Headline
Red Hat Security Advisory 2022-8400-01
Red Hat Security Advisory 2022-8400-01 - The libtirpc packages contain SunLib’s implementation of transport-independent remote procedure call documentation, which includes a library required by programs in the nfs-utils and rpcbind packages. Issues addressed include a denial of service vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: libtirpc security update
Advisory ID: RHSA-2022:8400-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:8400
Issue date: 2022-11-15
CVE Names: CVE-2021-46828
====================================================================
- Summary:
An update for libtirpc is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat CodeReady Linux Builder (v. 9) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux BaseOS (v. 9) - aarch64, ppc64le, s390x, x86_64
- Description:
The libtirpc packages contain SunLib’s implementation of
transport-independent remote procedure call (TI-RPC) documentation, which
includes a library required by programs in the nfs-utils and rpcbind
packages.
Security Fix(es):
- libtirpc: DoS vulnerability with lots of connections (CVE-2021-46828)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 9.1 Release Notes linked from the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2109352 - CVE-2021-46828 libtirpc: DoS vulnerability with lots of connections
2118157 - CVE-2021-46828 libtirpc: Upgrade to the latest upstream release libtirpc-1.3.3 [rhel-9.1.0]
- Package List:
Red Hat Enterprise Linux BaseOS (v. 9):
Source:
libtirpc-1.3.3-0.el9.src.rpm
aarch64:
libtirpc-1.3.3-0.el9.aarch64.rpm
libtirpc-debuginfo-1.3.3-0.el9.aarch64.rpm
libtirpc-debugsource-1.3.3-0.el9.aarch64.rpm
ppc64le:
libtirpc-1.3.3-0.el9.ppc64le.rpm
libtirpc-debuginfo-1.3.3-0.el9.ppc64le.rpm
libtirpc-debugsource-1.3.3-0.el9.ppc64le.rpm
s390x:
libtirpc-1.3.3-0.el9.s390x.rpm
libtirpc-debuginfo-1.3.3-0.el9.s390x.rpm
libtirpc-debugsource-1.3.3-0.el9.s390x.rpm
x86_64:
libtirpc-1.3.3-0.el9.i686.rpm
libtirpc-1.3.3-0.el9.x86_64.rpm
libtirpc-debuginfo-1.3.3-0.el9.i686.rpm
libtirpc-debuginfo-1.3.3-0.el9.x86_64.rpm
libtirpc-debugsource-1.3.3-0.el9.i686.rpm
libtirpc-debugsource-1.3.3-0.el9.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 9):
aarch64:
libtirpc-debuginfo-1.3.3-0.el9.aarch64.rpm
libtirpc-debugsource-1.3.3-0.el9.aarch64.rpm
libtirpc-devel-1.3.3-0.el9.aarch64.rpm
ppc64le:
libtirpc-debuginfo-1.3.3-0.el9.ppc64le.rpm
libtirpc-debugsource-1.3.3-0.el9.ppc64le.rpm
libtirpc-devel-1.3.3-0.el9.ppc64le.rpm
s390x:
libtirpc-debuginfo-1.3.3-0.el9.s390x.rpm
libtirpc-debugsource-1.3.3-0.el9.s390x.rpm
libtirpc-devel-1.3.3-0.el9.s390x.rpm
x86_64:
libtirpc-debuginfo-1.3.3-0.el9.i686.rpm
libtirpc-debuginfo-1.3.3-0.el9.x86_64.rpm
libtirpc-debugsource-1.3.3-0.el9.i686.rpm
libtirpc-debugsource-1.3.3-0.el9.x86_64.rpm
libtirpc-devel-1.3.3-0.el9.i686.rpm
libtirpc-devel-1.3.3-0.el9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2021-46828
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBY3OMRtzjgjWX9erEAQhd+Q//Y1X+e2OsGEBUqBRBDs2msHFginbvg7uZ
cbGMYGbb7u16+S0BgZEIUkmtCPSR2Tm2BjLjceTiQSR7rMhpM61O1ab3zPd42NvP
BcHnnu5alTi+LfSBippNJjR4TKm1JzON3ny9im6lz/icP14mrVQLpn0JdJNwUCVL
FLe8v8ZwSkTSFK6YUIb8QcKVJJH5NgWxQBQ4BK7xgCmx7DCRV97G7Z5a08fZf6Hn
BxIio3Jj6AzDAi7Llw+VDb7KI7p918Esq1Sl3w2kwXexmcXda6r5ftG7SjEvf8Sp
d4QPEWU9wJrEqx13rYh8g/8xAF1jTzLLBgvfnxnNQupvrgskss5qrDhTps/GaSVg
qk7RWyDsURRPTAtCisW+EO3PIXCL9101e+kroLC2w44hqqdTi86X03Fizn3xDuZ1
48YO2sOc6M+ipzA5YUWgMMEmT5YDOQGhflDNf9wbxcLmzFWz5Xa0ui3UWQJ8lrhH
4B4C7SYoHsuNUNUYDzqjnxB8QgpycDuVBHKB/eSqYHXBUOdPixZfrAKLI/h/LRfK
LhzogIsCy4tmw4txNcgvb0qhq6ehaU9cRmqlxbtRsvthtANorTrC8Slq1kT51OXJ
W5aaFyfGGC/+L8VnB3q0xWx4dzaonEh49aZdTjnqUCfM5ItkqsXE8MwwShn+Rr9W
E7LBqCWDqRw=u4dV
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Red Hat Security Advisory 2023-3742-02 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, and remote SQL injection vulnerabilities.
Updated images that include numerous enhancements, security, and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4.13.0 on Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-16250: A flaw was found in Vault and Vault Enterprise (“Vault”). In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM ident...
Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the container's underlying OS. Exploitation may lead to a system take over by an attacker.
Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]
An update for libtirpc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections
Gentoo Linux Security Advisory 202210-33 - A vulnerability has been discovered in Libtirpc which could result in denial of service. Versions less than 1.3.2 are affected.
Ubuntu Security Notice 5538-1 - It was discovered that libtirpc incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service.
In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.