Red Hat AMQ Broker 7.4.5 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat AMQ Broker 7.4.5 release and security update Advisory ID: RHSA-2020:4154-01 Product: Red Hat JBoss AMQ Advisory URL: https://access.redhat.com/errata/RHSA-2020:4154 Issue date: 2020-10-01 Keywords: amq,messaging,integration,broker Cross references: RHBA-2020:59251-01 CVE Names: CVE-2015-5183 CVE-2019-9827 ==================================================================== 1. Summary: Red Hat AMQ Broker 7.4.5 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. This release of Red Hat AMQ Broker 7.4.5 serves as a replacement for Red Hat AMQ Broker 7.4.4, and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Security Fix(es): * hawtio: server side request forgery via initial /proxy/ substring of a URI (CVE-2019-9827) * hawtio: HTTPOnly and Secure attributes not set on cookies (CVE-2015-5183) For more details about the security issue(s), including the impact, a CVSS score, and other relatedinformation, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1249182 - CVE-2015-5183 Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ 1728604 - CVE-2019-9827 hawtio: server side request forgery via initial /proxy/ substring of a URI 5. References: https://access.redhat.com/security/cve/CVE-2015-5183 https://access.redhat.com/security/cve/CVE-2019-9827 https://access.redhat.com/security/updates/classification#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.broker&version=7.4.5&productChanged=yes https://docs.redhat.com/en/documentation/red_hat_amq/7.4 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX3W/5tzjgjWX9erEAQjJThAApjG/bmlh+jPfK6NeBY+N2MqmZK3XbSF3 5j92jpykgAjYacWR0/KRSytbvaIYjUVzJptzvezGvn/V/O1rFLcFFkjxo34BKg0n B9u+Zi6K+QqteNjpSkCvfLQxbQsdvrchT2Z9hBHqD8iwEzpHWuXFYLJiV3JF2dJB 7AQG1blNGM5vqSQY5L4cvWQWMYkIerHDGi2U1sDmuM5VPFNPQAQJjuTHS7cKE50a OtVtFuthuQMCe/fJR6oF47p7/gAeKlGhhdMsdHL9P09//BhNebpQacnC7Ovc5K8Z MWjoWfCZ1Wwv1Xi1ws/EMs0uuXTMuJWkyKhgAyKvkmjoViq1U2KibPWNfY26KAv8 X77zWzW0pcBKtWq+h1ppjg2lNhW3uSMs+MIZML0oYT7uR2WARRlGIdu44YWy2L0m eCgZhfPDJLnXAlXYqfOmjla1NsHiCCiES0l+8vjPsO0k3DFHC7UlSa8iO14HBwlj 3mCg3F4NE/gXPJlEp1cbEeWpmTK0fEE4GVehzUcoFRIPpvHELbrgrzHsVAC2VH3p mLF+7sSad3dmAOa49aQJ98E1BP0G5yPPNAAaP54LB19O5WOTmek/2rHZNM2qbBK8 95oF1Oq/vO7JdAvUmaslbT8jnQisNOkJ3SpeMJBweJOIROyyNcfCpEARX4r1fW1O IdBGX2CR+mA=tS1o -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Red Hat Ansible Tower 3.6.5-1 - RHEL7 Container 2. Description: * Removed reports option for Satellite inventory script * Fixed Tower Server Side Request Forgery on Credentials (CVE-2020-14327). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Ansible Tower 3.6.5-1 - RHEL7 Container Advisory ID: RHSA-2020:3329-01 Product: Red Hat Ansible Tower Advisory URL: https://access.redhat.com/errata/RHSA-2020:3329 Issue date: 2020-08-05 CVE Names: CVE-2020-14327 ==================================================================== 1. Summary: Red Hat Ansible Tower 3.6.5-1 - RHEL7 Container 2. Description: * Removed reports option for Satellite inventory script * Fixed Tower Server Side Request Forgery on Credentials (CVE-2020-14327) * Fixed the ``Job Type`` field to render properly when editing a Job Template * Fixed a notable delay running large project update clones * Fixed Tower to properly sync host facts for Red Hat Satellite 6.7 inventories * Fixed installations on Red Hat OpenShift 4.3 to no longer fail * Fixed the usage of certain SSH keys on RHEL8 when FIPS is enabled to work properly * Fixed upgrades from 3.5 to 3.6 on RHEL8 in order for