Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 11 articles for you...
98
security advisoryRed Hat Enterprise Linuxsecurity impactModerate Update: dmidecode Local File Overwrite in RHEL 8 RHSA-2023:5252-01
An update for dmidecode is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: dmidecode security update Advisory ID: RHSA-2023:5252-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:5252 Issue date: 2023-09-19 CVE Names: CVE-2023-30630 ===================================================================== 1. Summary: An update for dmidecode is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, x86_64 3. Description: The dmidecode packages provide utilities for extracting Intel 64 and Intel Itanium hardware information from the system BIOS or Extensible Firmware Interface (EFI), depending on the SMBIOS/DMI standard. This information typically includes system manufacturer, model name, serial number, BIOS version, and asset tag, as well as other details, depending on the manufacturer. Security Fix(es): * dmidecode: dump-bin to overwrite a local file (CVE-2023-30630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, referto: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2186669 - CVE-2023-30630 dmidecode: dump-bin to overwrite a local file 6. Package List: Red Hat Enterprise Linux BaseOS (v. 8): Source: dmidecode-3.3-4.el8_8.1.src.rpm aarch64: dmidecode-3.3-4.el8_8.1.aarch64.rpm dmidecode-debuginfo-3.3-4.el8_8.1.aarch64.rpm dmidecode-debugsource-3.3-4.el8_8.1.aarch64.rpm x86_64: dmidecode-3.3-4.el8_8.1.x86_64.rpm dmidecode-debuginfo-3.3-4.el8_8.1.x86_64.rpm dmidecode-debugsource-3.3-4.el8_8.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2023-30630 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJlCb3lAAoJENzjgjWX9erEvf8P/0Q5xme4wX46ceez/+txxBu1 yjx1WZK9JZvvOj8trsldeG6caztK9+cq2vBpYSy6LCqsxrv1vev5+X79q53M+D3e 4FLuLfvmv2+YU70Mw4gxui5inC4Vq9C3/74T3KrVDJAQmNRyxsjkRqFEHx3lrcI6 N/741+yZNQf2UhcJGfqXAXDXR3MJ6b6QKxPWlYDHc5h4tV6s9Y26LZdUE5qyPaU9 SAA7IRjaph92zy9+f/ndvPeQ2KTp/UgrxPoAav96+Lz0/Xuo+nahFLEVFEi+eCc3 J3mu/J/vViXd4h0Y5kgle74alPhcQyOxUbvs4kE5jCdGvJOM6Os7EZ6h0nVAn8dM y7NAAcwQ/IHL6/47wsapO5Q/GBzZymbYwWKZGcERJJxD8QRuOr+EeQ/AyC6ePScK n6KLbXyt+mBOH0+BzMAsaxJVvG5PaZMmiip7ECnqSeVv/zfPj8DZoiDp88AfzL+w +W2Zgk1gJH9u5jQlx/0IX5icOavxu2jnFT8F2K5rTg8dj5W30RGjYgainFzbt3on c/wBHlAY/3ipR+0GN28JfeWOqJ2yTFldpazczfBU4wSr4lHx9k395lH39pUo0yzR eWA1cdiCzUBRzbOvhofM89l8paghrfoasFI86Zc385TNSRu1nJ/LnjK5RUElZ5Wp qUolUpWxaMko2Dz+hYXX =QDC0 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 19, 2023
Red Hat
98
security advisorymoderatesecurity fixRHEL 9 RHSA-2023-5061 Moderate: Dmidecode Local File Overwrite
An update for dmidecode is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: dmidecode security update Advisory ID: RHSA-2023:5061-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:5061 Issue date: 2023-09-12 CVE Names: CVE-2023-30630 ===================================================================== 1. Summary: An update for dmidecode is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux BaseOS (v. 9) - aarch64, x86_64 3. Description: The dmidecode packages provide utilities for extracting Intel 64 and Intel Itanium hardware information from the system BIOS or Extensible Firmware Interface (EFI), depending on the SMBIOS/DMI standard. This information typically includes system manufacturer, model name, serial number, BIOS version, and asset tag, as well as other details, depending on the manufacturer. Security Fix(es): * dmidecode: dump-bin to overwrite a local file (CVE-2023-30630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, referto: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2186669 - CVE-2023-30630 dmidecode: dump-bin to overwrite a local file 6. Package List: Red Hat Enterprise Linux BaseOS (v. 9): Source: dmidecode-3.3-7.el9_2.1.src.rpm aarch64: dmidecode-3.3-7.el9_2.1.aarch64.rpm dmidecode-debuginfo-3.3-7.el9_2.1.aarch64.rpm dmidecode-debugsource-3.3-7.el9_2.1.aarch64.rpm x86_64: dmidecode-3.3-7.el9_2.1.x86_64.rpm dmidecode-debuginfo-3.3-7.el9_2.1.x86_64.rpm dmidecode-debugsource-3.3-7.el9_2.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2023-30630 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJlAINeAAoJENzjgjWX9erE1ggP/jpgP6tmujOEKsHNMmefIpfo h8Fs+hDUJxaD8BsFgKyVX3YEv4Gx/czFytIfiNmZAutM5B5kq6oVuojQv1/aUzq2 SQ4sbT3WJLcbz+Y8SgBnkiHvif7jCOCZ/KSe0J99Y7Oab54nx0ApA/Cjjj2CtHE6 U8UXNZh4S6mXn58AFM7Pstbk7bv+F9X2meKF+0uM6u5jEO87wXYR261DekaYS7uI ZEZ5R4tnQG3uZ6N4zrqf0GrDxamZfvFqRd1ENhN/lUa8GvTglDym1vnV49QBe0Ol L7BDDAx8Zd2rnD7+fHTxyIvFF5/rF7pp9IR+qvKtgci4Dtn/la+AYlZxnEv8RmHh b6SnSj2kxFPueAHBcMLeCF/ska7D2rEJflQcggEN0P+7cqIGnAXz5tRULBQ04dbc Zq3IZ56/vJ/djY2m7Lih34Z/Kq4pm61tNN0CO6g9GUZf4kF3LdWCmFflm0wzQHeH ZPx8rWXbH0Yeo5BL59p3stViYSQ4n1XlRscqPCWfisiAXS1zNWP1/lUli9Et3woA F0/cvMULK5jZtrA9hFMzuz/38EsbfOdinywVLMcS/DlylRIFul+yEfjgGMuGnfol X/YK4B0Zfdf2yd8tfRjQHy3LUK9tROYIgIj20GmNBoGA6J9Hs8ZiPFlytAb5nEQ7 zTNd47I4HgAeayIuwREi =9ZnK -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 12, 2023
