Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
89
security advisoryFedoraTLSFedora 35: FEDORA-2021-eb3e3e87d3 Critical: OpenJDK 11 Security Fixes
# New in release OpenJDK 11.0.13 (2021-10-19): Live versions of these release notes can be found at: * https://mail.openjdk.org/pipermail/jdk-updates-dev/2021-October/009368.html * https://builds.shipilev.net/backports-monitor/release-notes-11.0.13.txt ## Security fixes - JDK-8163326, CVE-2021-35550: Update the default enabled cipher suites preference - JDK-8254967, CVE-2021-35565:. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-eb3e3e87d3 2021-10-29 22:48:33.394572 --------------------------------------------------------------------------------Name : java-11-openjdk Product : Fedora 35 Version : 11.0.13.0.8 Release : 1.fc35 URL : https://openjdk.org/ Summary : OpenJDK 11 Runtime Environment Description : The OpenJDK 11 runtime environment. --------------------------------------------------------------------------------Update Information: # New in release OpenJDK 11.0.13 (2021-10-19): Live versions of these release notes can be found at: * https://mail.openjdk.org/pipermail/jdk-updates-dev/2021-October/009368.html * https://builds.shipilev.net/backports-monitor/release-notes-11.0.13.txt ## Security fixes - JDK-8163326, CVE-2021-35550: Update the default enabled cipher suites preference - JDK-8254967, CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close - JDK-8263314: Enhance XML Dsig modes - JDK-8265167, CVE-2021-35556: Richer Text Editors - JDK-8265574: Improve handling of sheets - JDK-8265580, CVE-2021-35559: Enhanced style for RTF kit - JDK-8265776: Improve Stream handling for SSL - JDK-8266097, CVE-2021-35561: Better hashing support - JDK-8266103: Better specified spec values - JDK-8266109: More Resilient Classloading - JDK-8266115: More Manifest Jar Loading - JDK-8266137, CVE-2021-35564: Improve Keystore integrity - JDK-8266689, CVE-2021-35567: More Constrained Delegation - JDK-8267086: ArrayIndexOutOfBoundsException injava.security.KeyFactory.generatePublic -JDK-8267712: Better LDAP reference processing - JDK-8267729, CVE-2021-35578: Improve TLS client handshaking - JDK-8267735, CVE-2021-35586: Better BMP support - JDK-8268193: Improve requests of certificates - JDK-8268199: Correct certificate requests - JDK-8268205: Enhance DTLS client handshake -JDK-8268506: More Manifest Digests - JDK-8269618, CVE-2021-35603: Better session identification - JDK-8269624: Enhance method selection support -JDK-8270398: Enhance canonicalization - JDK-8270404: Better canonicalization ## Major Changes * [JDK-8271434](https://bugs.openjdk.org/browse/JDK-8271434): Removed IdenTrust Root Certificate * [JDK-8261922](https://bugs.openjdk.org/browse/JDK-8261922): Updated keytool to Create AKID From SKID of Issuing Certificate as Specified by RFC 5280 * [JDK-8210799](https://bugs.openjdk.org/browse/JDK-8210799): ChaCha20 and Poly1305 TLS Cipher Suites * [JDK-8219551](https://bugs.openjdk.org/browse/JDK-8219551): Updated the Default Enabled Cipher Suites Preference ## FIPS Mode Changes - The `SunPKCS11` provider in FIPS mode will now eagerly login to the NSS software token on initialisation - `keytool` in FIPS mode now supports importing plain private keys by the provider adding them to the NSS database. This can be disabled using `-Dcom.redhat.fips.plainKeySupport=false`. --------------------------------------------------------------------------------ChangeLog: * Wed Oct 13 2021 Andrew Hughes - 1:11.0.13.0.8-1 - Update to jdk-11.0.12.0+8 - Update release notes to 11.0.12.0+8 - Update tarball generation script to use git following OpenJDK 11u's move to github - Remove "-clean" suffix as no 11.0.13 builds are unclean. - Drop JDK-8269668 patch which is now applied upstream. - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.misc. - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false - Restructure the build so a minimal initial build is thenused for the final build (with docs) - This reduces pressure on the system JDK and ensures the JDK being built can do a full build * Tue Oct 5 2021 Martin Balao - 1:11.0.13.0.8-1 - Add patch to login to the NSS software token when in FIPS mode. - Add patch to allow plain key import. * Thu Sep 2 2021 Jiri Vanek - 1:11.0.13.0.8-1 - Added posttrans hook which persist sanity of dir-> symlink change in case of update from ancient versions - Minor cosmetic improvements to make spec more comparable between variants * Tue Aug 31 2021 Jiri Vanek - 1:11.0.12.0.7-3 - alternatives creation moved to posttrans - Thus fixing the old reisntall issue: - https://bugzilla.redhat.com/show_bug.cgi?id=1200302 - https://bugzilla.redhat.com/show_bug.cgi?id=1976053 * Mon Aug 9 2021 Andrew Hughes - 1:11.0.12.0.7-2 - Remove