PostgreSQL client libraries to be upgraded on Tower nodes, which fixes the backup/restore function * Fixed credential lookups from CyberArk AIM to no longer fail unexpectedly * Fixed the ability to add a user to an organization when they already had roles in the organization * Fixed manually added host variables to no longer be removed on VMWare vCenter inventory syncs * Fixed a number of issues related to Tower’s reporting of metrics to Red Hat Automation Analytics 3. Solution: For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://legacy-controller-docs.ansible.com/ansible-tower/ index.html 4. Bugs fixed(https://bugzilla.redhat.com/): 1856785 - CVE-2020-14327 Tower: SSRF: Server Side Request Forgery on Credential 5. References: https://access.redhat.com/security/cve/CVE-2020-14327 https://access.redhat.com/security/updates/classification#moderate 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXyrG7tzjgjWX9erEAQjTpA/9EkZENU9KqxjLw4K1CynuMe4NmCMsphgJ K8PPdrQNcGbZyAdFPoX0c1zzHWsEFJ8pcwGN4zO+qh3lpm2AuxJ3xiz8JRNMy62o 87qoVUbuP1RSWlkdkldK49j3XQcYs2LzWaokM9Y5H/wRGfaRDhg3Og4pOH4Lnkqi GK8UGLcxFkS0MCkIad7Uh0MrcvQ/5h3ijD9xWdg4/R2AxvOqn2RoW26clPJOZLVB QCP04WyUascWjBQBZHNBfdPqvJ1CfGrHnXcnRpNF7GdSPjCWtRBS9OyMjFVDz2a/ 9TA5WflLRhtVxB2FEFxeStewSsv9zOwSbu44Lf/6SDr1HlpKDR8PcViIlM+X6+N0 H1AevHi3H/uXTpGTLlTBlXG1BcJ8VGgP4FTu5N4y1gCoO7dAKyD1uMrDNAE3U5o0 bnNDo6nG2zJ9OuVgBEzyGUzxsX41mfRYs6dV/0hiKfzX7ZBu2tckLRUmGX0itLhT iiDUuDdffjBkUXRqYifBsW3cUttwR/nvFFLGyZMXLDJasd1YV2p4hXfto1rsUui/ XMVSJ+UrmqsLgmzlSnzM7w/HfheUy8+3xBJyVUUB7vHPM8Ajo29yLauCkGXl70T3 Dqv0lC4dD76a4d8KcVZPghW2benk5cIeYVSD94EnzllEje4pesS9p0eSqmQC7Amd F44f3+Z1Q9Y=1XgD -----END PGP SIGNATURE----- -- RHSA-announce mailing list
An update for openshift is now available for Red Hat OpenShift Container Platform 4.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: OpenShift Container Platform 4.2.36 openshift security update Advisory ID: RHSA-2020:2594-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2020:2594 Issue date: 2020-07-01 CVE Names: CVE-2020-8555 ==================================================================== 1. Summary: An update for openshift is now available for Red Hat OpenShift Container Platform 4.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenShift Container Platform 4.2 - s390x, x86_64 3. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. Security Fix(es): * kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information (CVE-2020-8555) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For OpenShift Container Platform 4.2 see the following documentation, which will be updated shortly for release 4.2.36, for important instructions on how to upgrade your cluster and fully apply this asynchronouserrata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.2/html/release_notes/ocp-4-2-release-notes Details on how to access this content are available at - -cli.html. 5. Bugs fixed (https://bugzilla.redhat.com/): 1821583 - CVE-2020-8555 kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information 6. Package List: Red Hat OpenShift Container Platform 4.2: Source: openshift-4.2.36-202006211650.p0.git.0.1fe246f.el7.src.rpm s390x: openshift-hyperkube-4.2.36-202006211650.p0.git.0.1fe246f.el7.s390x.rpm x86_64: openshift-hyperkube-4.2.36-202006211650.p0.git.0.1fe246f.el7.x86_64.rpm Red Hat OpenShift Container Platform 4.2: Source: openshift-4.2.36-202006211650.p0.git.0.1fe246f.el8.src.rpm s390x: openshift-hyperkube-4.2.36-202006211650.p0.git.0.1fe246f.el8.s390x.rpm x86_64: openshift-hyperkube-4.2.36-202006211650.p0.git.0.1fe246f.