Red Hat
89
security advisoryfedoracurlFedora 31: FEDORA-2020-55f1f7cb13 Critical: Curl Local File Safety
- avoid overwriting a local file with -J (CVE-2020-8177) - fix partial password leak over DNS on HTTP redirect (CVE-2020-8169). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-55f1f7cb13 2020-07-10 01:00:39.961680 --------------------------------------------------------------------------------Name : curl Product : Fedora 31 Version : 7.66.0 Release : 2.fc31 URL : https://curl.se/ Summary : A utility for getting files from remote servers (FTP, HTTP, and others) Description : curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks. --------------------------------------------------------------------------------Update Information: - avoid overwriting a local file with -J (CVE-2020-8177) - fix partial password leak over DNS on HTTP redirect (CVE-2020-8169) --------------------------------------------------------------------------------ChangeLog: * Wed Jun 24 2020 Kamil Dudka - 7.66.0-2 - avoid overwriting a local file with -J (CVE-2020-8177) - fix partial password leak over DNS on HTTP redirect (CVE-2020-8169) --------------------------------------------------------------------------------References: [ 1 ] Bug #1847915 - CVE-2020-8177 curl: command line arguments lead to local file overwrite https://bugzilla.redhat.com/show_bug.cgi?id=1847915 [ 2 ] Bug #1847916 - CVE-2020-8169 libcurl: partial password leak over DNS on HTTP redirect https://bugzilla.redhat.com/show_bug.cgi?id=1847916 --------------------------------------------------------------------------------This update canbe installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-55f1f7cb13' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jul 09, 2020
•Critical
Fedora
89
security advisorycriticalFedoraFedora 33: FEDORA-2020-8bd1aa7647 Important: wget Remote Code Execution
- avoid overwriting a local file with -J (CVE-2020-8177) - fix partial password leak over DNS on HTTP redirect (CVE-2020-8169). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-6af1dd2936 2020-06-27 02:05:35.505793 --------------------------------------------------------------------------------Name : curl Product : Fedora 32 Version : 7.69.1 Release : 4.fc32 URL : https://curl.se/ Summary : A utility for getting files from remote servers (FTP, HTTP, and others) Description : curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks. --------------------------------------------------------------------------------Update Information: - avoid overwriting a local file with -J (CVE-2020-8177) - fix partial password leak over DNS on HTTP redirect (CVE-2020-8169) --------------------------------------------------------------------------------ChangeLog: * Wed Jun 24 2020 Kamil Dudka - 7.69.1-4 - avoid overwriting a local file with -J (CVE-2020-8177) - fix partial password leak over DNS on HTTP redirect (CVE-2020-8169) --------------------------------------------------------------------------------References: [ 1 ] Bug #1847915 - CVE-2020-8177 curl: command line arguments lead to local file overwrite https://bugzilla.redhat.com/show_bug.cgi?id=1847915 [ 2 ] Bug #1847916 - CVE-2020-8169 libcurl: partial password leak over DNS on HTTP redirect https://bugzilla.redhat.com/show_bug.cgi?id=1847916 --------------------------------------------------------------------------------This update canbe installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-6af1dd2936' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jun 26, 2020
•Important
Fedora
100
security advisoryimportantSUSE LinuxSUSE: 2020:1734-1 Important: curl Local File Overwrite Security Fix