non-Free test from source tarball. * Wed Jul 28 2021 Severin Gehwolf - 1:11.0.12.0.7-1 - Add patch in order to fix java.library.path issue on aarch64 (JDK-8269668) - Resolves: rhbz#1977671 * Thu Jul 22 2021 Fedora Release Engineering - 1:11.0.12.0.7-0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild * Tue Jul 13 2021 Andrew Hughes - 1:11.0.12.0.7-0 - Update to jdk-11.0.12.0+7 - Update release notes to 11.0.12.0+7 - Switch to GA mode for final release. * Thu Jul 8 2021 Andrew Hughes - 1:11.0.12.0.6-0.0.ea - Update to jdk-11.0.12.0+6 - Update release notes to 11.0.12.0+6 - Skip 11.0.12.0+5 as 11.0.12.0+6 only adds a test change * Thu Jul 8 2021 Andrew Hughes - 1:11.0.12.0.4-0.0.ea - Update to jdk-11.0.12.0+4 - Update release notes to 11.0.12.0+4 - Correct bug ID JDK-8264846 to intended ID of JDK-8264848 * Mon Jul 5 2021 Andrew Hughes - 1:11.0.12.0.3-0.0.ea - Update to jdk-11.0.12.0+3 - Update release notes to 11.0.12.0+3 * Fri Jul 2 2021 Andrew Hughes - 1:11.0.12.0.2-0.1.ea - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics. - Remove restriction on disabling product build, as debugpackages no longer have javadoc packages. * Fri Jul 2 2021 Andrew Hughes - 1:11.0.12.0.2-0.0.ea - Update to jdk-11.0.12.0+2 - Update release notes to 11.0.12.0+2 * Mon Jun 28 2021 Andrew Hughes - 1:11.0.12.0.1-0.0.ea - Update to jdk-11.0.12.0+1 - Update release notes to 11.0.12.0+1 - Switch to EA mode for 11.0.12 pre-release builds. - Update ECC patch following JDK-8226374 (bug ID yet to be confirmed) * Tue Jun 8 2021 Andrew Hughes - 1:11.0.11.0.9-5 - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure. - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM. * Tue Jun 8 2021 Martin Balao - 1:11.0.11.0.9-5 - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library. * Wed Jun 2 2021 Andrew John Hughes - 1:11.0.11.0.9-4 - Update RH1655466 FIPS patch with changes in OpenJDK 8 version. - SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file. - Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg. - No need to substitute path to nss.fips.cfg as java.security file supports a java.home variable. - Disable FIPS mode support unless com.redhat.fips is set to "true". - Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable). - Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode - Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1915071) - Resolves: rhbz#1830090 * Wed Jun 2 2021 Martin Balao - 1:11.0.11.0.9-4 - Support the FIPS mode crypto policy (RH1655466) - Use appropriate keystore types when in FIPS mode (RH1818909) - Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use (RH1860986) - Resolves: rhbz#1830090 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade--advisory FEDORA-2021-eb3e3e87d3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Oct 29, 2021
•Critical
Fedora
89
security advisoryupdateFedoraFedora 33: 2021-9a51a6f8b1 Moderate: Certificate Management Enhancements
# New in release OpenJDK 11.0.13 (2021-10-19): Live versions of these release notes can be found at: * https://mail.openjdk.org/pipermail/jdk-updates-dev/2021-October/009368.html * https://builds.shipilev.net/backports-monitor/release-notes-11.0.13.txt ## Security fixes - JDK-8163326, CVE-2021-35550: Update the default enabled cipher suites preference - JDK-8254967, CVE-2021-35565:. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-9a51a6f8b1 2021-10-28 19:30:48.377092 --------------------------------------------------------------------------------Name : java-11-openjdk Product : Fedora 33 Version : 11.0.13.0.8 Release : 1.fc33 URL : https://openjdk.org/ Summary : OpenJDK 11 Runtime Environment Description : The OpenJDK 11 runtime environment. --------------------------------------------------------------------------------Update Information: # New in release OpenJDK 11.0.13 (2021-10-19): Live versions of these release notes can be found at: * https://mail.openjdk.org/pipermail/jdk-updates-dev/2021-October/009368.html * https://builds.shipilev.net/backports-monitor/release-notes-11.0.13.txt ## Security fixes - JDK-8163326, CVE-2021-35550: Update the default enabled cipher suites preference - JDK-8254967, CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close - JDK-8263314: Enhance XML Dsig modes - JDK-8265167, CVE-2021-35556: Richer Text Editors - JDK-8265574: Improve handling of sheets - JDK-8265580, CVE-2021-35559: Enhanced style for RTF kit - JDK-8265776: Improve Stream handling for SSL - JDK-8266097, CVE-2021-35561: Better hashing support - JDK-8266103: Better specified spec values - JDK-8266109: More Resilient Classloading - JDK-8266115: More Manifest Jar Loading - JDK-8266137, CVE-2021-35564: Improve Keystore integrity - JDK-8266689, CVE-2021-35567: More Constrained Delegation - JDK-8267086: