Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -7 articles for you...
98
security advisoryred hatpatchRed Hat OpenShift 2.2.9 Advisory RHSA-2023:4623-01 Important: Envoy Issues
Red Hat OpenShift Service Mesh 2.2.9 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenShift Service Mesh 2.2.9 security update Advisory ID: RHSA-2023:4623-01 Product: Red Hat OpenShift Service Mesh Advisory URL: https://access.redhat.com/errata/RHSA-2023:4623 Issue date: 2023-08-11 CVE Names: CVE-2023-27487 CVE-2023-27488 CVE-2023-27491 CVE-2023-27492 CVE-2023-27493 CVE-2023-27496 ===================================================================== 1. Summary: Red Hat OpenShift Service Mesh 2.2.9 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation. Security Fix(es): * envoy: Client may fake the header `x-envoy-original-path` (CVE-2023-27487) * envoy: envoy doesn't escape HTTP header values (CVE-2023-27493) * envoy: gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received (CVE-2023-27488) * envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream (CVE-2023-27491) * envoy: Crash when a large request body is processed in Lua filter (CVE-2023-27492) * envoy: Crash when a redirect url without a state param is received in the oauth filter (CVE-2023-27496) For more details about the security issue(s), including the impact, a CVSS score,acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4. Bugs fixed (https://bugzilla.redhat.com/): 2179135 - CVE-2023-27487 envoy: Client may fake the header `x-envoy-original-path` 2179138 - CVE-2023-27491 envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream 2179139 - CVE-2023-27492 envoy: Crash when a large request body is processed in Lua filter 2182155 - CVE-2023-27496 envoy: Crash when a redirect url without a state param is received in the oauth filter 2182156 - CVE-2023-27488 envoy: gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received 2182158 - CVE-2023-27493 envoy: envoy doesn't escape HTTP header values 5. References: https://access.redhat.com/security/cve/CVE-2023-27487 https://access.redhat.com/security/cve/CVE-2023-27488 https://access.redhat.com/security/cve/CVE-2023-27491 https://access.redhat.com/security/cve/CVE-2023-27492 https://access.redhat.com/security/cve/CVE-2023-27493 https://access.redhat.com/security/cve/CVE-2023-27496 https://access.redhat.com/security/updates/classification/#important 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIcBAEBCAAGBQJk1pfaAAoJENzjgjWX9erE16UP/Az3YBHc2BsjRSY0/48IyI49 PZ8yFpBCQMocY7dnts48iFeeVZtQlFruLzOOvGWvaKyPCSiyC0XtTg/6sw71XCaf bpOsMXNV75ggf0tTO6JEgGqD326pdOnYqXMUfBnxvgtqQ/Ej1kyGCig+c7bEcvB0 l0m4NsAo224h8U33fnOPbgP/m/0elWCTcZbOUBLd+qRqwE9edZX4Chd+3l3pq5kg zJHLKHui/q+dAIqgsoK6CznTglUXuFQlYpu+vlAomrMGED7kx3t7QgttmhlL7krl rKIBgJml3nottyavLGmdCBiuklBlcNNV6LHZNkIEaIaH7Hlgbcb0AWHcOr97KXxQ K1ZpIdNOX0IDgltC3cGWbmiNmM45KSWKjCTUKXPiD0jlIxbuDIrqT25tOlNw4nRa R4hoiJUvUBl33zcg0q1JZmr9iYA7kKmrQUTgjMaFersmaeVaALBsmwdmTasaAsC0 jdNzrbRB2JCnozPUphYff6Zc0iIKKPmMKtAWDzdyor0eQ+7sPfXNyND2WC5OQtVS oLK/juc7CxQkMhOI09goLFMSUEO7czvKzdr5rzG8s1D7JHNtPLlCy2D0X4jAXIKD Ca53KIpxVrEUpmrApFvZscITKSyEGt0pouxEh2mFU6Op1ZcnONOeDXz7+KVfQTZZ 3+soC5oF43vm3/r9KJAz =xctn -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Aug 11, 2023