An update that fixes one vulnerability is now available. . SUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:1734-1 Rating: important References: #1173027 Cross-References: CVE-2020-8177 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP5 SUSE Linux Enterprise Server 12-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: - CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious server to overwrite a local file when using the -J option (bsc#1173027). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP5: zypper in -t patch SUSE-SLE-SDK-12-SP5-2020-1734=1 - SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-1734=1 Package List: - SUSE Linux Enterprise Software Development Kit 12-SP5 (aarch64 ppc64le s390x x86_64): curl-debuginfo-7.60.0-11.3.2 curl-debugsource-7.60.0-11.3.2 libcurl-devel-7.60.0-11.3.2 - SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64): curl-7.60.0-11.3.2 curl-debuginfo-7.60.0-11.3.2 curl-debugsource-7.60.0-11.3.2 libcurl4-7.60.0-11.3.2 libcurl4-debuginfo-7.60.0-11.3.2 - SUSE Linux Enterprise Server 12-SP5 (s390x x86_64): libcurl4-32bit-7.60.0-11.3.2 libcurl4-debuginfo-32bit-7.60.0-11.3.2 References: https://www.suse.com/security/cve/CVE-2020-8177.html https://bugzilla.suse.com/1173027 _______________________________________________ sle-security-updates mailing list
Jun 24, 2020
•Important
SuSE
172
security advisoryUbuntuinformation exposureUbuntu 20.04 LTS: USN-4402-1 Moderate: Curl Information Exposure
Several security issues were fixed in curl.. =========================================================================Ubuntu Security Notice USN-4402-1 June 24, 2020 curl vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 19.10 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 ESM - Ubuntu 12.04 ESM Summary: Several security issues were fixed in curl. Software Description: - curl: HTTP, HTTPS, and FTP client and client libraries Details: Marek Szlagor, Gregory Jefferis and Jeroen Ooms discovered that curl incorrectly handled certain credentials. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-8169) It was discovered that curl incorrectly handled certain parameters. An attacker could possibly use this issue to overwrite a local file. (CVE-2020-8177) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: curl 7.68.0-1ubuntu2.1 libcurl3-gnutls 7.68.0-1ubuntu2.1 libcurl3-nss 7.68.0-1ubuntu2.1 libcurl4 7.68.0-1ubuntu2.1 Ubuntu 19.10: curl 7.65.3-1ubuntu3.1 libcurl3-gnutls 7.65.3-1ubuntu3.1 libcurl3-nss 7.65.3-1ubuntu3.1 libcurl4 7.65.3-1ubuntu3.1 Ubuntu 18.04 LTS: curl 7.58.0-2ubuntu3.9 libcurl3-gnutls 7.58.0-2ubuntu3.9 libcurl3-nss 7.58.0-2ubuntu3.9 libcurl4 7.58.0-2ubuntu3.9 Ubuntu 16.04 LTS: curl 7.47.0-1ubuntu2.15 libcurl3 7.47.0-1ubuntu2.15 libcurl3-gnutls 7.47.0-1ubuntu2.15 libcurl3-nss 7.47.0-1ubuntu2.15 Ubuntu 14.04 ESM: curl 7.35.0-1ubuntu2.20+esm4 libcurl3 7.35.0-1ubuntu2.20+esm4 libcurl3-gnutls 7.35.0-1ubuntu2.20+esm4 libcurl3-nss 7.35.0-1ubuntu2.20+esm4 Ubuntu 12.04 ESM: curl 7.22.0-3ubuntu4.28 libcurl3 7.22.0-3ubuntu4.28 libcurl3-gnutls 7.22.0-3ubuntu4.28 libcurl3-nss 7.22.0-3ubuntu4.28 In general, a standard system update will make all the necessary changes. References: CVE-2020-8169, CVE-2020-8177 Package Information: https://launchpad.net/ubuntu/+source/curl/7.68.0-1ubuntu2.1 https://launchpad.net/ubuntu/+source/curl/7.65.3-1ubuntu3.1 https://launchpad.net/ubuntu/+source/curl/7.58.0-2ubuntu3.9 https://launchpad.net/ubuntu/+source/curl/7.47.0-1ubuntu2.15 . Significant security flaws in curl were patched by recent Ubuntu updates, highlighting issues of information leakage and potential for unauthorized file overwriting.. Ubuntu curl vulnerabilities security update. . LinuxSecurity.com Team
Jun 24, 2020
Ubuntu
98
security advisorybug fiximportantRed Hat Enterprise Linux 7: Update RHSA-2020-2116-01 for Buildah Issues
An update for buildah is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: buildah security and bug fix update Advisory ID: RHSA-2020:2116-01 Product: Red Hat Enterprise Linux Extras Advisory URL: https://access.redhat.com/errata/RHSA-2020:2116 Issue date: 2020-05-12 CVE Names: CVE-2020-1702 CVE-2020-10696 ==================================================================== 1. Summary: An update for buildah is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux 7 Extras - ppc64le, s390x, x86_64 3. Description: The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) * containers/image: Container images read entire image manifest into memory (CVE-2020-1702) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * buildah is not expanding env vars infile paths (BZ#1822031) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1792796 - CVE-2020-1702 containers/image: Container images read entire image manifest into memory 1817651 - CVE-2020-10696 buildah: Crafted input tar file may lead to local file overwrite during image build process 1822031 - buildah is not expanding env vars in file paths [extras-rhel-7.8/buildah] 6. Package List: Red Hat