Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 1 articles for you...
100
security advisoryupdatecriticalSUSE: 2024:4105-1 critical advisory for tomcat10 security patch
* bsc#1233434 Cross-References: * CVE-2024-52316 . # Security update for tomcat10 Announcement ID: SUSE-SU-2024:4105-1 Release Date: 2024-11-28T15:09:20Z Rating: critical References: * bsc#1233434 Cross-References: * CVE-2024-52316 CVSS scores: * CVE-2024-52316 ( SUSE ): 10.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H * CVE-2024-52316 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-52316 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * Web and Scripting Module 15-SP5 * Web and Scripting Module 15-SP6 An update that solves one vulnerability can now be installed. ## Description: This update for tomcat10 fixes the following issues: * Update to Tomcat 10.1.33 * Fixed CVEs: * CVE-2024-52316: If the Jakarta Authentication fails with an exception, set a 500 status (bsc#1233434) * Catalina * Add: Add support for the new Servlet API method HttpServletResponse.sendEarlyHints(). (markt) * Add: 55470: Add debug logging that reports the class path when a ClassNotFoundException occurs in the digester or the web application class loader. Based on a patch by Ralf Hauser. (markt) * Update: 69374: Properly separate between table header and body in DefaultServlet's listing. (michaelo) * Update: 69373: Make DefaultServlet's HTML listing file last modified rendering better (flexible). (michaelo) * Update: Improve HTML output of DefaultServlet. (michaelo) * Code: Refactor RateLimitFilter to use FilterBase as the base class. The primary advantage is less code to process init-param values. (markt) * Update: 69370: DefaultServlet's HTML listing uses incorrect labels.(michaelo) * Fix: Avoid NPE in CrawlerSessionManagerValve for partially mapped requests. (remm) * Fix: Add missing WebDAV Lock-Token header in the response when locking a folder. (remm) * Fix: Invalid WebDAV lock requests should be rejected with 400. (remm) * Fix: Fix regression in WebDAV when attempting to unlock a collection. (remm) * Fix: Verify that destination is not locked for a WebDAV copy operation. (remm) * Fix: Send 415 response to WebDAV MKCOL operations that include a request body since this is optional and unsupported. (remm) * Fix: Enforce DAV: namespace on WebDAV XML elements. (remm) * Fix: Do not allow a new WebDAV lock on a child resource if a parent collection is locked (RFC 4918 section 6.1). (remm) * Fix: WebDAV DELETE should remove any existing lock on successfully deleted resources. (remm) * Update: Remove WebDAV lock null support in accordance with RFC 4918 section 7.3 and annex D. Instead, a lock on a non-existing resource will create an empty file locked with a regular lock. (remm) * Update: Rewrite implementation of WebDAV shared locks to comply with RFC 4918. (remm) * Update: Implement WebDAV If header using code from the Apache Jackrabbit project. (remm) * Add: Add PropertyStore interface in the WebDAV Servlet, to allow implementation of dead properties storage. The store used can be configured using the propertyStore init parameter of the WebDAV servlet by specifying the class name of the store. A simple non-persistent implementation is used if no custom store is configured. (remm) * Update: Implement WebDAV PROPPATCH method using the newly added PropertyStore, and update PROPFIND to support it. (remm) * Fix: Cache not found results when searching for web application class loader resources. This addresses performance problems caused by components such as java.sql.DriverManager, which in some circumstances will search for the same class repeatedly. The size of the cache can be controlled via the newnotFoundClassResourceCacheSize on the StandardContext. (markt) * Fix: Stop after INITIALIZED state should be a noop since it is possible for subcomponents to be in FAILED after init. (remm) * Fix: Fix incorrect web resource cache size calculations when there are concurrent PUT and DELETE requests for the same resource. (markt) * Add: Add debug logging for the web resource cache so the current size can be tracked as resources are added and removed. (markt) * Update: Replace legacy WebDAV opaquelocktoken: scheme for lock tokens with urn:uuid: as recommended by RFC 4918, and remove secret init parameter. (remm) * Fix: Concurrent reads and writes (e.g. GET and PUT / DELETE) for the same path caused corruption of the FileResource where some of the fields were set as if the file exists and some as set as if it does not. This resulted in inconsistent metadata. (markt) * Fix: 69415: Ensure that the ExpiresFilter only sets cache headers on GET and HEAD requests. Also, skip requests where the application has set Cache-Control: no-store. (markt) * Fix: 69419: Improve the performance of ServletRequest.getAttribute() when there are multiple levels of nested includes. Based on a patch provided by John Engebretson. (markt) * Add: All applications to send an early hints informational response by calling HttpServletResponse.sendError() with a status code of 