RPM: Multiple vulnerabilities

Background The Red Hat Package Manager RPM is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating computer software packages. Description Multiple vulnerabilities have been discovered in RPM. Please review the CVE identifiers...

RHEL 7 : nettle (RHSA-2021:2760)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2760 advisory. Nettle is a cryptographic library that is designed to fit easily in almost any context: In crypto toolkits for object-oriented languages, such as C++...

Medium: rpm

Issue Overview: A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highes...

Amazon Linux 2 : rpm (ALAS-2021-1689)

The version of rpm installed on the remote host is prior to 4.11.3-40. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1689 advisory. A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.6.38 extras and security update

Red Hat OpenShift Container Platform release 4.6.38 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a security impact of...

Moderate: Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.16.0

Release of OpenShift Serverless Client kn 1.16.0 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

EulerOS Virtualization 2.9.1 : rpm (EulerOS-SA-2021-2186)

According to the versions of the rpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a...

CentOS 7 : xstream (RHSA-2021:2683)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2683 advisory. - XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has...

Amazon Linux AMI : rpm (ALAS-2021-1521)

The version of rpm installed on the remote host is prior to 4.11.3-40.79. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1521 advisory. A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can...

Huawei EulerOS: Security Advisory for rpm (EulerOS-SA-2021-2197)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Medium: rpm

Issue Overview: A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highes...

EulerOS Virtualization 2.9.0 : rpm (EulerOS-SA-2021-2197)

According to the versions of the rpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a...

Huawei EulerOS: Security Advisory for rpm (EulerOS-SA-2021-2186)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Unbreakable Enterprise kernel security update

4.14.35-2047.505.4 - rds/ib: move rdsibclearirqmiss to .h file Manjunath Patil Orabug: 33044345 - rds/ib: recover rds connection from interrupt loss scenario Manjunath Patil Orabug: 32804265 - rds/ib: handle posted ACK during connection shutdown Manjunath Patil Orabug: 32863569 - rds/ib: reap tx...

CVE-2021-20266 affecting package rpm 4.14.2-15

CVE-2021-20266 affecting package rpm 4.14.2-15. A patched version of the package is available...

Citrix Hypervisor Open Source Licensing and Attribution

The Citrix Hypervisor product is a compilation of software packages. Each package is governed by its own license. The complete licensing terms applicable to a given package can be found in the source RPM of the package, unless the package is covered by a proprietary license which does not permit...

Advisory ROSA-SA-2021-1963

Software: rpm 4.11.3 OS: Cobalt 7.9 CVE-ID: CVE-2017-7501 CVE-Crit: HIGH CVE-DESC: It was discovered that rpm versions prior to 4.13.0.2 use temporary files with predictable names when installing RPM. An attacker with the ability to write to the directory where the files will be installed could...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.5.41 security update

Red Hat OpenShift Container Platform release 4.5.41 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whic...

CVE-2021-35938

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system...

CVE-2021-35937

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and...