Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
203
security advisorydenial of servicepath handlingMageia 8: 2022-0356 Moderate: Golang DoS and Path Handling Issues
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664) JoinPath and URL.JoinPath do not remove ../ path elements appended to a . MGASA-2022-0356 - Updated golang packages fix security vulnerability Publication date: 05 Oct 2022 URL: https://advisories.mageia.org/MGASA-2022-0356.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-27664, CVE-2022-32190 In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664) JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "", despite the JoinPath documentation stating that ../ path elements are removed from the result. (CVE-2022-32190) References: - https://bugs.mageia.org/show_bug.cgi?id=30835 - https://groups.google.com/g/golang-announce/c/x49AQzIVX-s - https://lists.fedoraproject.org/archives/list/
Oct 05, 2022 Mageia 89
security advisoryFedoramoderate security issueFedora 36: 2022-5038c3236c Moderate: Weldr-Client Golang Fixes
Rebuild to mitigate CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang --- See https://groups.google.com/g/golang-dev/c/frczlF8OFQ0/m/4lrZh5BHDgAJ for more information about the specific vulnerabilities. ---- Update to latest commit as of 20220719 ---- Added Experimental: nebula clients can be configured. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-5038c3236c 2022-07-31 01:30:22.784813 --------------------------------------------------------------------------------Name : weldr-client Product : Fedora 36 Version : 35.5 Release : 3.fc36 URL : %{gourl} Summary : Command line utility to control osbuild-composer Description : Command line utility to control osbuild-composer --------------------------------------------------------------------------------Update Information: Rebuild to mitigate CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang ---See https://groups.google.com/g/golang-dev/c/frczlF8OFQ0/m/4lrZh5BHDgAJ for more information about the specific vulnerabilities. ---- Update to latest commit as of 20220719 ---- Added Experimental: nebula clients can be configured to act as relays for other nebula clients. Primarily useful when stubborn NATs make a direct tunnel impossible. (#678) Configuration option to report manually specified ip:ports to lighthouses. (#650) Windows arm64 build. (#638) punchy and most lighthouse config options now support hot reloading. (#649) Changed Build against go 1.18. (#656) Promoted routines config from experimental to supported feature. (#702) Dependencies updated. (#664) Fixed Packets destined for the same host that sent it will be returned on MacOS. This matches the default behavior of other operating systems. (#501) unsafe_route configuration will no longer crash on Windows. (#648) A few panics that were introduced in 1.5.x. (#657, #658,#675) Security You can set listen.send_recv_error to control the conditions in which recv_error messages are sent. Sending these messages can expose the fact that Nebula is running on a host, but it speeds up re-handshaking. (#670) Removed x509 config stanza support has been removed. (#685) ---- bump to v4.2.0-rc1 ----fix package dir listing ---- resolve build issues and list new shell completion files ---- Release of stargz snapshotter v0.12.0. Please see the release note for details: https://github.com/containerd/stargz-snapshotter/releases/tag/v0.12.0 ---- Fix extracting network metric --------------------------------------------------------------------------------ChangeLog: * Tue Jul 19 2022 Maxwell G - 35.5-3 - Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-5038c3236c' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jul 30, 2022 Fedora 
89
security advisorymoderateFedoraFedora 36: 5ef0bd9a27 Moderate: Go-Bindata CVE Mitigation Details
Rebuild to mitigate CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang --- See https://groups.google.com/g/golang-dev/c/frczlF8OFQ0/m/4lrZh5BHDgAJ for more information about the specific vulnerabilities.