Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
202
security advisorymoderate severityopenSUSEopenSUSE 15.4/15.5: 2024:0033-1 Moderate: python-aiohttp Header Injection
This update for python-aiohttp fixes the following issues: CVE-2023-49081: fixed an HTTP header injection via a crafted version (bsc#1217684).. # Security update for python-aiohttp Announcement ID: SUSE-SU-2024:0033-1 Rating: moderate References: * bsc#1217684 Cross-References: * CVE-2023-49081 CVSS scores: * CVE-2023-49081 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-49081 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Python 3 Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for python-aiohttp fixes the following issues: * CVE-2023-49081: fixed an HTTP header injection via a crafted version (bsc#1217684). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-33=1 * Python 3 Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Python3-15-SP5-2024-33=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-33=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python311-aiohttp-3.8.5-150400.10.8.1 * python311-aiohttp-debuginfo-3.8.5-150400.10.8.1 * python-aiohttp-debugsource-3.8.5-150400.10.8.1 * Python 3 Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python311-aiohttp-3.8.5-150400.10.8.1 * python311-aiohttp-debuginfo-3.8.5-150400.10.8.1 * python-aiohttp-debugsource-3.8.5-150400.10.8.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python311-aiohttp-3.8.5-150400.10.8.1 *python311-aiohttp-debuginfo-3.8.5-150400.10.8.1 * python-aiohttp-debugsource-3.8.5-150400.10.8.1 ## References: * https://www.suse.com/security/cve/CVE-2023-49081.html * https://bugzilla.suse.com/show_bug.cgi?id=1217684 . Security patch for python-aiohttp to fix HTTP header injection vulnerabilities. You can install it using zypper commands or via YaST on openSUSE.. Python Aiohttp Update, OpenSUSE Security Advisory, HTTP Header Injection Fix. . LinuxSecurity.com Team
Jan 05, 2024
OpenSUSE
172
security advisorydenial of serviceubuntuUbuntu 18.04 LTS: USN-4528-1 Elevated: Ceph Denial of Service and XSS
Several security issues were fixed in Ceph.. =========================================================================Ubuntu Security Notice USN-4528-1 September 22, 2020 ceph vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Ceph. Software Description: - ceph: distributed storage and file system Details: Adam Mohammed discovered that Ceph incorrectly handled certain CORS ExposeHeader tags. A remote attacker could possibly use this issue to preform an HTTP header injection attack. (CVE-2020-10753) Lei Cao discovered that Ceph incorrectly handled certain POST requests with invalid tagging XML. A remote attacker could possibly use this issue to cause Ceph to crash, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-12059) Robin H. Johnson discovered that Ceph incorrectly handled certain S3 requests. A remote attacker could possibly use this issue to perform a XSS attack. (CVE-2020-1760) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: ceph 12.2.13-0ubuntu0.18.04.4 ceph-base 12.2.13-0ubuntu0.18.04.4 ceph-common 12.2.13-0ubuntu0.18.04.4 Ubuntu 16.04 LTS: ceph 10.2.11-0ubuntu0.16.04.3 ceph-common 10.2.11-0ubuntu0.16.04.3 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4528-1 CVE-2020-10753, CVE-2020-12059, CVE-2020-1760 Package Information: https://launchpad.net/ubuntu/+source/ceph/12.2.13-0ubuntu0.18.04.4 https://launchpad.net/ubuntu/+source/ceph/10.2.11-0ubuntu0.16.04.3 . Multiple vulnerabilities in Ceph impacting Ubuntu 16.04and 18.04 LTS disclosed in USN-4529-1.. Ceph Security Update, Ubuntu Update, Denial of Service, HTTP Injection, XSS Attack. . Severity: Critical. LinuxSecurity.com Team