Enterprise Linux 7 Extras: Source: buildah-1.11.6-11.el7_8.src.rpm ppc64le: buildah-1.11.6-11.el7_8.ppc64le.rpm buildah-debuginfo-1.11.6-11.el7_8.ppc64le.rpm s390x: buildah-1.11.6-11.el7_8.s390x.rpm buildah-debuginfo-1.11.6-11.el7_8.s390x.rpm x86_64: buildah-1.11.6-11.el7_8.x86_64.rpm buildah-debuginfo-1.11.6-11.el7_8.x86_64.rpm Red Hat Enterprise Linux 7 Extras: Source: buildah-1.11.6-11.el7_8.src.rpm x86_64: buildah-1.11.6-11.el7_8.x86_64.rpm buildah-debuginfo-1.11.6-11.el7_8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-1702 https://access.redhat.com/security/cve/CVE-2020-10696 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXrr+YtzjgjWX9erEAQgHcA/8Cemka/UdjwZPlwS0qTtW7g3a4UUpOQT9 SDRHmOBWM3h9niD+RvxvRH/O15QvyqxFUOXqaQMzVLzHoHpAp2ytO2SUfvg1/v52 CElMjnavuBaKtduFjzUqV+OfdqGz66bq2L4PUBKqAyyShNmGteEf87gbE3/+v2/5 lsW0pqWqPG0tQUtPAqJZHZStc4gD6JmzLjPlbShQyLxd+KBjH1MgIWdLt6fS6LYY nY7KEGjUY/7CmQQp3CiZKTps0KArYH3i7BPCxEc81VcjV42ijKVXt9DN43sxnacv 2JPPP6h8HB6wAHtN+Km7uTsU4HO1A9OUkvE8D3argSVtQb5DfloRpa2KaOCXVFao Imqi2likMBu8tI47PlaIOslTNFxarkgECJMyE8LQxD8W3Vbgfxiq7Dk1GJIHVAbe tE18/5U3n0iL8LDGRoMp/y7a2gtCB4UGQ1VIHZWr3Fi0rPnKZo7rPjDfUocrF7vl jWaJQFVkgT/6FUAFs6MMyUFfxwWZtVLKorzbVVfIzo0RboxfTaNKfhgCkvSSlBwT GkwEDzTYSBDIiaDYokuk8PvZe1HDbCzBlghBvTrFDvbJaoivKbqas0idec4g6h2T WxMp+x9J3ALjqCb52RqUz+kY8IA5ARAcsmEscBpXKIU65dIi8v0YRTZbi3Z9DYWg 9GwAg6mZnpc=xJFh -----END PGP SIGNATURE----- -- RHSA-announce mailing list
May 12, 2020
•Important
Red Hat
98
security advisoryred hatbug fixRedHat: RHSA-2020-1926-01 Critical: container-tools Local File Overwrite
An update for the container-tools:1.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: container-tools:1.0 security and bug fix update Advisory ID: RHSA-2020:1926-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:1926 Issue date: 2020-04-28 CVE Names: CVE-2020-10696 ==================================================================== 1. Summary: An update for the container-tools:1.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * conflicting requests: failed to install container-tools:1.0 (BZ#1813776) * podman run container error with avc denied (BZ#1816541) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed(https://bugzilla.redhat.com/): 1776313 - create advisory for container-tools-1.0-8.2.0 1813776 - conflicting requests: failed to install container-tools:1.0 1816541 - podman run container error with avc denied 1817651 - CVE-2020-10696 buildah: Crafted input tar file may lead to local file overwrite during image build process 6. Package List: Red Hat Enterprise Linux AppStream (v.8): Source: buildah-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.src.rpm container-selinux-2.124.0-1.gitf958d0c.module+el8.2.0+6370+6fb6c8ca.src.rpm containernetworking-plugins-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.src.rpm criu-3.12-9.module+el8.2.0+6370+6fb6c8ca.src.rpm fuse-overlayfs-0.3-5.module+el8.2.0+6370+6fb6c8ca.src.rpm oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.src.rpm oci-umount-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.src.rpm podman-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.src.rpm runc-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.src.rpm skopeo-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.src.rpm slirp4netns-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.src.rpm aarch64: buildah-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm buildah-debuginfo-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm buildah-debugsource-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm containernetworking-plugins-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm containernetworking-plugins-debuginfo-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm containernetworking-plugins-debugsource-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm containers-common-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm crit-3.12-9.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm criu-3.12-9.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm criu-debuginfo-3.12-9.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm criu-debugsource-3.12-9.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm fuse-overlayfs-0.3-5.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm fuse-overlayfs-debuginfo-0.3-5.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm fuse-overlayfs-debugsource-0.3-5.