103. (schultz) * Fix: Ensure that ServerAuthModule.initialize() is called when a Jakarta Authentication module is configured via registerServerAuthModule(). (markt) * Fix: Ensure that the Jakarta Authentication CallbackHandler only creates one GenericPrincipal in the Subject. (markt) * Fix: If the Jakarta Authentication process fails with an Exception, explicitly set the HTTP response status to 500 as the ServerAuthContext may not have set it. (markt) * Fix: When persisting the Jakarta Authentication provider configuration, create any necessary parent directories that don't already exist. (markt) * Fix: Correct the logicused to detect errors when deleting temporary files associated with persisting the Jakarta Authentication provider configuration. (markt) * Fix: When processing Jakarta Authentication callbacks, don't overwrite a Principal obtained from the PasswordValidationCallback with null if the CallerPrincipalCallback does not provide a Principal. (markt) * Fix: Avoid store config backup loss when storing one configuration more than once per second. (remm) * Fix: 69359: WebdavServlet duplicates getRelativePath() method from super class with incorrect Javadoc. (michaelo) * Fix: 69360: Inconsistent DELETE behavior between WebdavServlet and DefaultServlet. (michaelo) * Fix: Make WebdavServlet properly return the Allow header when deletion of a resource is not allowed. (michaelo) * Fix: Add log warning if non-wildcard mappings are used with the WebdavServlet. (remm) * Fix: 69361: Ensure that the order of entries in a multi-status response to a WebDAV is consistent with the order in which resources were processed. (markt) * Fix: 69362: Provide a better multi-status response when deleting a collection via WebDAV fails. Empty directories that cannot be deleted will now be included in the response. (markt) * Fix: 69363: Use getPathPrefix() consistently in the WebDAV servlet to ensure that the correct path is used when the WebDAV servlet is mounted at a sub-path within the web application. (markt) * Fix 69320, a regression in the fix for 69302 that meant the HTTP/2 processing was likely to be broken for all clients once any client sent an HTTP/2 reset frame. (markt) * Fix: Improve performance of ApplicationHttpRequest.parseParameters(). Based on sample code and test cases provided by John Engebretson. (markt) * Fix: Correct regressions in the refactoring that added recycling of the coyote request and response to the HTTP/2 processing. (markt) * Add: Add support for RFC 8297 (Early Hints). Applications can use this feature by casting the HttpServletResponse toorg.apache.catalina.connector. Response and then calling the method void sendEarlyHints(). This method will be added to the Servlet API (removing the need for the cast) in Servlet 6.2 onwards. (markt) * Fix: 69214: Do not reject a CORS request that uses POST but does not include a content-type header. Tomcat now correctly processes this as a simple CORS request. Based on a patch suggested by thebluemountain. (markt) * Fix: Refactor SpnegoAuthenticator so it uses Subject.callAs() rather than Subject.doAs() when available. (markt) * Fix: Allow JAASRealm to use the configuration source to load a configured configFile, for easier use with testing. (remm) * Fix: Add missing algorithm callback to the JAASCallbackHandler. (remm) * Fix: Add the OpenSSL version number on the APR and OpenSSL status classes. (remm) * Fix: 69131: Expand the implementation of the filter value of the Authenticator attribute allowCorsPreflight, so that it applies to all requests that match the configured URL patterns for the CORS filter, rather than only applying if the CORS filter is mapped to /*. (markt) * Fix: Using the OpenSSLListener will now cause the connector to use OpenSSL if available. (remm) * Coyote * Fix: Return null SSL session id on zero-length byte array returned from the SSL implementation. (remm) * Fix: Skip OpenSSLConf with BoringSSL since it is unsupported. (remm) * Fix: Create the HttpParser in Http11Processor if it is not present on the AbstractHttp11Protocol to provide better lifecycle robustness for regular HTTP/1.1. The new behavior was introduced in a previous refactoring to improve HTTP/2 performance. (remm) * Fix: OpenSSLContext will now throw a KeyManagementException if something is known to have gone wrong in the init method, which is the behavior documented by javax.net.ssl.SSLContext.init. This makes error handling more consistent. (remm) * Fix: 69379: The default HEAD response no longer includes the payload HTTP header fields as per section 9.3.2 of RFC 9110.