Sep 22, 2020
•Critical
Ubuntu
202
security advisorymoderatesecurity issueopenSUSE Leap 15.1: 2019:2393-1 Moderate: Python Security Fixes
An update that fixes three vulnerabilities is now available.. openSUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2019:2393-1 Rating: moderate References: #1130840 #1149955 #1153238 Cross-References: CVE-2019-16056 CVE-2019-16935 CVE-2019-9947 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for python fixes the following issues: Security issues fixed: - CVE-2019-9947: Fixed an insufficient validation of URL paths with embedded whitespace or control characters that could allow HTTP header injections. (bsc#1130840) - CVE-2019-16056: Fixed a parser issue in the email module. (bsc#1149955) - CVE-2019-16935: Fixed a reflected XSS in python/Lib/DocXMLRPCServer.py (bsc#1153238). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2019-2393=1 Package List: - openSUSE Leap 15.1 (i586 x86_64): libpython2_7-1_0-2.7.14-lp151.10.10.2 libpython2_7-1_0-debuginfo-2.7.14-lp151.10.10.2 python-2.7.14-lp151.10.10.1 python-base-2.7.14-lp151.10.10.2 python-base-debuginfo-2.7.14-lp151.10.10.2 python-base-debugsource-2.7.14-lp151.10.10.2 python-curses-2.7.14-lp151.10.10.1 python-curses-debuginfo-2.7.14-lp151.10.10.1 python-debuginfo-2.7.14-lp151.10.10.1 python-debugsource-2.7.14-lp151.10.10.1 python-demo-2.7.14-lp151.10.10.1 python-devel-2.7.14-lp151.10.10.2 python-gdbm-2.7.14-lp151.10.10.1 python-gdbm-debuginfo-2.7.14-lp151.10.10.1 python-idle-2.7.14-lp151.10.10.1 python-tk-2.7.14-lp151.10.10.1 python-tk-debuginfo-2.7.14-lp151.10.10.1 python-xml-2.7.14-lp151.10.10.2 python-xml-debuginfo-2.7.14-lp151.10.10.2 - openSUSE Leap 15.1 (x86_64): libpython2_7-1_0-32bit-2.7.14-lp151.10.10.2 libpython2_7-1_0-32bit-debuginfo-2.7.14-lp151.10.10.2 python-32bit-2.7.14-lp151.10.10.1 python-32bit-debuginfo-2.7.14-lp151.10.10.1 python-base-32bit-2.7.14-lp151.10.10.2 python-base-32bit-debuginfo-2.7.14-lp151.10.10.2 - openSUSE Leap 15.1 (noarch): python-doc-2.7.14-lp151.10.10.1 python-doc-pdf-2.7.14-lp151.10.10.1 References: https://www.suse.com/security/cve/CVE-2019-16056.html https://www.suse.com/security/cve/CVE-2019-16935.html https://www.suse.com/security/cve/CVE-2019-9947.html https://bugzilla.suse.com/1130840 https://bugzilla.suse.com/1149955 https://bugzilla.suse.com/1153238 -- . A new update for openSUSE addresses various vulnerabilities in Python, improving both security and functionality for its users.. openSUSE Security Update, Python Issues Fix, Software Update Advisory. . Severity: Important. LinuxSecurity.com Team
Oct 27, 2019
•Important
OpenSUSE
100
security advisorydenial of serviceimportantSUSE Linux Enterprise Server 12-LTSS: 2019:0223-1 Important: Python DoS
An update that fixes 5 vulnerabilities is now available. . SUSE Security Update: Security update for python ______________________________________________________________________________ Announcement ID: SUSE-SU-2019:0223-1 Rating: important References: #1122191 #984751 #985177 #985348 #989523 Cross-References: CVE-2016-0772 CVE-2016-1000110 CVE-2016-5636 CVE-2016-5699 CVE-2019-5010 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for python fixes the following issues: Security issues fixed: - CVE-2016-0772: smtplib vulnerability opens startTLS stripping attack (bsc#984751) - CVE-2016-5636: heap overflow when importing malformed zip files (bsc#985177) - CVE-2016-5699: incorrect validation of HTTP headers allow header injection (bsc#985348) - CVE-2016-1000110: HTTPoxy vulnerability in urllib, fixed by disregarding HTTP_PROXY when REQUEST_METHOD