Important: Red Hat Security Advisory: ignition security update

An update for ignition is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

Important: Red Hat Security Advisory: brotli security update

An update for brotli is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

brotli: Out-of-Bounds Write in Google Brotli Decoder

A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.20 security and extras update

Red Hat OpenShift Container Platform release 4.22.20 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.53 security and extras update

Red Hat OpenShift Container Platform release 4.19.53 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.44 security and extras update

Red Hat OpenShift Container Platform release 4.20.44 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.40 security and extras update

Red Hat OpenShift Container Platform release 4.21.40 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: brotli security update

An update for brotli is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

brotli: Out-of-Bounds Write in Google Brotli Decoder

A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...

Important: Red Hat Security Advisory: python-urllib3 security update

An update for python-urllib3 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override

A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security TLS settings inadvertently overwrite the proxy's TLS configuration, which can disabl...

urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser

A flaw was found in urllib3. This flaw allows a Denial of Service DoS through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application...

kernel: fuse: re-lock request before replacing page cache folio

A flaw was found in the Linux kernel's Filesystem in Userspace FUSE component. The fusetrymovefolio function, responsible for managing page cache folios, fails to re-lock a request after initially unlocking it on a successful path. This oversight allows another function, fusechanabort, to...

kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions

A flaw was found in the Linux kernel's Server Message Block SMB client. When a file with the setuid or setgid bit is written to on certain Common Internet File System CIFS mounts specifically those using 'cifsacl', 'modefromsid' options, or SMB3.1.1 POSIX extensions, the kernel fails to properly...

kernel: net/handshake: Drain pending requests at net namespace exit

A flaw was found in the Linux kernel's network handshake component. When a network namespace exits, pending handshake requests may not be properly released due to incorrect list handling. This can lead to resource leaks and a list-corruption race, potentially resulting in memory corruption. An...

kernel: ipvs: reload ip header after head reallocation

A flaw was found in the Linux kernel's IP Virtual Server IPVS module. When processing network packets, a buffer reallocation can leave an IP header pointer referencing freed memory. An attacker could exploit this use-after-free condition to cause a Denial of Service DoS by crashing the system or...

kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure

A flaw was found in the Linux kernel's vfio/pci component. During device initialization, a memory pointer is not properly cleared after being freed, leading to a use-after-free and double-free vulnerability. A local attacker could exploit this flaw to cause a system crash, resulting in a denial o...

kernel: udp: Deal with race between UDP socket address change and rehash

In the Linux kernel, the following vulnerability has been resolved: udp: Deal with race between UDP socket address change and rehash If a UDP socket changes its local address while it's receiving datagrams, as a result of connect, there is a period during which a lookup operation might fail to fi...

kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release()

A flaw was found in the Linux kernel's USB subsystem usbfs. An unprivileged local attacker with read/write access to a /dev/bus/usb node could exploit a use-after-free vulnerability. This occurs because the usbdevice structure is prematurely freed before all pending operations are completed...

kernel: fuse: re-lock request before returning from fuse_ref_folio()

A flaw was found in the Linux kernel's FUSE Filesystem in Userspace component. The fusereffolio function does not properly re-lock a request after unlocking it, which can lead to a use-after-free vulnerability. A local attacker could exploit this flaw to potentially execute arbitrary code or caus...

kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush()

A flaw was found in the Linux kernel. A local attacker can cause a Denial of Service DoS or potentially escalate privileges through a use-after-free vulnerability in the RAID-5 Partial Parity Log PPL component. During flush operations, the system improperly continues to access an input/output I/O...

kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()

A flaw was found in the Linux kernel's SELinux module. When handling Stream Control Transmission Protocol SCTP connections, a specific function attempts to access a network socket that may not exist. This can lead to a system crash, resulting in a Denial of Service DoS for affected systems...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

kernel: net/handshake: Take a long-lived file reference at submit

A flaw was found in the Linux kernel's networking handshake component. This vulnerability occurs because a critical file reference is not properly maintained during the handshake process. An attacker could potentially exploit this by causing the system to prematurely release a socket, leading to ...

kernel: KEYS: encrypted: fix integer overflow of datablob_len

A flaw was found in the Linux kernel's encrypted keys subsystem. An integer overflow occurs during memory size calculations for key data, resulting in an undersized buffer allocation. A local user can exploit this issue by supplying crafted key data to trigger an out-of-bounds write to kernel...

kernel: net/handshake: hand off the pinned file reference to accept_doit

A flaw was found in the Linux kernel's net/handshake component. A race condition exists where a network handshake request can be removed and its associated file reference released concurrently while the accept-side code attempts to access it. This can lead to the system attempting to read from...

kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine s390 PCI component. This vulnerability arises from improper handling of adapter interrupt forwarding, where enabling it multiple times for a zPCI device without prior unregistration can lead to resource overwriting and leakag...

kernel: netfilter: flowtable: hold reference on ct until flow is released

A flaw was found in the Linux kernel's netfilter subsystem. In the flowtable component, connection tracking reference counts are prematurely released before flow entries are fully removed from memory. An attacker could exploit this timing issue during network flow processing, triggering a...

libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKEAUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The...

libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...

Important: Red Hat Security Advisory: libreswan security update

An update for libreswan is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP

A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this fla...

crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority CA. A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitima...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...

Important: Red Hat Security Advisory: skopeo security update

An update for skopeo is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority CA. A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitima...

podman: Arbitrary file write when importing OCI archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

Important: Red Hat Security Advisory: buildah security update

An update for buildah is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority CA. A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitima...

net/http: golang: golang: Denial of Service via crafted HTTP Range headers

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service DoS by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages

A flaw was found in golang.org/x/crypto/ssh. After a channel has been established, a remote malicious peer could send specially crafted messages. This could lead to a deadlock of the entire connection, resulting in a Denial of Service DoS for the affected system...

podman: Arbitrary file write when importing OCI archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

php: fatal error handling retains stale request state leading to use-after-free

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is...

Important: Red Hat Security Advisory: php:8.3 security update

An update for the php:8.3 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...