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-8555 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXvy0c9zjgjWX9erEAQjy8A//ZIw20sS8h7J4t5KV1Z5W3qUmrUgFHkS+ gG9FpmKjdS+NdaIwJdeNXw7MTDWneTme6eJqk1i1lVJkA2Dc/hnI3pwJrf7QLX7s 8vBTBrG+0FLoE2yJ3Hf035EPRiwB05dCft/GLYJ7yN6klOhEyS9IjTMqbUUVE9Zm Jwwl6wT5cT409xPrb+YTDqi685iVcoMTVLLeAx0YrJ7cIwaJlKOyYptu8kcfcPAF 2ZzBwyhWBMJaJuGj+EJPYF6zn/BIYq2jaWrjH+8k59KUnwnzY56w9iwEgCVcXTPq gb1hvqKUFzo55UCqMN3Q2zoNZmSWYNK4cDTWZLDBwCsZmbeTFim8HN8i5gSONDeC l4FPVrlHfrv5y0OTjXEJFLbGbLth67ddiVVnPo/wEkYTjcxuN4QUE456dKNOsY9S hzP+vQHSVdQvXvh8LdOk5XyLHPvVoU3o3BS5Y+pudhy5ND4ZXSZr9h9JeAAh9OcQ apByuBL/JuUAdL4YOrD7GJCEFm+a1dl5oAPnHXgxGj/kYOFCxYw3ZiSRMr+7AqQn yzRJPEcqeAwh4UUWOBZy2hFkErcs65YhCxIVEnv9B0CL8/fVu9xUKpiG51tY3rBx 1ANpLEn44Ztk9OyoJy1rbQj1riiqwshA/k3wNaMtxAC8v+9T6eC2bcgn6q51cmyE Ovjy3q1SoJw=ShMs -----END PGP SIGNATURE----- -- RHSA-announce mailing list
An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: OpenShift Container Platform 4.4.8 openshift-enterprise-hyperkube-container security update Advisory ID: RHSA-2020:2449-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2020:2449 Issue date: 2020-06-17 CVE Names: CVE-2020-8555 CVE-2020-8616 CVE-2020-8617 ==================================================================== 1. Summary: An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. Security Fix(es): * kubernetes: Server side request forgery (SSRF) in kube-controller-manager allowed users to leak secret information (CVE-2020-8555) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.8, for important instructions on how to upgrade your cluster and fully apply this asynchronouserrata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.4/html/release_notes/ocp-4-4-release-notes Details on how to access this content are available at - -cli.html. 4. Bugs fixed (https://bugzilla.redhat.com/): 1821583 - CVE-2020-8555 kubernetes: Server side request forgery (SSRF) in kube-controller-manager allows users to leak secret information 5. References: https://access.redhat.com/security/cve/CVE-2020-8555 https://access.redhat.com/security/cve/CVE-2020-8616 https://access.redhat.com/security/cve/CVE-2020-8617 https://access.redhat.com/security/updates/classification/#moderate 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXuqLpdzjgjWX9erEAQhgUA/+MFyqE3dTMThkrC7DSqFvfYkP07atApMQ +jNb8tzAuHnYOw/BNe1Z9ytPTlnwAEXtzW/02i6gZh/Z0gqw5wVQxmVxhxMrDYwd 97o+OR6VZU/iQi5UFhfHIutGiyjpOrEdc/kJx22Q0ANMt/4LHAlAm2PpYA4LZTOD 9jdhoOFjJ+yqK2CctcecYZZUTQGTMP3crgbKUdQwm7g74IZ1ccoCPltP+4kAMItf Kwe50v8ixRBSHsqaVNwFLp3Z5JT+HmjFSih0nrSxXZgejNgOw/QNsiJOCyRvGiW6 J9HfBu3OTN62Sre/3Wn1hA6cqokRqP8mAeKvi+AnB89S2dJANH2oahWdq6ixZ5JU l2vNltG6l4m7CVCzwfEJusWXwPU2wKLtmVUMXPEow/1QcJwPOg/UIr9/Rsf2OD1h G9EzTPiyVx1JfFvTbcGyN4q0Rt/20N5pEm5aZyER/zZLzGcToJB4lNuVTvIw5LBQ rHJ44tyg2VfGwft+hx2vhCbJBjkx/LJkkN2h4S5j5VbmDebto4TFUurlFsqTnBny 7mQ4zePo+c2/Feg8aKYMiefS28xfNm544hxnaBa5XmLcupUBlGsDYIs3MIRU/ca8 h2Vxnt799XSIhBJbLRJ6+iWeKUFSEZi9H9E13ufbLBXVYnCaoK5W3+Lu1gTnOe8c qPICdsri8Pg=GfPf -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Fixes CVE-2018-14718 CVE-2018-14719 CVE-2018-19360 CVE-2018-19361 CVE-2018-19362 CVE-2018-12022 CVE-2018-12023 CVE-2018-14720 CVE-2018-14721 and CVE-2016-7051.