(markt) * Fix: 69316: Ensure that FastHttpDateFormat#getCurrentDate() (used to generate Date headers for HTTP responses) generates the correct string for the given input. Prior to this change, the output may have been wrong by one second in some cases. Pull request #751 provided by Chenjp. (markt) * Fix: Request start time may not have been accurately recorded for HTTP/1.1 requests preceded by a large number of blank lines. (markt) * Add: Add server and serverRemoveAppProvidedValues to the list of attributes the HTTP/2 protocol will inherit from the HTTP/1.1 connector it is nested within. (markt) * Fix: Avoid possible crashes when using Apache Tomcat Native, caused by destroying SSLContext objects through GC after APR has been terminated. (remm) * Fix: Improve HTTP/2 handling of trailer fields for requests. Trailer fields no longer need to be received before the headers of the subsequent stream, nor are trailer fields for an in-progress stream swallowed if the Connector is paused before the trailer fields are received. (markt) * Fix: Ensure the request and response are not recycled too soon for an HTTP/2 stream when a stream-level error is detected during the processing of incoming HTTP/2 frames. This could lead to incorrect processing times appearing in the access log. (markt) * Fix: Correct a regression in the fix for non-blocking reads of chunked request bodies that caused InputStream.available() to return a non-zero value when there was no data to read. In some circumstances this could cause a blocking read to block waiting for more data rather than return the data it had already received. (markt) * Add: Add a new attribute cookiesWithoutEquals to the Rfc6265CookieProcessor. The default behaviour is unchanged. (markt) * Fix: Ensure that Tomcat sends a TLS close_notify message after receiving one from the client when using the OpenSSLImplementation. (markt) * Fix: 69301: Fix trailer headers replacing non-trailer headers when writing response headers to the access log.Based on a patch and test case provided by hypnoce. (markt) * Fix: 69302: If an HTTP/2 client resets a stream before the request body is fully written, ensure that any ReadListener is notified via a call to ReadListener.onError(). (markt) * Fix: Ensure that HTTP/2 stream input buffers are only created when there is a request body to be read. (markt) * Code: Refactor creation of HttpParser instances from the Processor level to the Protocol level since the parser configuration depends on the protocol and the parser is, otherwise, stateless. (markt) * Add: Align HTTP/2 with HTTP/1.1 and recycle the container internal request and response processing objects by default. This behaviour can be controlled via the new discardRequestsAndResponses attribute on the HTTP/2 upgrade protocol. (markt) * Fix: Clean and log OpenSSL errors before processing of OpenSSL conf commands in the FFM code. (remm) * Fix: 69121: Ensure that the onComplete() event is triggered if AsyncListener. onError() dispatches to a target that throws an exception. (markt) * Fix: Following the trailer header field refactoring, -1 is no longer an allowed value for maxTrailerSize. Adjust documentation accordingly. (remm) * Update: Move OpenSSL support using FFM to a separate JAR named tomcat-coyote-ffm. jar that advertises Java 22 in its manifest. (remm) * Fix: Fix search for OpenSSL library for FFM on Mac OS so that java.library.path is searched. (markt) * Update: Add FFM compatibility methods for LibreSSL support. Renegotiation is not supported at the moment. (remm) * Update: Add org.apache.tomcat.util.openssl.LIBRARY_NAME (specifies the name of the library to load) and org.apache.tomcat.util.openssl.USE_SYSTEM_LOAD_LIBRARY (set to true to use System.loadLibrary rather than the FFM library loading code) to configure the OpenSSL library loading using FFM. (remm) * Update: Add FFM compatibility methods for BoringSSL support. Renegotiation is not supported in many cases. (remm) * Jasper * Fix: Add backtag release method as deprecated in the runtime for compatibility with old generated code. (remm) * Fix: 69399: Fix regression caused by improvement 69333, which caused the tag release to be called when using tag pooling, and to be skipped when not using it. Patch submitted by Michal Sobkiewicz. (remm) * Fix: 69381: Improve method lookup performance in expression language. When the required method has no arguments, there is no need to consider casting or coercion, and the method lookup process can be simplified. Based on a pull request by John Engebretson. (markt) * Fix: 69382: Improve the performance of the JSP include action by re-using results of relatively expensive method calls in the generated code rather than repeating them. Patch provided by John Engebretson. (markt) * Fix: 69398: Avoid unnecessary object allocation in PageContextImpl. Based on a suggestion by John Engebretson. (markt) * Fix: 69406: When using StringInterpreterEnum, do not throw an IllegalArgumentException when an invalid Enum is encountered. Instead, resolve the value at runtime. Patch provided by John Engebretson. (markt) * Fix: 69429: Optimize EL evaluation of method parameters for methods that do not accept any parameters. Patch provided by John Engebretson. (markt) * Fix: Further optimize EL evaluation of method parameters. Patch provided by Paolo B. (markt) * Fix: 69333: Remove unnecessary code from generated JSPs. (markt) * Fix: 69338: Improve the performance of processing expressions that include AND or OR operations with more than two operands and expressions that use not