfly handshake https://bugzilla.redhat.com/show_bug.cgi?id=1699141 [ 2 ] Bug #1699149 - CVE-2019-9495 wpa_supplicant: EAP-pwd cache side-channel attack https://bugzilla.redhat.com/show_bug.cgi?id=1699149 [ 3 ] Bug #1699153 - CVE-2019-9496 hostapd: SAE confirm missing state validation in hostapd/AP https://bugzilla.redhat.com/show_bug.cgi?id=1699153 [ 4 ] Bug #1699164 - CVE-2019-9497 wpa_supplicant: EAP-pwd server not checking for reflection attack https://bugzilla.redhat.com/show_bug.cgi?id=1699164 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-f409af9fbe' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Fedora 30 delivers essential security patches for libvirt to mitigate several vulnerability risks for improved system integrity.. hostapd Update, Fedora Security, Cache Attack Fixes, Authentication Server. . LinuxSecurity.com Team

Calendar%202 Apr 23, 2019 Fedora
Banner 3 1028x280 1708121785 1771599793
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics