An update for kernel-rt is now available for Red Hat Enterprise Linux 8.2 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: kernel-rt security and bug fix update Advisory ID: RHSA-2023:1110-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:1110 Issue date: 2023-03-07 CVE Names: CVE-2022-4378 ==================================================================== 1. Summary: An update for kernel-rt is now available for Red Hat Enterprise Linux 8.2 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Real Time TUS (v. 8.2) - x86_64 Red Hat Enterprise Linux Real Time for NFV TUS (v. 8.2) - x86_64 3. Description: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * kernel-rt: update RT source tree to the latest RHEL-8.2.z24 Batch (BZ#2166667) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The systemmust be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2152548 - CVE-2022-4378 kernel: stack overflow in do_proc_dointvec and proc_skip_spaces 6. Package List: Red Hat Enterprise Linux Real Time for NFV TUS (v. 8.2): Source: kernel-rt-4.18.0-193.100.1.rt13.151.el8_2.src.rpm x86_64: kernel-rt-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-core-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-core-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-debuginfo-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-devel-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-kvm-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-modules-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-modules-extra-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debuginfo-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debuginfo-common-x86_64-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-devel-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-kvm-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-modules-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-modules-extra-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm Red Hat Enterprise Linux Real Time TUS (v.8.2): Source: kernel-rt-4.18.0-193.100.1.rt13.151.el8_2.src.rpm x86_64: kernel-rt-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-core-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-core-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-debuginfo-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-devel-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-modules-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debug-modules-extra-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debuginfo-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-debuginfo-common-x86_64-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-devel-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-modules-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm kernel-rt-modules-extra-4.18.0-193.100.1.rt13.151.el8_2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-4378 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBZAiXONzjgjWX9erEAQgcHRAAodkm8RI/ph0uWxqyNMLlJin1DBKTINBZ hmCehrROAyJChhSlqyJy/RFzvnqUv7DxWjG29l1CObvs4NXoSGobUSa+GWK6Kj/s zqNyFUleBpCpbtw5jkRmzVDXXpkDCDPG9L11LY5qO63YDWEFQkIY0NK8AgM01WQN HiBtN4VtySWeVUNM6RsBLUJH9UR1te5X117JfQZTChYnfTPro+DYZe/pAV2M8NZ+ PL8UN05Mt86S7msRUHOktsdyTo4XFOg7eeYc/MdxOBcCWyPFS1gz+OoPIjctULxq KJ756AE8jed2XoWnak7OE+3TGFmIbZkYkVlJEKlrRnsfQyM5mnNcwHBU7+nZ62on T05/GRF1mSrnK36CCCPIJVZPGdRHTsC63+Y9JyHtTI/Rfo9JN/P/pZ7RHY2JfgGP kqIRTzmI711qS6SRE0t/WQqjayOEvKY1OnT+zhTFZ9lB0pyDWq8CXQOVQQ1CO++E OK4sd8khWdjt2/aq64PY8Mha//cyRNqtNFx5UuMQfEcnuY0HCnPOApfg2L7Zgjjv BllgiX7moZh1FEV48oOrpu3MiFU7f88jmqBc3Hb22NzOQxcmq7dwOTuleb42TSpu yZmpIdanBKrCSDWaZ/EayJsLls3AgySz6ASi9fLoP5+aaTZND6zgggOBT5qgQTVW MUNj0ZVLhJ8=Ful1 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Backport fix for CVE-2020-26159. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-d53469eceb 2020-10-09 16:27:42.087258 --------------------------------------------------------------------------------Name : oniguruma Product : Fedora 31 Version : 6.9.4 Release : 2.fc31 URL : https://github.com/kkos/oniguruma/ Summary : Regular expressions library Description : Oniguruma is a regular expressions library. The characteristics of this library is that different character encoding for every regular expression object can be specified. (supported APIs: GNU regex, POSIX and Oniguruma native) --------------------------------------------------------------------------------Update Information: Backport fix for CVE-2020-26159 --------------------------------------------------------------------------------ChangeLog: * Thu Oct 1 2020 Mamoru TASAKA - 6.9.4-2 - Apply upstream fix for CVE-2020-26159 --------------------------------------------------------------------------------References: [ 1 ] Bug #1884112 - CVE-2020-26159 oniguruma: Buffer overflow in concat_opt_exact_str could result in DoS [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1884112 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-d53469eceb' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.