empty. (markt) * Fix: 69348: Reduce memory consumption in ELContext by using lazy initialization for the data structure used to track lambda arguments. (markt) * Fix: Switch the TldScanner back to logging detailed scan results at debug level rather than trace level. (markt) * Fix: Update the optimisation in jakarta.el.ImportHandler so it is aware of new classes added to the java.lang package in Java 23. (markt) * Fix: Ensure that an exception in toString() still results in an ELException when an object is coerced to a String using ExpressionFactory.coerceToType(). (markt) * Add: Add support for specifying Java 24 (with the value 24) as the compiler source and/or compiler target for JSP compilation. If used with an Eclipse JDT compiler version that does not support these values, a warning will be logged and the default will be used. (markt) * Fix: 69135: When using include directives in a tag file packaged in a JAR file, ensure that context relative includes are processed correctly. (markt) * Fix: 69135: When using include directives in a tag file packaged in a JAR file, ensure that file relative includes are processed correctly. (markt) * Fix: 69135: When using include directives in a tag file packaged in a JAR file, ensure that file relative includes are not permitted to access files outside of the /META_INF/tags/ directory nor outside of the JAR file. (markt) * WebSocket * Fix: If a blocking message write exceeds the timeout, don't attempt the write again before throwing the exception. (markt) * Fix: An EncodeException being thrown during a message write should not automatically cause the connection to close. The application should handle the exception and make the decision whether or not to close the connection. (markt) * Web applications * Fix: The manager webapp will now be able to access certificates again when OpenSSL is used. (remm) * Fix: Documentation. Align the logging configuration documentation with the current defaults. (markt) * Fix: Fix status servlet detailed view of the connectors when using automatic port. (remm) * jdbc-pool * Fix: 69255: Correct a regression in the fix for 69206 that meant exceptions executing statements were wrapped in a java.lang.reflect.UndeclaredThrowableException rather than the application seeing the original SQLException. Fixed by pull request #744 provided by Michael Clarke. (markt) * Fix: 69279: Correct a regression in thefix for 69206 that meant that methods that previously returned a null ResultSet were returning a proxy with a null delegate. Fixed by pull request #745 provided by Huub de Beer. (markt) * Fix: 69206: Ensure statements returned from Statement methods executeQuery(), getResultSet() and getGeneratedKeys() are correctly wrapped before being returned to the caller. Based on pull request #742 provided by Michael Clarke. (markt) * Other * Update: Switch from DigiCert ONE to ssl.com eSigner for code signing. (markt) * Update: Update Byte Buddy to 1.15.10. (markt) * Update: Update CheckStyle to 10.20.0. (markt) * Add: Improvements to German translations. (remm) * Update: Update Byte Buddy to 1.15.3. (markt) * Update: Update CheckStyle to 10.18.2. (markt) * Add: Improvements to French translations. (remm) * Add: Improvements to Japanese translations by tak7iji. (markt) * Add: Improvements to Chinese translations by Ch_jp. (markt) * Add: Exclude the tomcat-coyote-ffm.jar from JAR scanning by default. (markt) * Fix: Change the default log handler level to ALL so log messages are not dropped by default if a logger is configured to use trace (FINEST) level logging. (markt) * Update: Update Hamcrest to 3.0. (markt) * Update: Update EasyMock to 5.4.0. (markt) * Update: Update Byte Buddy to 1.15.0. (markt) * Update: Update CheckStyle to 10.18.0. (markt) * Update: Update the internal fork of Apache Commons BCEL to 6.10.0. (markt) * Add: Improvements to Spanish translations by Fernando. (markt) * Add: Improvements to French translations. (remm) * Add: Improvements to Japanese translations by tak7iji. (markt) * Fix: Fix packaging regression with missing osgi information following addition of the test-only build target. (remm) * Update: Update Tomcat Native to 2.0.8. (markt) * Update: Update Byte Buddy to 1.14.18. (markt) * Add: Improvements to French translations. (remm) * Add: Improvements to Japanese translations by tak7iji.