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm oci-systemd-hook-debuginfo-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm oci-umount-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm oci-umount-debuginfo-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm podman-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm podman-debuginfo-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm podman-debugsource-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm python3-criu-3.12-9.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm runc-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm runc-debuginfo-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm runc-debugsource-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm skopeo-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm skopeo-debuginfo-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm skopeo-debugsource-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm slirp4netns-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm slirp4netns-debuginfo-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm slirp4netns-debugsource-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.aarch64.rpm noarch: container-selinux-2.124.0-1.gitf958d0c.module+el8.2.0+6370+6fb6c8ca.noarch.rpm podman-docker-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.noarch.rpm ppc64le: buildah-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm buildah-debuginfo-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm buildah-debugsource-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm containernetworking-plugins-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm containernetworking-plugins-debuginfo-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm containernetworking-plugins-debugsource-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm containers-common-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm crit-3.12-9.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm criu-3.12-9.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm criu-debuginfo-3.12-9.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm criu-debugsource-3.12-9.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm fuse-overlayfs-0.3-5.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm fuse-overlayfs-debuginfo-0.3-5.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm fuse-overlayfs-debugsource-0.3-5.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm oci-systemd-hook-debuginfo-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm oci-umount-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm oci-umount-debuginfo-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm podman-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm podman-debuginfo-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm podman-debugsource-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm python3-criu-3.12-9.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm runc-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm runc-debuginfo-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm runc-debugsource-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm skopeo-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm skopeo-debuginfo-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm skopeo-debugsource-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm slirp4netns-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm slirp4netns-debuginfo-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm slirp4netns-debugsource-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.ppc64le.rpm s390x: buildah-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.s390x.rpm buildah-debuginfo-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.s390x.rpm buildah-debugsource-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.s390x.rpm containernetworking-plugins-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.s390x.rpm containernetworking-plugins-debuginfo-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.s390x.rpm containernetworking-plugins-debugsource-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.s390x.rpm containers-common-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.s390x.rpm crit-3.12-9.module+el8.2.0+6370+6fb6c8ca.s390x.rpm criu-3.12-9.module+el8.2.0+6370+6fb6c8ca.s390x.rpm criu-debuginfo-3.12-9.module+el8.2.0+6370+6fb6c8ca.s390x.rpm criu-debugsource-3.12-9.module+el8.2.0+6370+6fb6c8ca.s390x.rpm fuse-overlayfs-0.3-5.module+el8.2.0+6370+6fb6c8ca.s390x.rpm fuse-overlayfs-debuginfo-0.3-5.module+el8.2.0+6370+6fb6c8ca.s390x.rpm fuse-overlayfs-debugsource-0.3-5.module+el8.2.0+6370+6fb6c8ca.s390x.rpm oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.s390x.rpm