The container bci/dotnet-runtime was updated. The following patches have been included in this update:. SUSE Container Update Advisory: bci/dotnet-runtime ----------------------------------------------------------------- Container Advisory ID : SUSE-CU-2024:251-1 Container Tags : bci/dotnet-runtime:7.0 , bci/dotnet-runtime:7.0-22.4 , bci/dotnet-runtime:7.0.15 , bci/dotnet-runtime:7.0.15-22.4 Container Release : 22.4 Severity : important Type : security References : 1211188 1211190 1217000 1218126 1218186 1218209 1218475 CVE-2023-1667 CVE-2023-2283 CVE-2023-48795 CVE-2023-6004 CVE-2023-6918 CVE-2024-22365 ----------------------------------------------------------------- The container bci/dotnet-runtime was updated. The following patches have been included in this update: ----------------------------------------------------------------- Advisory ID: SUSE-SU-2024:136-1 Released: Thu Jan 18 09:53:47 2024 Summary: Security update for pam Type: security Severity: moderate References: 1217000,1218475,CVE-2024-22365 This update for pam fixes the following issues: - CVE-2024-22365: Fixed a local denial of service during PAM login due to a missing check during path manipulation (bsc#1218475). - Check localtime_r() return value to fix crashing (bsc#1217000) ----------------------------------------------------------------- Advisory ID: SUSE-SU-2024:140-1 Released: Thu Jan 18 11:34:58 2024 Summary: Security update for libssh Type: security Severity: important References: 1211188,1211190,1218126,1218186,1218209,CVE-2023-1667,CVE-2023-2283,CVE-2023-48795,CVE-2023-6004,CVE-2023-6918 This update for libssh fixes the following issues: Security fixes: - CVE-2023-6004: Fixed command injection using proxycommand (bsc#1218209) - CVE-2023-48795: Fixed potential downgrade attack using strict kex (bsc#1218126) - CVE-2023-6918: Fixed missing checks for return values of MD functions (bsc#1218186) -CVE-2023-1667: Fixed NULL dereference during rekeying with algorithm guessing (bsc#1211188) - CVE-2023-2283: Fixed possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190) Other fixes: - Update to version 0.9.8 - Allow @ in usernames when parsing from URI composes - Update to version 0.9.7 - Fix several memory leaks in GSSAPI handling code The following package changes have been done: - libssh-config-0.9.8-150400.3.3.1 updated - libssh4-0.9.8-150400.3.3.1 updated - pam-1.3.0-150000.6.66.1 updated - container:sles15-image-15.0.0-36.5.74 updated . Enhancements implemented in the bci/dotnet-runtime container, focusing on critical security flaws and bolstering protective protocols.. bci/dotnet-runtime, container update, pam security, libssh updates, security patch. . Severity: Important. LinuxSecurity.com Team
An update for libssh is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Low: libssh security update Advisory ID: RHSA-2021:4387-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4387 Issue date: 2021-11-09 CVE Names: CVE-2020-16135 ==================================================================== 1. Summary: An update for libssh is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL (CVE-2020-16135) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory,refer to: https://access.redhat.com/articles/11258 After installing these updated packages, all running applications using libssh must be restarted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1862456 - CVE-2020-16135 libssh: NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): aarch64: libssh-debuginfo-0.9.4-3.el8.aarch64.rpm libssh-debugsource-0.9.4-3.el8.aarch64.rpm libssh-devel-0.9.4-3.el8.aarch64.rpm ppc64le: libssh-debuginfo-0.9.4-3.el8.ppc64le.rpm libssh-debugsource-0.9.4-3.el8.ppc64le.rpm libssh-devel-0.9.4-3.el8.ppc64le.rpm s390x: libssh-debuginfo-0.9.4-3.el8.s390x.rpm libssh-debugsource-0.9.4-3.el8.s390x.rpm libssh-devel-0.9.4-3.el8.s390x.rpm x86_64: libssh-debuginfo-0.9.4-3.el8.i686.rpm libssh-debuginfo-0.9.4-3.el8.x86_64.rpm libssh-debugsource-0.9.4-3.el8.i686.rpm libssh-debugsource-0.9.4-3.el8.x86_64.rpm libssh-devel-0.9.4-3.el8.i686.rpm libssh-devel-0.9.4-3.el8.x86_64.rpm Red Hat Enterprise Linux BaseOS (v. 8): Source: libssh-0.9.4-3.el8.src.rpm aarch64: libssh-0.9.4-3.el8.aarch64.rpm libssh-debuginfo-0.9.4-3.el8.aarch64.rpm libssh-debugsource-0.9.4-3.el8.aarch64.rpm noarch: libssh-config-0.9.4-3.el8.noarch.rpm ppc64le: libssh-0.9.4-3.el8.ppc64le.rpm libssh-debuginfo-0.9.4-3.el8.ppc64le.rpm libssh-debugsource-0.9.4-3.el8.ppc64le.rpm s390x: libssh-0.9.4-3.el8.s390x.rpm libssh-debuginfo-0.9.4-3.el8.s390x.rpm libssh-debugsource-0.9.4-3.el8.s390x.rpm x86_64: libssh-0.9.4-3.el8.i686.rpm libssh-0.9.4-3.el8.x86_64.rpm libssh-debuginfo-0.9.4-3.el8.i686.rpm libssh-debuginfo-0.9.4-3.el8.x86_64.rpm libssh-debugsource-0.9.4-3.el8.i686.rpm libssh-debugsource-0.9.4-3.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7.References: https://access.redhat.com/security/cve/CVE-2020-16135 https://access.redhat.com/security/updates/classification#low https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/8.5_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYYrdodzjgjWX9erEAQiqwg/7BYb207D8i9w/qntsnhHOFR4gtRGuVhsJ 6U2eVdsrxdP7TfIViRXr6CJLMK2Xqv793eXvb1Nlx1Yp/R8UpSpsKyBY3r2Sdbkt lDmVtEvgVoXW5LHfgRCkk0+/tHNz8YOzyiVhvlIb04vfHxwTge3s62UUylvnEu00 ss8farUPMhVK+ohPQDXYe7XaA31KqeFr0wz3wEXh5oHoX2Hor3AzK4fFM+id9xL8 ALOTm2Rp/Z7w050mc4HnM7883x1if2tYayQc7ZbXSJ96thEfv/5z9UIF0Gh5lTxU X/bVIUP2wUVpuLXZYPVN/aUNlemGNjWWVBMGqsRv0bTLjzT528NuEDJba73yJ7MM TMlw8+tIlu27FJv7LgK8pVTiJa981JhokTXYe5/h7bOpUoKxAWYW1ViK3mRO1iUh tTdRiJtuBJdVPMgtVn/WXpYYol4GQAb7EO4L1eD1CoRTUBfTt4/VarFF7c2QyWAi uCGjf8gSh8qR3YC6KQ5bMp69zQIYfTtStvlVKHjSGVX45x7QwUU3n7YOcAJgRoXW SLD2ZNIy3ai1WkyNFMKOrxYHmvhwy0NbtqY+EupqpurWFLgVUxFprxn5MfDwYM4W qJQxXHPXRMg8nzLmV6cGFs1nYwQxIXW+jDheQmdp2828KAFURDCxD06hNHIkXv68 3FtGTddeHIw=7sSo -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Get the latest Linux and open source security news straight to your inbox.