•Important
Red Hat
98
security advisoryRed HatimportantRed Hat OpenShift 2.0: RHSA-2021-2061 Important Authorization Bypass
An update for servicemesh is now available for OpenShift Service Mesh 2.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenShift Service Mesh 2.0.5 security update Advisory ID: RHSA-2021:2061-01 Product: Red Hat OpenShift Service Mesh Advisory URL: https://access.redhat.com/errata/RHSA-2021:2061 Issue date: 2021-05-20 CVE Names: CVE-2021-31921 ==================================================================== 1. Summary: An update for servicemesh is now available for OpenShift Service Mesh 2.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: 2.0 - ppc64le, s390x, x86_64 3. Description: Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. Security Fix(es): * istio/istio: authorization bypass when using AUTO_PASSTHROUGH (CVE-2021-31921) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: The OpenShift Service Mesh release notes provide information on the features and known issues: esh-release-notes.html 5. Bugs fixed (https://bugzilla.redhat.com/): 1955396 - CVE-2021-31921 istio/istio: authorization bypass when using AUTO_PASSTHROUGH 6. PackageList: 2.0: Source: servicemesh-2.0.5-3.el8.src.rpm ppc64le: servicemesh-2.0.5-3.el8.ppc64le.rpm servicemesh-istioctl-2.0.5-3.el8.ppc64le.rpm servicemesh-mixc-2.0.5-3.el8.ppc64le.rpm servicemesh-mixs-2.0.5-3.el8.ppc64le.rpm servicemesh-pilot-agent-2.0.5-3.el8.ppc64le.rpm servicemesh-pilot-discovery-2.0.5-3.el8.ppc64le.rpm s390x: servicemesh-2.0.5-3.el8.s390x.rpm servicemesh-istioctl-2.0.5-3.el8.s390x.rpm servicemesh-mixc-2.0.5-3.el8.s390x.rpm servicemesh-mixs-2.0.5-3.el8.s390x.rpm servicemesh-pilot-agent-2.0.5-3.el8.s390x.rpm servicemesh-pilot-discovery-2.0.5-3.el8.s390x.rpm x86_64: servicemesh-2.0.5-3.el8.x86_64.rpm servicemesh-istioctl-2.0.5-3.el8.x86_64.rpm servicemesh-mixc-2.0.5-3.el8.x86_64.rpm servicemesh-mixs-2.0.5-3.el8.x86_64.rpm servicemesh-pilot-agent-2.0.5-3.el8.x86_64.rpm servicemesh-pilot-discovery-2.0.5-3.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2021-31921 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYKZEi9zjgjWX9erEAQhHkQ//fm7MMI9+tRp+hlFL5Ndr5YzdeqdbLOHS CVplVd9lwsITgbSFBZC+az8gUZ/b1Cn4nnNaL9fthvzz3MOfBcEkdAezQQyuHEZQ 9oVGSHSvI40bbmz6Bdv5btoGBSE7TTvmjH4rLRioT6UUUsm6SkBOmm+Pjr8vX3fU RXwGHUn7krAKypeisr5Dsw63ehTI2XWBQuFRJaJTAqEjvOIfJIMKWa1kvTxEWUKD Xs8nEbwKIOi27VPoJj2OjS2uFJF8NWJnxc5HPn4cWm/i7CvZcsun5/ZZa3eLWwZ/ LYpIienNGpGup1P1L4EPm9d8lG/41sLdE/j6R2tPa4LYHV4vRZoa9Fj68X+CuLbT 6+n0OYevsWo1g7C+jgKBgsCzsu6V+J/rcCY4g2Zl9RUTCrknlz7xcto20KhDuhPy WG9Xe87ka5GbExU25kh/uJj7rMR0aF4QyE8SngEo5azY/wOALaLN9Y8Wb2QADv7x 3M8NYonDmRuvVGoo/aMkLTESTTyUMvfdZlt+oy8wrNPL/OQHaU8JYQVDPQvFVESW PCEzElB/wzqxFIA12qJG+hkgkLmh/vDTOFQS6ZalxAgM2n5qECjWDW8GGFNiVfs5 BDlIQsDLPK2hDPKF3GVbvRqo/uAsp2ppC8UQkKli6u8hOVPlt0hldzRbALncsa/e Ei92hP0HvKU=kAXH -----END PGP SIGNATURE----- -- RHSA-announce mailing list
May 20, 2021
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!