Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
98
security advisoryred hatimportantRedHat: RHSA-2020-3806-01 Important: Spring Boot DoS and XSS Risks
An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat support for Spring Boot 2.2.6.SP2 security update Advisory ID: RHSA-2020:3806-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2020:3806 Issue date: 2020-09-23 CVE Names: CVE-2020-10688 CVE-2020-10693 CVE-2020-13934 CVE-2020-13935 ==================================================================== 1. Summary: An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform. This release of Red Hat support for Spring Boot 2.2.6.SP2 serves as a replacement for Red Hat support for Spring Boot 2.2.6.SP1, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section. Security Fix(es): * resteasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack (CVE-2020-10688) * hibernate-validator: Improper input validation in the interpolation of constraint error messages (CVE-2020-10693) * tomcat: multiple requests with invalidpayload length in a WebSocket frame could lead to DoS (CVE-2020-13935) * tomcat: OutOfMemoryException caused by HTTP/2 connection leak could lead to DoS (CVE-2020-13934) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1805501 - CVE-2020-10693 hibernate-validator: Improper input validation in the interpolation of constraint error messages 1814974 - CVE-2020-10688 RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack 1857024 - CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS 1857040 - CVE-2020-13934 tomcat: OutOfMemoryException caused by HTTP/2 connection leak could lead to DoS 5. References: https://access.redhat.com/security/cve/CVE-2020-10688 https://access.redhat.com/security/cve/CVE-2020-10693 https://access.redhat.com/security/cve/CVE-2020-13934 https://access.redhat.com/security/cve/CVE-2020-13935 https://access.redhat.com/security/updates/classification#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.spring.boot&version=2.2.6.SP2 https://docs.redhat.com/en/documentation/red_hat_support_for_spring_boot/2.2/html-single/release_notes_for_spring_boot_2.2/index#advisories-related-to-current-release-spring-boot 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBX2t3otzjgjWX9erEAQh26RAAgcJ7EUdFjrelpODcC8VN+yGcBSPLWrhs RS9ycDoUq8nQxCjmJ7ADo2QRpPowcPY9lt7VX6AEmqVi+rI4HwagZG4nUx/NQoq0 pGtZ0mgJ/YxGdLqJnNazoYXofqBq8yr2wojT3dVJ1RENyibFMR5bPYLAWSgoxuuB t8hsP7nwQzFU4c/BuoSgp2XLpGY2LtnrRIJgvicFS47HqtdfFqoiRLqci5/FJQ4n DxbfnAL6pCtoyEKJCWsUQQ28A2ONQHErC0Y8XONZrN+eKvEV4T6Dk/Bgeoc8iSr/ E7PL0n+mnuw9xhtPjxI2rzmgPx/jfjy35tYbR7kRoOxjP87dF2E3rhGLnj7HzX0W Z/V/dTwDJYGu3ryzp7/66txYY9uBBT0vvZl01GVakSxOog39okKfgX4Os+jUJCSU IDV/8zbc7V+tAuie1JrEuv4RyUBZi39AyU1WN6nsE43/eWHmzAvEBpQJpMpDfDgj nf7lFZfYzWAVCL80C6O5/qHVD0ZkNUviTuEt6cOb29JwK5dPioYgJrlE9antECJx Tzuqk+Q02kxVzThijNvMhLAoa+bqzs4mLSY6KIcYuHUD/OOFNSqfDm5ExgduXKhR LmUVon9pk6OJqw1C9XnHXKs9yd0kRvDjBh3DBDQykCMru+OsLqq6DOvdQ/GYF7ON wZsvtSdws5U=eT/H -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 23, 2020 •Important Red Hat 197
security advisorydenial of servicesoftware updateDebian 8: DLA-2227-1 Critical: Bind9 Denial Of Service Flaws
Several vulnerabilities were discovered in BIND, a DNS server implementation. . Package : bind9 Version : 1:9.9.5.dfsg-9+deb8u19 CVE ID : CVE-2020-8616 CVE-2020-8617 Several vulnerabilities were discovered in BIND, a DNS server implementation. CVE-2020-8616 It was discovered that BIND does not sufficiently limit the number of fetches performed when processing referrals. An attacker can take advantage of this flaw to cause a denial of service (performance degradation) or use the recursing server in a reflection attack with a high amplification factor. CVE-2020-8617 It was discovered that a logic error in the code which checks TSIG validity can be used to trigger an assertion failure, resulting in denial of service. For Debian 8 "Jessie", these problems have been fixed in version 1:9.9.5.dfsg-9+deb8u19. We recommend that you upgrade your bind9 packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Uncover essential updates for BIND9 within Debian LTS to maintain optimal functionality and safeguard against vulnerabilities.. bind9 update, denial of service, debian security, dns server security, jessie security fix. . Severity: Critical. LinuxSecurity.com Team
May 30, 2020 •Critical Debian LTS 
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!