Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
98
security advisorymoderatesecurity updateRedHat: RHSA-2020-3578-01 Moderate: OpenShift 4.5.8 Update
An update for cluster-network-operator-container, cluster-version-operator-container, elasticsearch-operator-container, logging-kibana6-container, and ose-cluster-svcat-controller-manager-operator-container is now available. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: OpenShift Container Platform 4.5.8 security update Advisory ID: RHSA-2020:3578-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2020:3578 Issue date: 2020-09-08 CVE Names: CVE-2020-7015 CVE-2020-7598 CVE-2020-8174 CVE-2020-10531 CVE-2020-11080 CVE-2020-14040 ==================================================================== 1. Summary: An update for cluster-network-operator-container, cluster-version-operator-container, elasticsearch-operator-container, logging-kibana6-container, and ose-cluster-svcat-controller-manager-operator-container is now available for Red Hat OpenShift Container Platform 4.5. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: OpenShift Container Platform components are primarily written in Go (golang). The golang.org/x/text contains text-related packages which are used for text operations, such as character encodings, text transformations, and locale-specific text handling. Kibana is one of the major components of OpenShift Container Platform cluster logging. It is a browser-based console interface to query, discover, and visualize the log data. Security Fix(es): * kibana: XSS in TSVB visualization (ESA-2020-08) (CVE-2020-7015) * golang.org/x/text: Possibility to trigger an infinite loop in encoding/unicode could lead to crash(CVE-2020-14040) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: For OpenShift Container Platform 4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.5/html/release_notes/ocp-4-5-release-notes Details on how to access this content are available at - -cli.html. 4. Bugs fixed (https://bugzilla.redhat.com/): 1849037 - CVE-2020-7015 kibana: XSS in TSVB visualization (ESA-2020-08) 1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash 5. References: https://access.redhat.com/security/cve/CVE-2020-7015 https://access.redhat.com/security/cve/CVE-2020-7598 https://access.redhat.com/security/cve/CVE-2020-8174 https://access.redhat.com/security/cve/CVE-2020-10531 https://access.redhat.com/security/cve/CVE-2020-11080 https://access.redhat.com/security/cve/CVE-2020-14040 https://access.redhat.com/security/updates/classification#moderate 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBX1dYxdzjgjWX9erEAQiAnQ//aosmvd6NhSmrowLMuVYYOThUrYXFD96H UkGE+vvrx1/LHNCvatd5ODcDpk9TYbA2Hbzb3vw0Dk0G2YV8UEFV0tfd7FgMMF8N +qTmD98RKmT5JHMYrVPpsk6M1FKwFL7X1I/kMwPZpHBi0DUB/RLR4MkDI6Ydw8k1 HQewB3hBLGaw6uP8G5DzeVzg0JWJyUQ98TZeZk9hZN4qtY/qUPbtUlqtrCA7YP/h TyYWQHZaUah1cng/yr2clPx1/kVooPhFahBne7+WyPq4keSoYUf0Oq8JCngUp+Dt ZfkLKpe+jo/AuCJpvQKYIUS/wNqERcWO4mJByKA5OqXf2fcCsHQ1fC8MVNu7eC15 awavDc6pnz+p6/eSD/K7jT7sCXGuBAnvAbkZ4grTKHkQ1IeHOsTsRmJ65qzk7OpU uUkWrVWSWWOsATyHLg3Zb6G0eIORzHwB7RVG1sdDDk0BoiU8MGx1ciSJ5ailAkTK tJFsZuiSpCl2UVVbB7GDkOuW1B/POM8VbL519cSTsi17qHMEE4B+vTx16XpSv52Z SRwGRaESAh0v2+xXpFfLHt77WyGeJlNccIP5aOhDqZGXUUHAtb+EE1SqdyoBcYy4 Va/iiYY5EF9L3bCWnbQd0cl9uoQlNpFt5B6YDmhveEb7gqZIm+c255+ZfVo8nPY/ +jfikiNar7Y=k7vx -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 08, 2020
•Important
Red Hat
98
security advisorysecurity updateremote code executionRedHat: RHSA-2019-2860 Moderate: OpenShift Kibana Security Update