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-df57551f6d 2019-02-19 13:59:57.021257 --------------------------------------------------------------------------------Name : eclipse-linuxtools Product : Fedora 29 Version : 7.1.0 Release : 3.fc29 URL : https://eclipse.dev/linuxtools/ Summary : Linux specific Eclipse plugins Description : The Linux Tools project is a two-faceted project. Firstly, it develops tools and frameworks for writing tools for Linux developers. Secondly, it provides a place for Linux distributions to collaboratively overcome issues surrounding distribution packaging of Eclipse technology. The project will produce both best practices and tools related to packaging. --------------------------------------------------------------------------------Update Information: Fixes CVE-2018-14718 CVE-2018-14719 CVE-2018-19360 CVE-2018-19361 CVE-2018-19362 CVE-2018-12022 CVE-2018-12023 CVE-2018-14720 CVE-2018-14721 and CVE-2016-7051. --------------------------------------------------------------------------------ChangeLog: * Thu Feb 7 2019 Mat Booth - 7.1.0-3 - Rebuild against newer BC and Jackson * Thu Jan 31 2019 Fedora Release Engineering - 7.1.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild * Mon Dec 10 2018 Mat Booth - 7.1.0-1 - Update to 2018-12 release --------------------------------------------------------------------------------References: [ 1 ] Bug #1555900 - jackson-datatype-jdk8: FTBFS in F28 https://bugzilla.redhat.com/show_bug.cgi?id=1555900 [ 2 ] Bug #1604397 - jackson-datatype-jdk8: FTBFS in Fedora rawhide https://bugzilla.redhat.com/show_bug.cgi?id=1604397 [ 3 ] Bug #1671098 - CVE-2018-12022 jackson-databind: improper polymorphicdeserialization of types from Jodd-db library [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1671098 [ 4 ] Bug #1666490 - CVE-2018-19362 jackson-databind: improper polymorphic deserialization in jboss-common-core class [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1666490 [ 5 ] Bug #1666486 - CVE-2018-19361 jackson-databind: improper polymorphic deserialization in openjpa class [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1666486 [ 6 ] Bug #1666483 - CVE-2018-19360 jackson-databind: improper polymorphic deserialization in axis2-transport-jms class [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1666483 [ 7 ] Bug #1666429 - CVE-2018-14721 jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1666429 [ 8 ] Bug #1666424 - CVE-2018-14720 jackson-databind: exfiltration/XXE in some JDK classes [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1666424 [ 9 ] Bug #1666419 - CVE-2018-14719 jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1666419 [ 10 ] Bug #1666416 - CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1666416 [ 11 ] Bug #1380206 - CVE-2016-7051 jackson-dataformat-xml: XmlMapper is vulnerable to SSRF attack [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1380206 [ 12 ] Bug #1672925 - bouncycastle-1.61 is available https://bugzilla.redhat.com/show_bug.cgi?id=1672925 [ 13 ] Bug #1667118 - CVE-2018-1000873 jackson-datatype-jsr310: jackson-modules-java8: DoS due to an Improper Input Validation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1667118 [ 14 ] Bug #1671099 - CVE-2018-12023 jackson-databind: improper polymorphic deserialization of types from Oracle JDBCdriver [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1671099 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-df57551f6d' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Luc Lynx discovered that SVG Salamander, a SVG engine for Java was susceptible to server side request forgery. For the stable distribution (jessie), this problem has been fixed in . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3781-1
Get the latest Linux and open source security news straight to your inbox.