Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
98
security advisoryred hatsecurity fixRedHat: RHSA-2022-6152-01 Important: secondary scheduler security threat
Secondary Scheduler Operator for Red Hat OpenShift 1.1.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Secondary Scheduler Operator for Red Hat OpenShift 1.1.0 security update Advisory ID: RHSA-2022:6152-01 Product: OSSO Advisory URL: Issue date: 2022-09-01 CVE Names: CVE-2022-1705 CVE-2022-1962 CVE-2022-24675 CVE-2022-28131 CVE-2022-28327 CVE-2022-30629 CVE-2022-30630 CVE-2022-30631 CVE-2022-30632 CVE-2022-30633 CVE-2022-30635 CVE-2022-32148 ==================================================================== 1. Summary: Secondary Scheduler Operator for Red Hat OpenShift 1.1.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Secondary Scheduler Operator for Red Hat OpenShift 1.1.0 Security Fix(es): * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962) * golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675) * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131) * golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327) * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633) * golang: encoding/gob: stack exhaustionin Decoder.Decode (CVE-2022-30635) * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148) * golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: For Secondary Scheduler Operator 1.1.0 see the following documentation, which will be updated shortly, for detailed release notes: For more information on Secondary Scheduler Operator for Red Hat OpenShift 1.1.0, see the following release notes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.11/html/nodes/controlling-pod-placement-onto-nodes-scheduling#nodes-secondary-scheduler-release-notes 4. Bugs fixed (https://bugzilla.redhat.com/): 2077688 - CVE-2022-24675 golang: encoding/pem: fix stack overflow in Decode 2077689 - CVE-2022-28327 golang: crypto/elliptic: panic caused by oversized scalar 2092793 - CVE-2022-30629 golang: crypto/tls: session tickets lack random ticket_age_add 2105001 - [SSO] Secondary scheduler version is shown as unknown in the operator logs 2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read 2107371 - CVE-2022-30630 golang: io/fs: stack exhaustion in Glob 2107374 - CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header 2107376 - CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions 2107383 - CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working 2107386 - CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob 2107388 - CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode 2107390 - CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip 2107392 - CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal 5. JIRA issues fixed(https://redhat.atlassian.net/jira/projects): WRKLDS-466 - Secondary Scheduler Operator for Red Hat OpenShift 1.1 release 6. References: https://access.redhat.com/security/cve/CVE-2022-1705 https://access.redhat.com/security/cve/CVE-2022-1962 https://access.redhat.com/security/cve/CVE-2022-24675 https://access.redhat.com/security/cve/CVE-2022-28131 https://access.redhat.com/security/cve/CVE-2022-28327 https://access.redhat.com/security/cve/CVE-2022-30629 https://access.redhat.com/security/cve/CVE-2022-30630 https://access.redhat.com/security/cve/CVE-2022-30631 