Stay Secure with the Latest Linux Advisories

security advisorysecurity issueFedora

Fedora 28: Security Advisory for lldpad - Improper Shell Code Sanitization

- Add upstream fix for improper sanitization of shell-escape codes when lldptool parses a mngAddr TLV (CVE-2018-10932). - Add upstream patch to support DSCP selectors in APP TLVs. This allows configuration of DSCP-based packet prioritization on capable network devices.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-cec7093baa 2018-10-26 17:06:17.983421 --------------------------------------------------------------------------------Name : lldpad Product : Fedora 28 Version : 1.0.1 Release : 10.git036e314.fc28 URL : / Summary : Intel LLDP Agent Description : This package contains the Linux user space daemon and configuration tool for Intel LLDP Agent with Enhanced Ethernet support for the Data Center. --------------------------------------------------------------------------------Update Information: - Add upstream fix for improper sanitization of shell-escape codes when lldptool parses a mngAddr TLV (CVE-2018-10932). - Add upstream patch to support DSCP selectors in APP TLVs. This allows configuration of DSCP-based packet prioritization on capable network devices. --------------------------------------------------------------------------------ChangeLog: * Tue Oct 23 2018 Petr Machata - 1.0.1-10.git036e314 - Add open-lldp-v1.0.1-29-basman_clif-print-the-OID-properly.patch (BZ 1614932, 1614896 (CVE-2018-10932) - Add open-lldp-v1.0.1-28-support-DSCP-selectors.patch (BZ 1618377) --------------------------------------------------------------------------------References: [ 1 ] Bug #1614896 - CVE-2018-10932 lldptool: improper sanitization of shell-escape codes https://bugzilla.redhat.com/show_bug.cgi?id=1614896 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-cec7093baa' at the command line. For more information, refer to the dnfdocumentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . This patch resolves a vulnerability in lldptool that impacts Fedora 28, thereby improving the overall security of the network.. lldpad security,Fedora update,network configuration,shell-escape sanitization,packet prioritization. . Severity: Important. LinuxSecurity.com Team

Oct 26, 2018 •Important Fedora