Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
100
security advisorysoftware updateimportantImportant Security Update for pgAdmin4 on SUSE 2024:3771-1 Released
* bsc#1224295 * bsc#1224366 * bsc#1226967 * bsc#1227248 * bsc#1227252 . # Security update for pgadmin4 Announcement ID: SUSE-SU-2024:3771-1 Release Date: 2024-10-29T12:55:39Z Rating: important References: * bsc#1224295 * bsc#1224366 * bsc#1226967 * bsc#1227248 * bsc#1227252 * bsc#1229423 * bsc#1229861 * bsc#1230928 * bsc#1231564 * bsc#1231684 Cross-References: * CVE-2024-38355 * CVE-2024-38998 * CVE-2024-38999 * CVE-2024-39338 * CVE-2024-4067 * CVE-2024-4068 * CVE-2024-43788 * CVE-2024-48948 * CVE-2024-48949 * CVE-2024-9014 CVSS scores: * CVE-2024-38355 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-38998 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2024-38998 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-38998 ( NVD ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-38999 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2024-39338 ( SUSE ): 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2024-39338 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2024-39338 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2024-4067 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-4068 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-43788 ( SUSE ): 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L * CVE-2024-43788 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L * CVE-2024-43788 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2024-48948 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2024-48948 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2024-48949 ( SUSE ): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2024-48949 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N *CVE-2024-48949 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2024-9014 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-9014 ( SUSE ): 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H * CVE-2024-9014 ( NVD ): 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.6 * Python 3 Module 15-SP6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves 10 vulnerabilities can now be installed. ## Description: This update for pgadmin4 fixes the following issues: * CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967) * CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248) * CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252) * CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423) * CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366) * CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295) * CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861) * CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684) * CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564) * CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternativelyyou can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2024-3771=1 openSUSE-SLE-15.6-2024-3771=1 * Python 3 Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Python3-15-SP6-2024-3771=1 ## Package List: * openSUSE Leap 15.6 (noarch) * pgadmin4-desktop-8.5-150600.3.6.1 * system-user-pgadmin-8.5-150600.3.6.1 * pgadmin4-doc-8.5-150600.3.6.1 * pgadmin4-cloud-8.5-150600.3.6.1 * pgadmin4-8.5-150600.3.6.1 * pgadmin4-web-uwsgi-8.5-150600.3.6.1 * Python 3 Module 15-SP6 (noarch) * pgadmin4-8.5-150600.3.6.1 * system-user-pgadmin-8.5-150600.3.6.1 * pgadmin4-doc-8.5-150600.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2024-38355.html * https://www.suse.com/security/cve/CVE-2024-38998.html * https://www.suse.com/security/cve/CVE-2024-38999.html * https://www.suse.com/security/cve/CVE-2024-39338.html * https://www.suse.com/security/cve/CVE-2024-4067.html * https://www.suse.com/security/cve/CVE-2024-4068.html * https://www.suse.com/security/cve/CVE-2024-43788.html * https://www.suse.com/security/cve/CVE-2024-48948.html * https://www.suse.com/security/cve/CVE-2024-48949.html * https://www.suse.com/security/cve/CVE-2024-9014.html * https://bugzilla.suse.com/show_bug.cgi?id=1224295 * https://bugzilla.suse.com/show_bug.cgi?id=1224366 * https://bugzilla.suse.com/show_bug.cgi?id=1226967 * https://bugzilla.suse.com/show_bug.cgi?id=1227248 * https://bugzilla.suse.com/show_bug.cgi?id=1227252 * https://bugzilla.suse.com/show_bug.cgi?id=1229423 * https://bugzilla.suse.com/show_bug.cgi?id=1229861 * https://bugzilla.suse.com/show_bug.cgi?id=1230928 * https://bugzilla.suse.com/show_bug.cgi?id=1231564 * https://bugzilla.suse.com/show_bug.cgi?id=1231684 . Crucial security enhancement for pgadmin4 tackles various vulnerabilities; comprehensive information on flaws and guidance for applying patches provided.. pgadmin4 update, security advisory, SUSE software, openSUSE security. . Severity:Important. LinuxSecurity.com Team
Oct 29, 2024 •Important SuSE 98
security advisoryRed HatupdateRed Hat: RHSA-2017:0444-02 Moderate: rpm-ostree GPG Signature Flaw
An update for rpm-ostree and rpm-ostree-client is now available for Red Hat Enterprise Linux Atomic Host 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rpm-ostree and rpm-ostree-client security, bug fix, and enhancement update Advisory ID: RHSA-2017:0444-02 Product: Red Hat Enterprise Linux Atomic Host Advisory URL: https://access.redhat.com/errata/RHSA-2017:0444 Issue date: 2017-03-02 CVE Names: CVE-2017-2623 ==================================================================== 1. Summary: An update for rpm-ostree and rpm-ostree-client is now available for Red Hat Enterprise Linux Atomic Host 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Atomic Host 7 - x86_64 3. Description: The rpm-ostree tool binds together the RPM packaging model with the OSTree model of bootable file system trees. It provides commands which can be used both on client systems as well as server-side composes. The rpm-ostree-client package provides commands usable on client systems to upgrade and rollback. The following packages have been upgraded to a later upstream version: rpm-ostree (2017.1), rpm-ostree-client (2017.1). (BZ#1416089) Security Fix(es): * It was discovered that rpm-ostree and rpm-ostree-client fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host,where certificate pinning is used by default. (CVE-2017-2623) This issue was discovered by Colin Walters (Red Hat). 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1416089 - Rebase ostree + rpm-ostree for 7.3.3 1421781 - Package layering non-root packages does not install var paths owned by root 1421867 - rpm-ostree daemon does not start when system is unsubscribed 1422157 - CVE-2017-2623 rpm-ostree and rpm-ostree-client fail to check gpg package signatures when layering 6. Package List: Red Hat Enterprise Linux Atomic Host 7: Source: rpm-ostree-2017.1-5.atomic.el7.src.rpm rpm-ostree-client-2017.1-6.atomic.el7.src.rpm x86_64: rpm-ostree-2017.1-5.atomic.el7.x86_64.rpm rpm-ostree-client-2017.1-6.atomic.el7.x86_64.rpm rpm-ostree-client-debuginfo-2017.1-6.atomic.el7.x86_64.rpm rpm-ostree-debuginfo-2017.1-5.atomic.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-2623 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYua6VXlSAg2UNWIIRArH9AKC6iEqsWOpD4fnaGUOv/+lX/lA+hwCgrhqf MiRkWlUViSI8bMY3ORUT38k=iyES -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Mar 03, 2017 Red Hat 
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!