Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
98
security advisorymoderatesecurity updateRed Hat Enterprise MRG 2.5 RHSA-2014:0859-01 Moderate: Cumin Security Fixes
An updated cumin package that fixes two security issues is now available for Red Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Enterprise MRG 2.5 Messaging and Grid security update Advisory ID: RHSA-2014:0859-01 Product: Red Hat Enterprise MRG for RHEL-5 Advisory URL: https://access.redhat.com/errata/RHSA-2014:0859.html Issue date: 2014-07-09 CVE Names: CVE-2012-2682 CVE-2014-0174 ==================================================================== 1. Summary: An updated cumin package that fixes two security issues is now available for Red Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: MRG Grid for RHEL 5 Server v.2 - noarch MRG Management for RHEL 5 Server v.2 - noarch 3. Description: Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation IT infrastructure for enterprise computing. MRG offers increased performance, reliability, interoperability, and faster computing for enterprise customers. It was found that if Cumin were asked to display a link name containing non-ASCII characters, the request would terminate with an error. If data containing non-ASCII characters were added to the database (such as via Cumin or Wallaby), requests to load said data would terminate and the requested page would not be displayed until an administrator cleans the database. (CVE-2012-2682) It was found thatCumin did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie. (CVE-2014-0174) These issues were discovered by Stanislav Graf of Red Hat. All users of cumin with Red Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux 5 are advised to upgrade to this updated package, which corrects these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 830254 - CVE-2012-2682 cumin: DoS via displayed link names containing non-ASCII characters1086000 - CVE-2014-0174 cumin: session cookies lack httponly setting 6. Package List: MRG Grid for RHEL 5 Server v.2: Source: cumin-0.1.5796-4.el5_9.src.rpm noarch: cumin-0.1.5796-4.el5_9.noarch.rpm MRG Management for RHEL 5 Server v.2: Source: cumin-0.1.5796-4.el5_9.src.rpm noarch: cumin-0.1.5796-4.el5_9.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2012-2682 https://access.redhat.com/security/cve/CVE-2014-0174 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTvQuZXlSAg2UNWIIRAqLNAJ9iz0oP9c/IM9+1tIQahZa6yiasDwCginbm ifNIwei0m7ODkwrI3ojEfjw=Attb -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Jul 09, 2014
Red Hat
98
security advisorymoderateRed HatRed Hat: RHSA-2014-0858-01 Moderate: Cumin Session Cookie Problem
An updated cumin package that fixes two security issues is now available for Red Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Enterprise MRG 2.5 Messaging and Grid security update Advisory ID: RHSA-2014:0858-01 Product: Red Hat Enterprise MRG for RHEL-6 Advisory URL: https://access.redhat.com/errata/RHSA-2014:0858.html Issue date: 2014-07-09 CVE Names: CVE-2012-2682 CVE-2014-0174 ==================================================================== 1. Summary: An updated cumin package that fixes two security issues is now available for Red Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: MRG Grid for RHEL 6 Server v.2 - noarch MRG Management for RHEL 6 Server v.2 - noarch 3. Description: Red Hat Enterprise MRG (Messaging, Realtime, and Grid) is a next-generation IT infrastructure for enterprise computing. MRG offers increased performance, reliability, interoperability, and faster computing for enterprise customers. It was found that if Cumin were asked to display a link name containing non-ASCII characters, the request would terminate with an error. If data containing non-ASCII characters were added to the database (such as via Cumin or Wallaby), requests to load said data would terminate and the requested page would not be displayed until an administrator cleans the database. (CVE-2012-2682) It was found thatCumin did not set the HttpOnly flag on session cookies. This could allow a malicious script to access the session cookie. (CVE-2014-0174) These issues were discovered by Stanislav Graf of Red Hat. All users of cumin with Red Hat Enterprise MRG 2.5 for Red Hat Enterprise Linux 6 are advised to upgrade to this updated package, which corrects these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 830254 - CVE-2012-2682 cumin: DoS via displayed link names containing non-ASCII characters1086000 - CVE-2014-0174 cumin: session cookies lack httponly setting 6. Package List: MRG Grid for RHEL 6 Server v.2: Source: cumin-0.1.5797-3.el6.src.rpm noarch: cumin-0.1.5797-3.el6.noarch.rpm MRG Management for RHEL 6 Server v.2: Source: cumin-0.1.5797-3.el6.src.rpm noarch: cumin-0.1.5797-3.el6.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2012-2682 https://access.redhat.com/security/cve/CVE-2014-0174 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFTvQtlXlSAg2UNWIIRAvyPAJ4t8usigBWAc1zg8vIgNsAfna5oCgCePWHq B+yu84FfTPBV/P3tEyYX4vw=50WZ -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Jul 09, 2014
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!