ArrayIndexOutOfBoundsException injava.security.KeyFactory.generatePublic -JDK-8267712: Better LDAP reference processing - JDK-8267729, CVE-2021-35578: Improve TLS client handshaking - JDK-8267735, CVE-2021-35586: Better BMP support - JDK-8268193: Improve requests of certificates - JDK-8268199: Correct certificate requests - JDK-8268205: Enhance DTLS client handshake -JDK-8268506: More Manifest Digests - JDK-8269618, CVE-2021-35603: Better session identification - JDK-8269624: Enhance method selection support -JDK-8270398: Enhance canonicalization - JDK-8270404: Better canonicalization ## Major Changes * [JDK-8271434](https://bugs.openjdk.org/browse/JDK-8271434): Removed IdenTrust Root Certificate * [JDK-8261922](https://bugs.openjdk.org/browse/JDK-8261922): Updated keytool to Create AKID From SKID of Issuing Certificate as Specified by RFC 5280 * [JDK-8210799](https://bugs.openjdk.org/browse/JDK-8210799): ChaCha20 and Poly1305 TLS Cipher Suites * [JDK-8219551](https://bugs.openjdk.org/browse/JDK-8219551): Updated the Default Enabled Cipher Suites Preference ## FIPS Mode Changes - The `SunPKCS11` provider in FIPS mode will now eagerly login to the NSS software token on initialisation - `keytool` in FIPS mode now supports importing plain private keys by the provider adding them to the NSS database. This can be disabled using `-Dcom.redhat.fips.plainKeySupport=false`. --------------------------------------------------------------------------------ChangeLog: * Wed Oct 13 2021 Andrew Hughes - 1:11.0.13.0.8-1 - Update to jdk-11.0.12.0+8 - Update release notes to 11.0.12.0+8 - Update tarball generation script to use git following OpenJDK 11u's move to github - Remove "-clean" suffix as no 11.0.13 builds are unclean. - Drop JDK-8269668 patch which is now applied upstream. - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.misc. - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false - Restructure the build so a minimal initial build is thenused for the final build (with docs) - This reduces pressure on the system JDK and ensures the JDK being built can do a full build * Tue Oct 5 2021 Martin Balao - 1:11.0.13.0.8-1 - Add patch to login to the NSS software token when in FIPS mode. - Add patch to allow plain key import. * Thu Sep 2 2021 Jiri Vanek - 1:11.0.13.0.8-1 - Added posttrans hook which persist sanity of dir-> symlink change in case of update from ancient versions - Minor cosmetic improvements to make spec more comparable between variants --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-9a51a6f8b1' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Oct 28, 2021
•Important
Fedora
91
security advisoryGentooaccess controlGentoo: GLSA-200410-21 Low: Apache mod_ssl SSLCipherSuite Bypass Risk
In certain configurations, it can be possible to bypass restrictions set by the "SSLCipherSuite" directive of mod_ssl.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200410-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Apache 2, mod_ssl: Bypass of SSLCipherSuite directive Date: October 21, 2004 Bugs: #66807 ID: 200410-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= In certain configurations, it can be possible to bypass restrictions set by the "SSLCipherSuite" directive of mod_ssl. Background ========= The Apache HTTP server is one of the most popular web servers on the internet. mod_ssl provides SSL v2/v3 and TLS v1 support for Apache 1.3 and is also included in Apache 2. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-www/apache < 2.0.52 > = 2.0.52 < 2.0 2 net-www/mod_ssl < 2.8.20 > = 2.8.20 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== A flaw has been found in mod_ssl where the "SSLCipherSuite" directive could be bypassed in certain configurations if it is used in a directory or location context to restrict the set of allowed cipher suites. Impact ===== A remote attacker could gain access to a location using any cipher suite allowedby the server/virtual host configuration, disregarding the restrictions by "SSLCipherSuite" for that location. Workaround ========= There is no known workaround at this time. Resolution ========= All Apache 2 users should upgrade to the latest version: # emerge sync # emerge -pv "> =net-www/apache-2.0.52" # emerge "> =net-www/apache-2.0.52" All mod_ssl users should upgrade to the latest version: # emerge sync # emerge -pv "> =net-www/mod_ssl-2.8.20" # emerge "> =net-www/mod_ssl-2.8.20" References ========= [ 1 ] CAN-2004-0885 https://www.cve.org/CVERecord?id=CAN-2004-0885 [ 2 ] Apache HTTPD Bug 31505 https://bz.apache.org/bugzilla/show_bug.cgi Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200410-21 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Oct 21, 2004
•Low
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!