(markt) * Update: Add test-only build target to allow running only the testsuite, supporting Java versions down to the minimum supported to run Tomcat. (rjung) * Update: Update UnboundID to 7.0.1. (markt) * Update: Update to SpotBugs 4.8.6. (markt) * Update: Remove cglib dependency as it is not required by the version of EasyMock used by the unit tests. (markt) * Update: Update EasyMock to 5.3.0. This adds a test dependency on Byte-Buddy 1.14.17. (markt) * Add: Improvements to Czech translations by VladimÃr Chlup. (markt) * Add: Improvements to French translations. (remm) * Add: Improvements to Japanese translations by tak7iji. (markt) * Add: Improvements to Chinese translations by fangzheng. (markt) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-4105=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-4105=1 * Web and Scripting Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP5-2024-4105=1 * Web and Scripting Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP6-2024-4105=1 ## Package List: * openSUSE Leap 15.5 (noarch) * tomcat10-docs-webapp-10.1.33-150200.5.28.1 * tomcat10-lib-10.1.33-150200.5.28.1 * tomcat10-jsvc-10.1.33-150200.5.28.1 * tomcat10-jsp-3_1-api-10.1.33-150200.5.28.1 * tomcat10-el-5_0-api-10.1.33-150200.5.28.1 * tomcat10-servlet-6_0-api-10.1.33-150200.5.28.1 * tomcat10-10.1.33-150200.5.28.1 * tomcat10-webapps-10.1.33-150200.5.28.1 * tomcat10-admin-webapps-10.1.33-150200.5.28.1 * tomcat10-embed-10.1.33-150200.5.28.1 * openSUSE Leap 15.6 (noarch) * tomcat10-docs-webapp-10.1.33-150200.5.28.1 * tomcat10-lib-10.1.33-150200.5.28.1 * tomcat10-doc-10.1.33-150200.5.28.1 *tomcat10-jsvc-10.1.33-150200.5.28.1 * tomcat10-jsp-3_1-api-10.1.33-150200.5.28.1 * tomcat10-el-5_0-api-10.1.33-150200.5.28.1 * tomcat10-servlet-6_0-api-10.1.33-150200.5.28.1 * tomcat10-10.1.33-150200.5.28.1 * tomcat10-webapps-10.1.33-150200.5.28.1 * tomcat10-admin-webapps-10.1.33-150200.5.28.1 * tomcat10-embed-10.1.33-150200.5.28.1 * Web and Scripting Module 15-SP5 (noarch) * tomcat10-lib-10.1.33-150200.5.28.1 * tomcat10-jsp-3_1-api-10.1.33-150200.5.28.1 * tomcat10-el-5_0-api-10.1.33-150200.5.28.1 * tomcat10-servlet-6_0-api-10.1.33-150200.5.28.1 * tomcat10-10.1.33-150200.5.28.1 * tomcat10-webapps-10.1.33-150200.5.28.1 * tomcat10-admin-webapps-10.1.33-150200.5.28.1 * Web and Scripting Module 15-SP6 (noarch) * tomcat10-lib-10.1.33-150200.5.28.1 * tomcat10-jsp-3_1-api-10.1.33-150200.5.28.1 * tomcat10-el-5_0-api-10.1.33-150200.5.28.1 * tomcat10-servlet-6_0-api-10.1.33-150200.5.28.1 * tomcat10-10.1.33-150200.5.28.1 * tomcat10-webapps-10.1.33-150200.5.28.1 * tomcat10-admin-webapps-10.1.33-150200.5.28.1 ## References: * https://www.suse.com/security/cve/CVE-2024-52316.html * https://bugzilla.suse.com/show_bug.cgi?id=1233434 . Ubuntu Announcement UBU-SU-2024:6123-8 includes essential patches for nginx, resolving a major vulnerability.. Security Advisory,SUSE Linux,Tomcat 10 Update,Critical Patch. . Severity: Critical. LinuxSecurity.com Team
Nov 28, 2024
•Critical
SuSE
98
security advisorymoderatesecurity updateRed Hat 8: RHSA-2023-2706-01 Moderate: Single Sign-On 7.6.3 Update
New Red Hat Single Sign-On 7.6.3 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Single Sign-On 7.6.3 security update on RHEL 8 Advisory ID: RHSA-2023:2706-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2023:2706 Issue date: 2023-05-10 CVE Names: CVE-2021-0341 CVE-2022-4492 CVE-2022-38752 CVE-2022-41854 CVE-2022-41881 CVE-2022-45787 CVE-2023-0482 ==================================================================== 1. Summary: New Red Hat Single Sign-On 7.6.3 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Single Sign-On 7.6 for RHEL 8 - noarch 3. Description: Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.6.3 on RHEL 8 serves as a replacement for Red Hat Single Sign-On 7.6.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * okhttp: information disclosure via improperly used cryptographic function (CVE-2021-0341) * undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492) * snakeyaml: Uncaughtexception in java.base/java.util.ArrayList.hashCode (CVE-2022-38752) * dev-java/snakeyaml: DoS via stack overflow (CVE-2022-41854) * codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS (CVE-2022-41881) * apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider (CVE-2022-45787) * RESTEasy: creation of insecure temp files (CVE-2023-0482) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2129710 - CVE-2022-38752 snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode 2151988 - CVE-2022-41854 dev-java/snakeyaml: DoS via stack overflow 2153260 - CVE-2022-4492 undertow: Server identity in https connection is not checked by the undertow client 2153379 - CVE-2022-41881 codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS 2154086 - CVE-2021-0341 okhttp: information disclosure via improperly used cryptographic function 2158916 - CVE-2022-45787 apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider 2166004 - CVE-2023-0482 RESTEasy: creation of insecure temp files 6. Package List: Red Hat Single Sign-On 7.6 for RHEL 8: Source: rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el8sso.src.rpm noarch: rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el8sso.noarch.rpm rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el8sso.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7.References: https://access.redhat.com/security/cve/CVE-2021-0341 https://access.redhat.com/security/cve/CVE-2022-4492 https://access.redhat.com/security/cve/CVE-2022-38752 https://access.redhat.com/security/cve/CVE-2022-41854 https://access.redhat.com/security/cve/CVE-2022-41881 https://access.redhat.com/security/cve/CVE-2022-45787 https://access.redhat.com/security/cve/CVE-2023-0482 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZFuFsdzjgjWX9erEAQhFTw/+JA+RnMX2FVNb0F00SW8JiNlDfI6bHkL9 yGl32KFCRoRy1exUxzs8GGOwXh0hV2TbV+Z7De57cfGBEIs1z1eVGsOWrKEW/a6Q AaG9L1TO5Sz3G0DnUYrXCyKoeOr++gwSvxkLBDjJRBkSkeHos27zK+oM/xBy57VH gNTkBu0adgP/BGY9flS5QfnshcfiO6RvgESRglpL5RKgw1IYUbtF4BbG3fnkp34U iTC/u6wWmW+vbMP1r5d8tCIM5djbbz5QCwhuTk4b/NQ2Nqwnj1kU0DDrfSfNpZ9O BO+MrHyQwQAfjnPEFQtGpWGD3kj3QiOeLoDvz0yevkJBIiQbBbDBxxojma9ptJ8e fz7aaGorN5cG91emajgbtovEb5MZRPVMdiKukGcVlBXFoWoCNvdQGKD+Be/77xW6 d8MWAXAo/mdnz44xbtokH++Ky5mfLVbHE03efHHaOEob5UjLQe63k+INHxySFhpg j9mCXlFK8igx4GMyedYvPXxjdIztdnewAvs8uvyLDAMUk79S7JiamSRJFJNMoM++ IR7wqb0QoLcbnovXQKS1Bq3NZYMUo0TPh6nAhw7CEApWTV85nMJCY7tce05jRTlS o3oGoJZzGFdNWx3P2MRHAczQKpTV5V0UlohykyU5nMH0HxYoOMkW9s8Y6ToE+nHc X55z1z3U4zY=Sdcz -----END PGP SIGNATURE----- -- RHSA-announce mailing list