oci-systemd-hook-debuginfo-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.s390x.rpm oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.s390x.rpm oci-umount-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.s390x.rpm oci-umount-debuginfo-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.s390x.rpm oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.s390x.rpm podman-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.s390x.rpm podman-debuginfo-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.s390x.rpm podman-debugsource-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.s390x.rpm python3-criu-3.12-9.module+el8.2.0+6370+6fb6c8ca.s390x.rpm runc-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.s390x.rpm runc-debuginfo-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.s390x.rpm runc-debugsource-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.s390x.rpm skopeo-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.s390x.rpm skopeo-debuginfo-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.s390x.rpm skopeo-debugsource-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.s390x.rpm slirp4netns-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.s390x.rpm slirp4netns-debuginfo-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.s390x.rpm slirp4netns-debugsource-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.s390x.rpm x86_64: buildah-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm buildah-debuginfo-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm buildah-debugsource-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm containernetworking-plugins-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm containernetworking-plugins-debuginfo-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm containernetworking-plugins-debugsource-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm containers-common-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm crit-3.12-9.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm criu-3.12-9.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm criu-debuginfo-3.12-9.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm criu-debugsource-3.12-9.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm fuse-overlayfs-0.3-5.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm fuse-overlayfs-debuginfo-0.3-5.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm fuse-overlayfs-debugsource-0.3-5.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm oci-systemd-hook-debuginfo-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm oci-umount-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm oci-umount-debuginfo-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm podman-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm podman-debuginfo-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm podman-debugsource-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm python3-criu-3.12-9.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm runc-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm runc-debuginfo-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm runc-debugsource-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm skopeo-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm skopeo-debuginfo-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm skopeo-debugsource-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm slirp4netns-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm slirp4netns-debuginfo-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm slirp4netns-debugsource-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-10696 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXqiYbdzjgjWX9erEAQiX6Q//XAcN8Mxb59x6oBAW++pZssgKGyp2Vq1r /D5af9bhf5fDqqIoy2Y7fcJGurb66EeuZuwcwv3bB9bjsKd1vc48Ds+lJ+G8tNrZ 2B8WyApxox0xWCFAianKZD0EfGUTMUzK/d3WJ4RJyzuS45HoUZU9btlkiBOSMzFH rz1tusbQE5HQR/lgnwxyfBxJnokdNvK8QHN44H7Du2EQ+1j8VELvS6OKnfsMSbk5 yO0BpzBmt1wzdXmjtEynKMZQERbJNIlJUkI2c/IrePUvE303enNUrEl1c6WH1J8z h46ZxoNN7/AIywsz4cxAgxEe4pcd7SYJP6bT9epwqd4DO2zF0pSHvcbfwFCwQoPD BkWhmuPXmkFzO6au/PmflQp5yW6fcLsR8+ZmBCaNGOdfkmxMlueCFgDGGxGjA171 x1XLHMkpd3lLQHHycNb+7lDKPYlQq0PA64KHvkagaG+Y4yPbxDiGRI3iNeMHALnI w0A90AJLmL+rIQG9ypTSVPxnOxnF5x0v0irtTjucGdkxLQ2WJDCj4UiWbJO/Ig3V ghX9at4i94cEvJQPRnw9A0qiVqut+ynLucw3o4Lfz1/nLr+xn0psKHAC1rjIzq3Y FSiaHh7X7WoetPrO+ajs/1D2dewqvkzkET9vDFOZpj6m7K901GbLXs8xQigbwiok QXdz5UabWLM=mme8 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Apr 28, 2020
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!