is also set (bsc#989523) - CVE-2019-5010: Fixed a denial-of-service vulnerability in the X509 certificate parser (bsc#1122191) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2019-223=1 Package List: - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): libpython2_7-1_0-2.7.9-16.7.2 libpython2_7-1_0-debuginfo-2.7.9-16.7.2 python-2.7.9-16.7.1 python-base-2.7.9-16.7.2 python-base-debuginfo-2.7.9-16.7.2 python-base-debugsource-2.7.9-16.7.2 python-curses-2.7.9-16.7.1 python-curses-debuginfo-2.7.9-16.7.1 python-debuginfo-2.7.9-16.7.1 python-debugsource-2.7.9-16.7.1 python-demo-2.7.9-16.7.1 python-gdbm-2.7.9-16.7.1 python-gdbm-debuginfo-2.7.9-16.7.1 python-idle-2.7.9-16.7.1 python-tk-2.7.9-16.7.1 python-tk-debuginfo-2.7.9-16.7.1 python-xml-2.7.9-16.7.2 python-xml-debuginfo-2.7.9-16.7.2 - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64): libpython2_7-1_0-32bit-2.7.9-16.7.2 libpython2_7-1_0-debuginfo-32bit-2.7.9-16.7.2 python-32bit-2.7.9-16.7.1 python-base-32bit-2.7.9-16.7.2 python-base-debuginfo-32bit-2.7.9-16.7.2 python-debuginfo-32bit-2.7.9-16.7.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): python-doc-2.7.9-16.7.2 python-doc-pdf-2.7.9-16.7.2 References: https://www.suse.com/security/cve/CVE-2016-0772.html https://www.suse.com/security/cve/CVE-2016-1000110.html https://www.suse.com/security/cve/CVE-2016-5636.html https://www.suse.com/security/cve/CVE-2016-5699.html https://www.suse.com/security/cve/CVE-2019-5010.html https://bugzilla.suse.com/1122191 https://bugzilla.suse.com/984751 https://bugzilla.suse.com/985177 https://bugzilla.suse.com/985348 https://bugzilla.suse.com/989523 _______________________________________________ sle-security-updates mailing list
Feb 01, 2019
•Important
SuSE
197
security advisorydenial of serviceunauthorized accessDebian 7: DLA-1339-1 Moderate: OpenJDK Denial Of Service Threats
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in denial of service, unauthorized access, sandbox bypass or HTTP header injection. . Package : openjdk-7 Version : 7u171-2.6.13-1~deb7u1 CVE ID : CVE-2018-2579 CVE-2018-2588 CVE-2018-2599 CVE-2018-2602 CVE-2018-2603 CVE-2018-2618 CVE-2018-2629 CVE-2018-2633 CVE-2018-2634 CVE-2018-2637 CVE-2018-2641 CVE-2018-2663 CVE-2018-2677 CVE-2018-2678 Debian Bug : 891330 Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in denial of service, unauthorized access, sandbox bypass or HTTP header injection. For Debian 7 "Wheezy", these problems have been fixed in version 7u171-2.6.13-1~deb7u1. We recommend that you upgrade your openjdk-7 packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Enhance your OpenJDK installation to fix urgent vulnerabilities such as unauthorized entry and service disruption in Debian LTS.. OpenJDK Update, Debian LTS Security, Java Threats. . LinuxSecurity.com Team
Apr 03, 2018
Debian LTS
87
security advisorycriticaldebianDebian: DSA-3743-1 Critical: Python Bottle CRLF Attack Fix
It was discovered that bottle, a WSGI-framework for the Python programming language, did not properly filter "\r\n" sequences when handling redirections. This allowed an attacker to perform CRLF attacks such as HTTP header injection. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3743-1
Dec 20, 2016
•Critical
Debian
87
security advisorydebianremote accessDebian: DSA-2587-1 Moderate: libcgi-pm-perl HTTP Header Injection
It was discovered that the CGI module for Perl does not filter LF characters in the Set-Cookie and P3P headers, potentially allowing attackers to inject HTTP headers. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2587-1
Dec 11, 2012
•Important
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!