Stay Secure with the Latest Linux Advisories

security advisorysecurity updateimportant

Red Hat OpenStack Platform 14: RHSA-2022-1045 Critical TLS Resolution

An update for rubygem-em-http-request is now available for Red Hat OpenStack Platform 13 (Queens). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: rubygem-em-http-request security update Advisory ID: RHSA-2021:0937-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2021:0937 Issue date: 2021-03-18 CVE Names: CVE-2020-13482 ==================================================================== 1. Summary: An update for rubygem-em-http-request is now available for Red Hat OpenStack Platform 13 (Queens). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 13.0 Operational Tools for RHEL 7 - ppc64le, x86_64 3. Description: EventMachine based, async HTTP Request client. Security Fix(es): * missing SSL hostname validation allows MITM (CVE-2020-13482) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1911457 - CVE-2020-13482 rubygem-em-http-request: missing SSL hostname validation allows MITM 6. Package List: Red Hat OpenStack Platform 13.0 Operational Tools for RHEL7: Source: rubygem-em-http-request-1.1.5-4.el7ost.src.rpm ppc64le: rubygem-em-http-request-1.1.5-4.el7ost.ppc64le.rpm rubygem-em-http-request-debuginfo-1.1.5-4.el7ost.ppc64le.rpm x86_64: rubygem-em-http-request-1.1.5-4.el7ost.x86_64.rpm rubygem-em-http-request-debuginfo-1.1.5-4.el7ost.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-13482 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYFNPltzjgjWX9erEAQhy4w/+JJrsRo5h3qFyZJG85pUWAY0PdewMtN6H 8qbUj3rj9NJ5jIa72ms3ELmG/KK/+Afrw09K5WpjRt3s0bKn4UUmiM1sP6mWH6XM TZ1JCWkwGhABGSc3DrH78mU31npPMOd99KO0DzpoXU096YcZonYqSJUQLrdvBfVK neCZOvOWaDqap9j/nkPqK49ZuK45VKE2fjvcmkNLLkVfjy0m4e51AIos9YXLDFa8 jGsuRJGeXhGCS3IskViOJZ79gtm2vZKPdNY7tyl9dgPlj30VJ2+7zgZqXdmwqaft 3BlCCv/HyDMCjqZZdqZxviqTGeAcVKZd3Oyu8iKlgW9BdIUvYkHnJM82KASDUPzC msbz8rMVphnadR1xEu8mKJLQRYe5XXsiP6fkPxJx40nt8FmNgZa70lg6eW5ZG5bS dY+gaYX6hU01+3xzzTCJjYYLYOyeGPw1jDiHz26yzz61CApC4nDs3vb8JrgT4brQ 7tBdHQy93BYJv4Q2+A/sgHGAsxC8EPjlwl1YDU8Oix8TX1887j1vyU6sKFntklIM 9d++Dpho+mz8vpURgOZv2BZQHYaY8/GLvuG/1KFiH6XlPDYddBZrDl3H2aoJpTQ1 QeY0UOcHCMqy74Pd4nIYcGZ7R1WFkk/U/EcfKGOAGEl0uLPrA/tfpkeR/SAGa1Pg fSUW1FsKuVU=MG1I -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. https://listman.redhat.com/mailman/listinfo/rhsa-announce . Crucial patch released for rubygem-em-http-client addressing SSL certificate verification problems and preventing potential MITM threats.. rubygem-em-http-request, Red Hat OpenStack, SSL Fix, Security Update. . Severity: Important. LinuxSecurity.com Team

Mar 18, 2021 •Important Red Hat