https://access.redhat.com/security/cve/CVE-2022-30632 https://access.redhat.com/security/cve/CVE-2022-30633 https://access.redhat.com/security/cve/CVE-2022-30635 https://access.redhat.com/security/cve/CVE-2022-32148 https://access.redhat.com/security/updates/classification/#important 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYxCI69zjgjWX9erEAQhXXxAAosQlZxGWGILaGuYUJr/S/jXROYtor0Wv z8na9oZNTgJG086tiPehf+HAUIbwIRlExUg/fI0TkkQILou0JDqDKbMfxuvZ3You vgUzKoLHnf541JJp1tjLFbHl+dcG1ohoXEFdh6UpmhxILu56hnC7jB7hfAXnye/E wIwwtRkG7tzS2f81vFG1TwWunVddvtNy6ITnqkBLWvjRP0ihk6mBt4iBz4NOKYFi x/7TRZUGV+ILeP++g7qsbehOwZLj2p9NzqE2cRw/A1DP3WVRglKaGuhd46kR9mtn o0LK9jSBJ0QMPXDvEk52PU4J8yDqhhvTWSeCrFg0rwC3Xd3/41xxKTo9htbLOHfQ Ei359sevhBTpLH1sdS7/jjmd8jMYe9CZXxk0Ck87e+T17MXOyKVHSsMFjZR1Pgfu wXAMZaIut1l23RA+3T79jYUnrbB+zD4rDk5mwLuurO8n6y7Bw1Dr1Rr2r1mKgr7N rxIpHDhw2nWjEhnhl91+2r2ucLvfD6qqsdnV58XTKdLUqNbYAOL1p3tGljqmUVsH f2YWDoEc3LpbVoT12xbxqnmJRQGmWwfsNRY4tr6w+qVHgKjBAjMGaDhd4gIVEuGi 08mdVFBRqUPBbkIZu9ku5Eh8dgg2NcOFN1naDYb3AaNJp7+garNbcGFL1lIK0cBM ZO93shdrUmc=3goO -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 01, 2022
•Important
Red Hat
98
security advisorysecurity impactimportant advisoryRed Hat OpenStack Platform 16.2 RHSA-2022-6062-01 Crucial collectd Upgrade
An update for collectd-libpod-stats is now available for Red Hat OpenStack Platform 16.2 (Train). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenStack Platform 16.2 (collectd-libpod-stats) security update Advisory ID: RHSA-2022:6062-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2022:6062 Issue date: 2022-08-15 CVE Names: CVE-2022-30631 ==================================================================== 1. Summary: An update for collectd-libpod-stats is now available for Red Hat OpenStack Platform 16.2 (Train). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 16.2 - ppc64le, x86_64 3. Description: Collectd plugin for gathering resource usage statistics from containerscreated with the libpod library. Security Fix(es): * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2107342 - CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read 6. Package List: Red Hat OpenStack Platform16.2: Source: collectd-libpod-stats-1.0.4-2.el8ost.src.rpm ppc64le: collectd-libpod-stats-1.0.4-2.el8ost.ppc64le.rpm x86_64: collectd-libpod-stats-1.0.4-2.el8ost.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-30631 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYvo2+9zjgjWX9erEAQifBQ/9FNIwjzEhXZMoULDnpPWA5iiRmfdmd6s9 WVmP2w6qY4rrKF7hSItPz0IxzXBTOklId42E12nF3zIArzTqKKOag0oOIeiAXvdZ QOcX/KOFQC9jF7iBxU4J0uYk8wfUqxOCCITLKojHEt8pCOpH6aiGTPFM9ZpFS9HF mmF4YJUB9/1XtsjQKuqCPQHrFZHWtJUW8TBt48374F2WvC4QzCVFxfJx05d6SGvD NWyMFyI3ciyGMflGe6DZiFjPlqY0idfhaTobNS+6v73mLfPLAARtZyEqezxFawyi oR/vF4/Mcv2wcYXfM+YX5VXVawgN+Xqw8OAIbujUcEXhhK/cEYHhm5SlYEP0l7xS /OvZ+BZOZ1W2cHBxRgME6RCbdYQ8z0ZEMEmMHVGuJzd/t0OX6nSYfx9GeuIQe8gr UMCLtDNZJ06fLgr0bdJ2x8EeY+ulJWLco5F+Y/f4Jq5dX3Aj+zJE9MdVOJI768N1 BkHE0OaFklYprz4ZZu3RrIRK7OIurDpICDK/K8E/WHp08bcIfwLJdE/Wi0PHH7M/ LTAoLwPBGlP+zqQE2dPlaBp0lEDePm+w4gYVO9vfwa0jsU7UQ0dH/ptePcPhUO4a 5Rn6creMaKbQrLKZYjhRBzg4E2vAPjaqfEc7NftSZvn4B8pfX1pVEUxbn9ZsWSBZ hPFw3Kwo1GY=EOoO -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Aug 15, 2022
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!