Stay Secure with the Latest Linux Advisories

security advisorymoderatered hat

RedHat: RHSA-2020-4687-01 Moderate: oddjob Symlink Attack Risk

An update for oddjob is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: oddjob security, bug fix, and enhancement update Advisory ID: RHSA-2020:4687-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:4687 Issue date: 2020-11-03 CVE Names: CVE-2020-10737 ==================================================================== 1. Summary: An update for oddjob is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The oddjob packages contain a D-Bus service which performs particular tasks for clients which connect to it and issue requests using the system-wide message bus. The following packages have been upgraded to a later upstream version: oddjob (0.34.5). (BZ#1833289) Security Fix(es): * oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack (CVE-2020-10737) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from theReferences section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1833042 - CVE-2020-10737 oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack 1833289 - [Rebase] Rebase oddjob to 0.34.5 1886362 - oddjob-mkhomedir - homedir has a wrong permissions 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: oddjob-0.34.5-3.el8.src.rpm aarch64: oddjob-0.34.5-3.el8.aarch64.rpm oddjob-debuginfo-0.34.5-3.el8.aarch64.rpm oddjob-debugsource-0.34.5-3.el8.aarch64.rpm oddjob-mkhomedir-0.34.5-3.el8.aarch64.rpm oddjob-mkhomedir-debuginfo-0.34.5-3.el8.aarch64.rpm ppc64le: oddjob-0.34.5-3.el8.ppc64le.rpm oddjob-debuginfo-0.34.5-3.el8.ppc64le.rpm oddjob-debugsource-0.34.5-3.el8.ppc64le.rpm oddjob-mkhomedir-0.34.5-3.el8.ppc64le.rpm oddjob-mkhomedir-debuginfo-0.34.5-3.el8.ppc64le.rpm s390x: oddjob-0.34.5-3.el8.s390x.rpm oddjob-debuginfo-0.34.5-3.el8.s390x.rpm oddjob-debugsource-0.34.5-3.el8.s390x.rpm oddjob-mkhomedir-0.34.5-3.el8.s390x.rpm oddjob-mkhomedir-debuginfo-0.34.5-3.el8.s390x.rpm x86_64: oddjob-0.34.5-3.el8.x86_64.rpm oddjob-debuginfo-0.34.5-3.el8.x86_64.rpm oddjob-debugsource-0.34.5-3.el8.x86_64.rpm oddjob-mkhomedir-0.34.5-3.el8.x86_64.rpm oddjob-mkhomedir-debuginfo-0.34.5-3.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-10737 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/ 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBX6IzCtzjgjWX9erEAQgHWhAAnK2OemZ2/uWHQF1oo6WLYeR/yvOASFuY +6Imk0VA1QasN/Q1eqK3R9f3O5+NgIUPlifM0rPUY9D3LVjroZBfQI4rJ2o3hRN7 +HdP6bphlZ+BUIys+MtmExu/WWfnZvGDx62WDgvnQyh9k2NFECOkq9D3RGrg3i9Z EJQvkLIsu77EE8+uC5+U8JKKBCcgzBE33mRCw61UxhQKBc/N/89LpU9WzhSpDEMG wpe7GVXkNWHaDfQ1vnySRJ/7XZ8D9juZJ9TH0dVRnMZ39TcpYXOcS4EBtoqolYjq Gh4EsTrY4ooo1DIBTnx0Ok9yBr040nkOidLIuh0RWqmStwjw8v+WVkWlqSWtNr4w gIl1r1pzNJCHWUqroO2kruWkHvX9Z+eM4ktuLwQmIeC6T+eV/OQOjSaJfRW5br7N YSTHMuahM7avBrdH/FwWuTE2ytFDHRu/9WY3Lw52wiV5rs/biqliF2J9as+nHSnF IPqFbjMsciNbQrgQHYBLpLPmhmD0S+LxhtR9S8IkDlzGcoYfevL3MHr9+AZOhH4H vjV+4N5EB7dqmTyEw9YoeNFrijJseLAn4Qzu7Nr2kTCAVetYQ3hwfzWkgmXYoLrq VuwiMf8mMnyxftEeN+VOBGEFUTlpCvNw+W1NED712GBAVMalF7fDzYkzOoKQmifH o5EqHVAZo+U=pHJk -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Red Hat has issued a medium-level security patch for oddjob to mitigate a possible symlink attack vulnerability. Discover more details!. oddjob update, red hat advisory, Linux security update, moderate security fix. . LinuxSecurity.com Team

Nov 03, 2020 Red Hat