May 10, 2023
Red Hat
100
security advisorypatchimportantSUSE: 2022:3620-1 Critical Nodejs18 Vulnerabilities Addressed
An update that fixes four vulnerabilities is now available. . SUSE Security Update: Security update for nodejs16 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3615-1 Rating: important References: #1201325 #1201327 #1203831 #1203832 Cross-References: CVE-2022-32213 CVE-2022-32215 CVE-2022-35255 CVE-2022-35256 CVSS scores: CVE-2022-32213 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-32213 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2022-32215 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-32215 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2022-35255 (SUSE): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVE-2022-35256 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Web Scripting 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for nodejs16 fixes the following issues: Updated to version 16.17.1: - CVE-2022-32213: Fixed bypass via obs-fold mechanic (bsc#1201325). - CVE-2022-32215: Fixed incorrect Parsing of Multi-line Transfer-Encoding (bsc#1201327). - CVE-2022-35256: Fixed incorrect Parsing of Header Fields (bsc#1203832). - CVE-2022-35255:FIxed weak randomness in WebCrypto keygen (bsc#1203831). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3615=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP3-2022-3615=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs16-16.17.1-150300.7.12.1 nodejs16-debuginfo-16.17.1-150300.7.12.1 nodejs16-debugsource-16.17.1-150300.7.12.1 nodejs16-devel-16.17.1-150300.7.12.1 npm16-16.17.1-150300.7.12.1 - openSUSE Leap 15.3 (noarch): nodejs16-docs-16.17.1-150300.7.12.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (aarch64 ppc64le s390x x86_64): nodejs16-16.17.1-150300.7.12.1 nodejs16-debuginfo-16.17.1-150300.7.12.1 nodejs16-debugsource-16.17.1-150300.7.12.1 nodejs16-devel-16.17.1-150300.7.12.1 npm16-16.17.1-150300.7.12.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (noarch): nodejs16-docs-16.17.1-150300.7.12.1 References: https://www.suse.com/security/cve/CVE-2022-32213.html https://www.suse.com/security/cve/CVE-2022-32215.html https://www.suse.com/security/cve/CVE-2022-35255.html https://www.suse.com/security/cve/CVE-2022-35256.html https://bugzilla.suse.com/1201325 https://bugzilla.suse.com/1201327 https://bugzilla.suse.com/1203831 https://bugzilla.suse.com/1203832 . A significant SUSE patch targeting various vulnerabilities in nodejs16 has just been released for impacted distributions.. NodeJs Security Update, SUSE Linux Enterprise, Web Scripting. . Severity: Important. LinuxSecurity.com Team
Oct 18, 2022
•Important
SuSE
98
security advisoryRed Hatcritical fixRed Hat: RHSA-2022:0408 Critical Security Update for SSO 7.4.10 Released
A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Single Sign-On 7.4.10 security update Advisory ID: RHSA-2022:0408-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2022:0408 Issue date: 2022-02-02 CVE Names: CVE-2021-3859 ==================================================================== 1. Summary: A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.4.10 serves as a replacement for Red Hat Single Sign-On 7.4.9, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * undertow: client side invocation timeout raised when calling over HTTP and HTTP2 (CVE-2021-3859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and soon. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 2010378 - CVE-2021-3859 undertow: client side invocation timeout raised when calling over HTTP2 5. JIRA issues fixed (https://redhat.atlassian.net/jira/projects): CIAM-1977 - [CVE-2021-3859 (undertow)] One-off patch for RH-SSO 7.4.10 ZIP distribution 6. References: https://access.redhat.com/security/cve/CVE-2021-3859 https://access.redhat.com/security/updates/classification#important 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYfq9HNzjgjWX9erEAQjxixAAlk+sFKQxO4l1FuUI3JShzog4Wy28hUPu ZhtNCCpAqa3qleB6YpJKg8Q4s5lLySEGKFPAQ3BR73hYPUz5+oR0VdJlA/50xKwo HUtTzeD0q1/FgJfwBGlHk9VQ1OPQiTj/u10FruvbNd6PNeLbRNiMoLr3IegW/1/8 xYgH8fomayrcH97S6gB9xzkRfJbFdLZ6IF0TTmhiekkOsDeZ/dnMkWTvtNaqL6K0 Qi42tVmG7TiQaW1AouNDWX9sRDwA58wo5Yxburgn/ufxcG+tSVU8f/hpNc151LcU L6PTGo3cbNNgqZ5TL/4iZWf7oxSHJcSwC0xFDqHscrUDgyI9XjKmc18ohuZFaoIa 2tNRse+yVqN29ckf56lqne62YgShtxFAq35gIlprAV3pS0PRU1sXs2nY0LtuzgCz 3+ycgRV70rmoBgXsUOpHKu6+X0QXXlY6qoNAQQUXFb+Y1ZCI+S/ElHJB+oE7etpf 4+SkmSh6CjmYSHNZbnPM6LijJrOXT7NnPjAJ5UT9v3CFMXpKqx49qSrpi1pGusWn ZTmukqnnPGeZ2hqD9R1TTCXlysOYXnBEGAUvU2KBYjwjjfb1DzS/j6qCMRxbU1HT qbY0DwLNbshLTs6dxvA7Qj0X69PTYXES1QU8fPZmuDjm8GTKN6B07e4Yj8Y6srs2 QxYGiPm9AjM=Vs3b -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Feb 02, 2022
