Moderate Photon OS Security Update - PHSA-2022-4.0-0305

Updates of 'go' packages of Photon OS have been released...

Moderate Photon OS Security Update - PHSA-2022-3.0-0509

Updates of 'go' packages of Photon OS have been released...

AlmaLinux 9 : toolbox (ALSA-2022:8098)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8098 advisory. - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if...

Important Photon OS Security Update - PHSA-2022-0282

Updates of 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-4.0-0282

Updates of 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-0541

Updates of 'go' packages of Photon OS have been released...

Oracle Linux 8 : grafana (ELSA-2022-7519)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-7519 advisory. - resolve CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse functions - resolve CVE-2022-1705 golang: net/http: improper sanitization of...

Important Photon OS Security Update - PHSA-2022-4.0-0273

Updates of 'go' packages of Photon OS have been released...

GHSA-69CH-W2M2-3VJP golang.org/x/text/language Denial of service via crafted Accept-Language header

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten t...

golang.org/x/text/language Denial of service via crafted Accept-Language header

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten t...

MGASA-2022-0356 Updated golang packages fix security vulnerability

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. CVE-2022-27664 JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path...

Important Photon OS Security Update - PHSA-2022-3.0-0455

Updates of 'ImageMagick', 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-0242

Updates of 'go' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-4.0-0242

Updates of 'go' packages of Photon OS have been released...

Moderate Photon OS Security Update - PHSA-2022-0498

Updates of 'go' packages of Photon OS have been released...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to an issue in OPM and Golang Go packages (CVE-2020-15257, CVE-2021-21334 and CVE-2021-41771)

Summary IBM MQ Operator catalog container image is vulnerable to an issue in OPM package from Red Hat openshift4/ose-operator-registry and IBM MQ Operator, IBM Supplied Queue Manager container images are vulnerable to an issue in the Golang Go packages. CVE-2020-15257, CVE-2021-21334 and...

Important Photon OS Security Update - PHSA-2022-0480

Updates of 'go' packages of Photon OS have been released...

LXD vulnerable to Race Condition

LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer has an unsafe Chmod call that races against the stat in the Filepath.Walk function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice. Specific Go Packages Affected...

GitHub Git LFS Arbitrary command execution vulnerability

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a url = line in a .lfsconfig file within a repository. Specific Go Packages Affected github.com/git-lfs/git-lfs/lfsapi...

Docker Registry has Allocation of Resources Without Limits or Throttling

Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service memory consumption via the manifest endpoint. Specific Go Packages Affected...