pki-core: access to external entities when parsing XML can lead to XXE (CVE-2022-2414) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 pki-core-debuginfo-10.5.18-24.el7_9.x86_64.rpm pki-symkey-10.5.18-24.el7_9.x86_64.rpm pki-tools-10.5.18-24.el7_9.x86_64.rpm noarch [More...]. Synopsis: Important: pki-core security update Advisory ID: SLSA-2022:8799-1 Issue Date: 2022-12-06 CVE Numbers: CVE-2022-2414 -- Security Fix(es): * pki-core: access to external entities when parsing XML can lead to XXE (CVE-2022-2414) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE -- SL7 x86_64 pki-core-debuginfo-10.5.18-24.el7_9.x86_64.rpm pki-symkey-10.5.18-24.el7_9.x86_64.rpm pki-tools-10.5.18-24.el7_9.x86_64.rpm noarch pki-base-10.5.18-24.el7_9.noarch.rpm pki-base-java-10.5.18-24.el7_9.noarch.rpm pki-ca-10.5.18-24.el7_9.noarch.rpm pki-javadoc-10.5.18-24.el7_9.noarch.rpm pki-kra-10.5.18-24.el7_9.noarch.rpm pki-server-10.5.18-24.el7_9.noarch.rpm - Scientific Linux Development Team . Critical pki-core patch addresses XXE flaw in Scientific Linux 7.x. Consult advisory SLSA-2022:8799-1 for comprehensive information.. pki-core, scientific linux, xml parsing, security advisory, xxee. . Severity: Critical. LinuxSecurity.com Team
Security fix for CVE-2018-1285. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-73d380e9b9 2020-05-24 03:27:16.087207 --------------------------------------------------------------------------------Name : log4net Product : Fedora 32 Version : 2.0.8 Release : 10.fc32 URL : https://logging.apache.org/log4net/ Summary : A .NET framework for logging Description : log4net is a tool to help the programmer output log statements to a variety of output targets. log4net is a port of the excellent log4j framework to the .NET runtime --------------------------------------------------------------------------------Update Information: Security fix for CVE-2018-1285 --------------------------------------------------------------------------------ChangeLog: * Fri May 15 2020 Timotheus Pokorra - 2.0.8-10 - apply security fix for xml configurator: [CVE-2018-1285] XXE vulnerability in Apache log4net --------------------------------------------------------------------------------References: [ 1 ] Bug #1835982 - CVE-2018-1285 log4net: XXE in applications that accept arbitrary configuration files from users https://bugzilla.redhat.com/show_bug.cgi?id=1835982 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-73d380e9b9' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.