•Important
Red Hat
89
security advisoryupdatecriticalFedora 33 FEDORA-2020-4dd34860a3 Critical XSS in rubygem-activesupport
Upgrade to Ruby on Rails 6.0.3.3. Fixes CVEs: #1877568 #1831529 #1852381. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-4dd34860a3 2020-10-05 00:15:05.246453 --------------------------------------------------------------------------------Name : rubygem-activesupport Product : Fedora 33 Version : 6.0.3.3 Release : 1.fc33 URL : https://rubyonrails.org/ Summary : A support libraries and Ruby core extensions extracted from the Rails framework Description : A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing. --------------------------------------------------------------------------------Update Information: Upgrade to Ruby on Rails 6.0.3.3. Fixes CVEs: #1877568 #1831529 #1852381 --------------------------------------------------------------------------------ChangeLog: * Fri Sep 18 2020 Pavel Valena - 1:6.0.3.3-1 - Update to activesupport 6.0.3.3. Resolves: rhbz#1877502 - Fix evaluator test from web-console. - Properly fix flaky `FileStoreTest#test_filename_max_size` test case. --------------------------------------------------------------------------------References: [ 1 ] Bug #1831529 - CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1831529 [ 2 ] Bug #1852381 - CVE-2020-8185 rubygem-rails: untrusted users able to run pending migrations in production [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1852381 [ 3 ] Bug #1877568 - CVE-2020-15169 rubygem-actionview: rubygem-activeview: Cross-site scripting in translation helpers [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1877568 --------------------------------------------------------------------------------This update can beinstalled with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-4dd34860a3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Oct 04, 2020
•Critical
Fedora
98
security advisoryRed HatadvisoryRed Hat Security Advisory: RHSA-2020-2106-01 for SSO 7.3.8 Issues
New Red Hat Single Sign-On 7.3.8 packages are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Single Sign-On 7.3.8 security update on RHEL 6 Advisory ID: RHSA-2020:2106-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2020:2106 Issue date: 2020-05-12 CVE Names: CVE-2020-1718 CVE-2020-1724 CVE-2020-1758 ==================================================================== 1. Summary: New Red Hat Single Sign-On 7.3.8 packages are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Single Sign-On 7.3 for RHEL 6 Server - noarch 3. Description: Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.8 on RHEL 6 serves as a replacement for Red Hat Single Sign-On 7.3.7, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * keycloak: security issue on reset credential flow (CVE-2020-1718) * keycloak: improper verification of certificate with host mismatch could result in information disclosure (CVE-2020-1758) * keycloak: problem with privacy after user logout (CVE-2020-1724) For more details about the security issue(s), includingthe impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1796756 - CVE-2020-1718 keycloak: security issue on reset credential flow 1800527 - CVE-2020-1724 keycloak: problem with privacy after user logout 1812514 - CVE-2020-1758 keycloak: improper verification of certificate with host mismatch could result in information disclosure 6. JIRA issues fixed (https://redhat.atlassian.net/jira/projects): KEYCLOAK-13797 - Create RPMs for the RH-SSO 7.3.8 release for RHEL6 7. Package List: Red Hat Single Sign-On 7.3 for RHEL 6 Server: Source: rh-sso7-keycloak-4.8.20-1.Final_redhat_00001.1.el6sso.src.rpm noarch: rh-sso7-keycloak-4.8.20-1.Final_redhat_00001.1.el6sso.noarch.rpm rh-sso7-keycloak-server-4.8.20-1.Final_redhat_00001.1.el6sso.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 8. References: https://access.redhat.com/security/cve/CVE-2020-1718 https://access.redhat.com/security/cve/CVE-2020-1724 https://access.redhat.com/security/cve/CVE-2020-1758 https://access.redhat.com/security/updates/classification#important https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.3 9. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXrrRntzjgjWX9erEAQgBWRAAnqSzYpDyJMCXsKin1SxPhnRXtDf0Fvw9 b6u32OoXwmbVx/ejhlrAuZt5ykM1kYUkMBaMe3dmNIRlcTe7NFxRJtjw/UURO/Bj 3GLjUX6wgnZKjd13mHmkbnm48A/6lhpuDo2+NdM8aeuWc/USyj2VSbmWp79JqmuV vvNiFXhIFO2IvVfmJJ2BqVfrc53nk61ZUhyXXEW+UspwIQsKHLb7vLxHyz6lGpZO chf3O4zVUKky5dWZuT2w2pDV2I1ROOdVwSntTLmML9Q6IzgGdrWzoQlxMBk4Z+oA Ww8XLGwHJ4E6e0/0SLVb26nwBupRk8CtDaf41rNGIlMysDLcbHMrHkgNUsUKeAzl NlyvzJFxn7mV3NTsfaM8adOu4S6+9J1oWmgNeO54d5i01nJjCTIkLryrjjqzU/v1 xwPIiMMoGaJweKd2tok0NafdXi4gzPvNRmG8IyBpb+FV6H3CHci0WD5vUNwD3qZD 0/S3oCFe87Mcef3fffoKb5cjtZQ4JDWeKBo0znUtbBUwWL7RqpTc9k4b1xgSu2nc IGrWboUtoKO99Fyz7v0jWHD4MSx8in+Jk9zXRZtB/4waAJhRPKkC+Wt5+t80ue+T obRp/nLwopi+yw6y4TbIm1qmshwjhbnK6noewSzcRRmxkR1ngrnWFZrJNnJb9fDF xA5Pov0IYws=Arda -----END PGP SIGNATURE----- -- RHSA-announce mailing list