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-5ef0bd9a27 2022-07-30 01:52:05.591823 --------------------------------------------------------------------------------Name : go-bindata Product : Fedora 36 Version : 3.0.7 Release : 23.gita0ff256.fc36 URL : https://github.com/jteeuwen/go-bindata Summary : A small utility which generates Go code from any file Description : A small utility which generates Go code from any file This tool converts any file into managable Go source code. Useful for embedding binary data into a go program. The file data is optionally gzip compressed before being converted to a raw byte slice. --------------------------------------------------------------------------------Update Information: Rebuild to mitigate CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang ---See https://groups.google.com/g/golang-dev/c/frczlF8OFQ0/m/4lrZh5BHDgAJ for more information about the specific vulnerabilities. --------------------------------------------------------------------------------ChangeLog: * Tue Jul 19 2022 Maxwell G - 3.0.7-23.gita0ff256 - Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-5ef0bd9a27' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jul 29, 2022 Fedora 98
security advisoryRed Hatsecurity fixRedHat: RHSA-2022-4861 Moderate: OpenShift Serverless Client 1.22.2
Release of OpenShift Serverless Client kn 1.22.1 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Release of OpenShift Serverless Client kn 1.22.1 Advisory ID: RHSA-2022:4860-01 Product: Red Hat OpenShift Serverless Advisory URL: https://access.redhat.com/errata/RHSA-2022:4860 Issue date: 2022-06-01 CVE Names: CVE-2022-23772 CVE-2022-23773 CVE-2022-23806 ==================================================================== 1. Summary: Release of OpenShift Serverless Client kn 1.22.1 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Openshift Serverless 1 on RHEL 8Base - ppc64le, s390x, x86_64 3. Description: The Red Hat OpenShift Serverless Client kn 1.22.1 provides a CLI to interact with Red Hat OpenShift Serverless 1.22.1. The kn CLI is delivered as an RPM package for installation on RHEL platforms, and as binaries for non-Linux platforms. Security Fix(es): - - golang: crypto/elliptic IsOnCurve returns true for invalid field elements(CVE-2022-23806) - - golang: cmd/go: misinterpretation of branch names can lead to incorrect access control(CVE-2022-23773) - - golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772) For more details about the security issue(s), including the impact; a CVSS score; acknowledgments; and other related information refer to the CVE page(s) listed in the Referencessection. 4. Solution: See the Red Hat OpenShift Container Platform 4.6 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index See the Red Hat OpenShift Container Platform 4.7 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index See the Red Hat OpenShift Container Platform 4.8 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index See the Red Hat OpenShift Container Platform 4.9 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index See the Red Hat OpenShift Container Platform 4.10 documentation at: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index 5. Bugs fixed (https://bugzilla.redhat.com/): 2053429 - CVE-2022-23806 golang: crypto/elliptic IsOnCurve returns true for invalid field elements 2053532 - CVE-2022-23772 golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString 2053541 - CVE-2022-23773 golang: cmd/go: misinterpretation of branch names can lead to incorrect access control 6. Package List: Openshift Serverless 1 on RHEL 8Base: Source: openshift-serverless-clients-1.1.0-3.el8.src.rpm ppc64le: openshift-serverless-clients-1.1.0-3.el8.ppc64le.rpm s390x: openshift-serverless-clients-1.1.0-3.el8.s390x.rpm x86_64: openshift-serverless-clients-1.1.0-3.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7.References: https://access.redhat.com/security/cve/CVE-2022-23772 https://access.redhat.com/security/cve/CVE-2022-23773 https://access.redhat.com/security/cve/CVE-2022-23806 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYpd08NzjgjWX9erEAQhGeg//SHazFZvE+qKtTpDZXq2RvZGhnBMatOij vDVoVqScZeEIlKriKFoICC6gc1cRrLor36WlmNdTc0+XbcOKeQivZlTrBPXEAVgU pHN1T7fyGh9lAiUpKBMqkAuQF4AeKb0fFHWAIxoEcaI+WAGFP00o76sFs6as8RPq 5z1H/4aAqTEA8b/F190ZefGHZGwxY+aqNR7pP36zSkCEPWpfW8iK0K5ulTmquged 1TgGNSypXW/AnXNOC8jJC/7fRft92fwUmkpYCkP9NgR5QUy1HYBDMJcnohCA+kL/ JCfiacX95jJeiafRItXI1aw5zdTpr34rsdThOucf86BlVuXIaFcNXtWeh/qc2CU0 tWdpBWXp4fQiI2nhwRppnlyjAIQlkvxwCUspHc7uNC1Af4zJ5FXZDN7X+cyk1u2W vSUUVzPnHudjACSt0SoDmf8nar9g/h4/5jP4I1pUEj1NzEKb3ov20KkXHmTLXhh9 6/aLW0OCkN6MhcQb1dCgoEU5o3UMnTLqkseDSh/Y7QNJAbQWa6ABrGqvJ/FVl3Eo upbFJKWNGDXxtC+twUu3DcsuddWhwTuyu/StK1SKD5khz2QtfnKxPS4AqfejXkMH AmdZCLcxf71B09+v3xuI++3j6bohgFNQvwq+pjaAP4THOS4luyFRzX9P5EPg9+Pt vV0Mq6V8/iU=0Z7y -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Jun 01, 2022 •Important Red Hat 
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!