An update for kibana is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: OpenShift Container Platform 4.1.18 security update Advisory ID: RHSA-2019:2860-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2019:2860 Issue date: 2019-09-27 CVE Names: CVE-2019-7608 CVE-2019-7609 CVE-2019-7610 ==================================================================== 1. Summary: An update for kibana is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenShift Container Platform 4.1 - x86_64 3. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains updates to kibana in Red Hat OpenShift Container Platform 4.1.18. Security Fix(es): * kibana: Cross-site scripting vulnerability permits perform destructive actions on behalf of other Kibana users (CVE-2019-7608) * kibana: Arbitrary code execution flaw in the Timelion visualizer (CVE-2019-7609) * kibana: Audit logging Remote Code Execution issue (CVE-2019-7610) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For OpenShift ContainerPlatform 4.1 see the following documentation, which will be updated shortly for release 4.1.18, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.1/html/release_notes/ocp-4-1-release-notes 5. Bugs fixed (https://bugzilla.redhat.com/): 1696028 - CVE-2019-7608 kibana: Cross-site scripting vulnerability permits perform destructive actions on behalf of other Kibana users1696030 - CVE-2019-7609 kibana: Arbitrary code execution flaw in the Timelion visualizer 1696032 - CVE-2019-7610 kibana: Audit logging Remote Code Execution issue 6. Package List: Red Hat OpenShift Container Platform 4.1: Source: kibana-5.6.16-2.el7.src.rpm x86_64: kibana-5.6.16-2.el7.x86_64.rpm kibana-debuginfo-5.6.16-2.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-7608 https://access.redhat.com/security/cve/CVE-2019-7609 https://access.redhat.com/security/cve/CVE-2019-7610 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXY1nhtzjgjWX9erEAQjVGA/+M2/8BykyAZsS8sqwCakbM5/IpFHFbb7d uj/X8FeEcBvhPVG56mMNGRroN5oYH5DFPzJwyK06iOOe2T7bk2pWWdZFsdbT+eNZ P024EV3cuUZXbzWLyJvRHYqS4MQjpB8CrP7NIaFt+4TwjjPMDi+tpAAANreugw7R 7YYFU/7HT0WUjS6a9NPB4dygp3HgkyzmuKkApRlNd7f7EYzrBSH+t+D5ZJU84+uc 6b1tXgYIh6igQbuFgvXoOL8sS3+BYYI5AIjjhrpb1Pi6+jZMjShQ3trNilK8wIb/ wT/LnKqhsXEkeaFLn9mIn6OyxnlSCrJwazQmqIiB3u5j3HFcM/lOrJjtysnygPJD hlQoOp2Z67knd2mhNMHeygZSKMeW65pHLY1MHOSiQQoAdXTKQD79Eltxn1qSKUh0 sqxmdeynCLMiriEgTFAYYUmj8MGJ+OGSoux2c2/tphqS03rWIcl50AVbDBNzQEHP e1GGqAICI4UFgAfVUlW4Vuc0Q2H/NXKdK4QYsvf1J4MiODZL3XemIUgkN69GoLjY rI6uZFVEeZZhIlS0EAhEt0LIUlXggEWMer410BZFDXdbt1eeMsSWH0O31jcgjsMS uttMw8Z9AmfDaSE8RvzKeoaDapmz+e5ct7RHhvlPe5K+6/vuFWJ+E1zrx3XpVhmK LunMweg6j8c=1cg6 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 26, 2019
•Important
Red Hat
198
security advisoryhigh severityarbitrary code executionArch Linux: 201902-26 High Severity: Kibana Issues And Threats
The package kibana before version 6.6.1-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. . Arch Linux Security Advisory ASA-201902-26 ========================================= Severity: High Date : 2019-02-25 CVE-ID : CVE-2019-7608 CVE-2019-7609 CVE-2019-7610 Package : kibana Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-911 Summary ====== The package kibana before version 6.6.1-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========= Upgrade to 6.6.1-1. # pacman -Syu "kibana> =6.6.1-1" The problems have been fixed upstream in version 6.6.1. Workaround ========= None. Description ========== - CVE-2019-7608 (information disclosure) Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from, or perform destructive actions on behalf of, other Kibana users. - CVE-2019-7609 (arbitrary code execution) Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. - CVE-2019-7610 (arbitrary code execution) Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. Impact ===== An authenticated malicious user can disclose sensitive information or execute arbitrarycode. References ========= https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077 https://security.archlinux.org/CVE-2019-7608 https://security.archlinux.org/CVE-2019-7609 https://security.archlinux.org/CVE-2019-7610 . Arch Linux Security Advisory ASA-201902-26 ========================================= Severity: High . package, kibana, version, vulnerable, arbitrary. . LinuxSecurity.com Team
Feb 26, 2019
ArchLinux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!