May 12, 2020
•Important
Red Hat
98
security advisorysecurity updatesecurity fixRedHat: RHSA-2020-0951-01 Critical Security Update for SSO 7.3.7 Released
A security update is now available for Red Hat Single Sign-On 7.3 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Single Sign-On 7.3.7 security update Advisory ID: RHSA-2020:0951-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2020:0951 Issue date: 2020-03-23 CVE Names: CVE-2019-0205 CVE-2019-0210 CVE-2019-10086 CVE-2019-12400 CVE-2019-14885 CVE-2019-14887 CVE-2019-20330 CVE-2019-20444 CVE-2019-20445 CVE-2020-1744 CVE-2020-7238 ==================================================================== 1. Summary: A security update is now available for Red Hat Single Sign-On 7.3 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.3.7 serves as a replacement for Red Hat Single Sign-On 7.3.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * libthrift: thrift: Endless loop when feed with specific input data (CVE-2019-0205) * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210) * commons-beanutils: apache-commons-beanutils: does notsuppresses the class property in PropertyUtilsBean by default (CVE-2019-10086) * xmlsec: xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source (CVE-2019-12400) * JBoss EAP: Vault system property security attribute value is revealed on CLI 'reload' command (CVE-2019-14885) * wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use (CVE-2019-14887) * jackson-databind: lacks certain net.sf.ehcache blocking (CVE-2019-20330) * netty: HTTP request smuggling (CVE-2019-20444) * netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header (CVE-2019-20445) * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238) * keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP (CVE-2020-1744) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1764607 - CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol 1764612 - CVE-2019-0205 thrift: Endless loop when feed with specific input data 1764658 - CVE-2019-12400 xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source 1767483 - CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default 1770615 - CVE-2019-14885 JBoss EAP: Vault system property security attribute value is revealed on CLI 'reload' command 1772008 - CVE-2019-14887 wildfly: The 'enabled-protocols' value in legacy security is notrespected if OpenSSL security provider is in use 1793154 - CVE-2019-20330 jackson-databind: lacks certain net.sf.ehcache blocking 1796225 - CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling 1798509 - CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header 1798524 - CVE-2019-20444 netty: HTTP request smuggling 1805792 - CVE-2020-1744 keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP 5. References: https://access.redhat.com/security/cve/CVE-2019-0205 https://access.redhat.com/security/cve/CVE-2019-0210 https://access.redhat.com/security/cve/CVE-2019-10086 https://access.redhat.com/security/cve/CVE-2019-12400 https://access.redhat.com/security/cve/CVE-2019-14885 https://access.redhat.com/security/cve/CVE-2019-14887 https://access.redhat.com/security/cve/CVE-2019-20330 https://access.redhat.com/security/cve/CVE-2019-20444 https://access.redhat.com/security/cve/CVE-2019-20445 https://access.redhat.com/security/cve/CVE-2020-1744 https://access.redhat.com/security/cve/CVE-2020-7238 https://access.redhat.com/security/updates/classification#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso&downloadType=securityPatches&version=7.3 https://docs.redhat.com/en/documentation/red_hat_single_sign-on/7.3 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXnkYj9zjgjWX9erEAQiTHhAApXKm1HP2WZtfXz1C4xJeCFdehaI7rOzm JDER7JDvhtpll9JnPdO9mQe2EsP8o96vwH5lKJxE34Hi6sR4ROVjW+wpS2f4wF+R GV9LWAzSw6skxwhgYZKhwLjSMPndisDA8OUCFfB0k4lPWpHweNs1C25m1FPpK2/B 0hZgzCN/VDVj/nDsv11bZT00EH83MxNOi9Jjj1kT9v1WE3cSCLrxyg3L3+p8d0QT aXfqOFJ8fLTDBIGwgqKfy9NnOxkR9AoiaeP9fnSJpLq3+YWS11ZD8Gmw2JayCtGe xS6FJAKHbu90cPM0mxDInBPwCQIm3XQEX0h0L+6bfGhcVuOmABdd3V/DURnHO/hZ NasO4LwlWx3hy32aRG53hLnbtQWHq1OFK0DGyU1RUEu1bDHCFqzJnT7HfS82gLJO lCDW5D3W1AYfJtr+Tr4z9m81yMWxzt8embrL81hmqYDxYEsDxS70FTXBPQlq4ERi lJ/QDJUhmW1B6qhSqMEPME1L3uu0BwlElfyLzCr7SIwuHEI5aK4LCZZ/hFulphTm I7nsdH1a/3PkDlmXzal7yRFhA7gwBO4//lHrarfALhxDtxQdC7mt9vZ4Tj2roO5U 5PLxDyH9K5+ZjYU/BdNOWCZ0hzs0saagTxkGPT+AbZJmY2IYNNuQZdb/nbo7ihWm AKt6O8M5K9Q=dKyX -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Mar 23, 2020
•Important
Red Hat
87
security advisorydebianapplication securityDebian DSA-3843-1 Critical: Tomcat8 Flaws Affecting Web Apps
Two vulnerabilities were discovered in tomcat8, a servlet and JSP engine. CVE-2017-5647 . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3843-1
May 03, 2017
•Critical
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!