RLSA-2024:0387 Moderate: php:8.1 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: 1-byte array overrun in common path resolve code CVE-2023-0568 php: DoS vulnerability when parsing multipart request body CVE-2023-0662 php: Missing error check and insufficient random bytes...

php:8.1 security update

An update is available for php-pecl-zip, module.php-pecl-apcu, php-pecl-xdebug3, module.php-pecl-xdebug3, php-pecl-rrd, module.php-pecl-rrd, module.php-pecl-zip, php-pecl-apcu. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

com.slack.api:bolt-micronaut (>=1.5.0-rc1, <=1.5.3) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (2.2.3)

io.micronaut:micronaut-http-server-netty MAVEN version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut =1.5.0-rc1, =1.5.3 Source cves: CVE-2024-23639...

com.bertramlabs.plugins:asset-pipeline-micronaut (>=3.3.1, <=4.3.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (2.0.2)

io.micronaut:micronaut-http-server-netty MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.bertramlabs.plugins:asset-pipeline-micronaut =3.3.1, =4.3.0 Source cves:...

io.micronaut:micronaut-function-web (2.0.3), io.micronaut:micronaut-http-server-netty (2.0.3) +1 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.0.3)

io.micronaut:micronaut-http-server MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut:micronaut-function-web 2.0.3 - io.micronaut:micronaut-http-server-netty 2.0.3 ...

com.slack.api:bolt-micronaut (0.99.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (1.3.0)

io.micronaut:micronaut-http-server-netty MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut 0.99.0 Source cves: CVE-2024-23639 Source advisory...

io.micronaut:micronaut-function-web (1.2.0.rc2), io.micronaut:micronaut-http-server-netty (1.2.0.rc2) +1 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.2.0.rc2)

io.micronaut:micronaut-http-server MAVEN version 1.2.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut:micronaut-function-web 1.2.0.rc2 - io.micronaut:micronaut-http-server-nett...

io.micronaut:micronaut-function-web (2.4.4), io.micronaut:micronaut-http-server-netty (2.4.4) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.4.4)

io.micronaut:micronaut-http-server MAVEN version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut:micronaut-function-web 2.4.4 - io.micronaut:micronaut-http-server-netty 2.4.4...

io.micronaut:micronaut-function-web (1.2.5), io.micronaut:micronaut-http-server-netty (1.2.5) +8 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.2.5)

io.micronaut:micronaut-http-server MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut:micronaut-function-web 1.2.5 - io.micronaut:micronaut-http-server-netty 1.2.5 ...

io.micronaut:micronaut-benchmarks (2.0.1), io.micronaut:micronaut-function-web (2.0.1) +3 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.0.1)

io.micronaut:micronaut-http-server MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut:micronaut-benchmarks 2.0.1 - io.micronaut:micronaut-function-web 2.0.1 -...

io.micronaut.configuration:micronaut-security-ldap (>=1.2.0, <=1.2.2), io.micronaut.configuration:micronaut-security-oauth2 (>=1.2.0, <=1.2.2) +7 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.2.0)

io.micronaut:micronaut-http-server MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.configuration:micronaut-security-ldap =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0,...

io.micronaut:micronaut-function-web (2.5.7), io.micronaut:micronaut-http-server-netty (2.5.7) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.5.7)

io.micronaut:micronaut-http-server MAVEN version 2.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut:micronaut-function-web 2.5.7 - io.micronaut:micronaut-http-server-netty 2.5.7...

io.micronaut.gcp:micronaut-gcp-function-http (3.5.0), io.micronaut.gcp:micronaut-gcp-function-http-test (3.5.0) +2 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.5.0)

io.micronaut:micronaut-http-server MAVEN version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.gcp:micronaut-gcp-function-http 3.5.0 -...

com.slack.api:bolt-micronaut (1.9.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (2.5.9)

io.micronaut:micronaut-http-server-netty MAVEN version 2.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut 1.9.0 Source cves: CVE-2024-23639 Source advisory:...

io.micronaut:micronaut-function-web (1.3.0.m1), io.micronaut:micronaut-http-server-netty (1.3.0.m1) +1 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.3.0.m1)

io.micronaut:micronaut-http-server MAVEN version 1.3.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut:micronaut-function-web 1.3.0.m1 - io.micronaut:micronaut-http-server-netty...

io.micronaut:micronaut-function-web (1.2.3), io.micronaut:micronaut-http-server-netty (1.2.3) +2 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.2.3)

io.micronaut:micronaut-http-server MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut:micronaut-function-web 1.2.3 - io.micronaut:micronaut-http-server-netty 1.2.3 ...

com.agorapulse:micronaut-slack-http (>=1.0.1-micronaut-3.0, <=1.0.4-micronaut-3.0), com.exactpro.th2:th2-cr-converter (>=1.3.0, <=1.3.1) +98 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (>=3.0.0-m1, <=3.8.2)

io.micronaut:micronaut-http-server MAVEN version =3.0.0-m1, =1.0.1-micronaut-3.0, =1.3.0, =2.0.0, =2.4.0, =1.16.0, =0.7.0, =0.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.2.1 and more Source cves: CVE-2024-23639 Source advisory: OSV:GHSA-583G-G682-CRXF...

io.github.artemy-osipov.thrift:rest-bridge-micronaut (0.4.0), net.javacrumbs.shedlock:shedlock-micronaut (4.23.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (2.4.2)

io.micronaut:micronaut-http-server-netty MAVEN version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - io.github.artemy-osipov.thrift:rest-bridge-micronaut 0.4.0 -...

com.slack.api:bolt-micronaut (>=1.0.3, <=1.0.6), info.novatec:micronaut-camunda-bpm-feature (>=0.1.0, <=0.2.2) +14 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.3.3)

io.micronaut:micronaut-http-server MAVEN version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - com.slack.api:bolt-micronaut =1.0.3, =0.1.0, =1.0.0.rc1, =1.0.0.rc2 -...

com.slack.api:bolt-micronaut (>=0.99.1, <=1.0.2), io.micronaut.configuration:micronaut-security-ldap (>=1.3.2, <=1.4.0) +12 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.3.2)

io.micronaut:micronaut-http-server MAVEN version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - com.slack.api:bolt-micronaut =0.99.1, =1.3.2, =1.3.2, =1.3.2, =1.3.2, =1.3.2, =1.4.0 Source...