Headline
Red Hat Security Advisory 2024-3925-03
Red Hat Security Advisory 2024-3925-03 - An update is now available for Red Hat Ceph Storage 7.1.
The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_3925.jsonRed Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis: Critical: Red Hat Ceph Storage 7.1 security, enhancements, and bug fix updateAdvisory ID: RHSA-2024:3925-03Product: Red Hat Ceph StorageAdvisory URL: https://access.redhat.com/errata/RHSA-2024:3925Issue date: 2024-06-14Revision: 03CVE Names: CVE-2023-3128====================================================================Summary: An update is now available for Red Hat Ceph Storage 7.1Description:Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.These new packages include numerous enhancements, bug fixes, and known issues. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on the most significant of these changes:https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/7.1/html/release_notes/indexSolution:https://access.redhat.com/articles/1548993https://access.redhat.com/articles/11258CVEs:CVE-2023-3128References:https://access.redhat.com/security/updates/classification/#criticalhttps://access.redhat.com/security/cve/CVE-2023-3128https://access.redhat.com/security/cve/CVE-2023-49568https://access.redhat.com/security/cve/CVE-2023-49569https://access.redhat.com/security/cve/CVE-2023-4822https://bugzilla.redhat.com/show_bug.cgi?id=1871333https://bugzilla.redhat.com/show_bug.cgi?id=1954461https://bugzilla.redhat.com/show_bug.cgi?id=1954463https://bugzilla.redhat.com/show_bug.cgi?id=1995152https://bugzilla.redhat.com/show_bug.cgi?id=2009599https://bugzilla.redhat.com/show_bug.cgi?id=2029585https://bugzilla.redhat.com/show_bug.cgi?id=2061627https://bugzilla.redhat.com/show_bug.cgi?id=2068026https://bugzilla.redhat.com/show_bug.cgi?id=2068030https://bugzilla.redhat.com/show_bug.cgi?id=2079815https://bugzilla.redhat.com/show_bug.cgi?id=2079897https://bugzilla.redhat.com/show_bug.cgi?id=2089167https://bugzilla.redhat.com/show_bug.cgi?id=2107014https://bugzilla.redhat.com/show_bug.cgi?id=2112325https://bugzilla.redhat.com/show_bug.cgi?id=2125107https://bugzilla.redhat.com/show_bug.cgi?id=2130292https://bugzilla.redhat.com/show_bug.cgi?id=2134786https://bugzilla.redhat.com/show_bug.cgi?id=2136766https://bugzilla.redhat.com/show_bug.cgi?id=2144472https://bugzilla.redhat.com/show_bug.cgi?id=2148831https://bugzilla.redhat.com/show_bug.cgi?id=2149450https://bugzilla.redhat.com/show_bug.cgi?id=2153468https://bugzilla.redhat.com/show_bug.cgi?id=2166576https://bugzilla.redhat.com/show_bug.cgi?id=2172162https://bugzilla.redhat.com/show_bug.cgi?id=2176297https://bugzilla.redhat.com/show_bug.cgi?id=2185792https://bugzilla.redhat.com/show_bug.cgi?id=2190366https://bugzilla.redhat.com/show_bug.cgi?id=2207713https://bugzilla.redhat.com/show_bug.cgi?id=2213626https://bugzilla.redhat.com/show_bug.cgi?id=2213766https://bugzilla.redhat.com/show_bug.cgi?id=2217499https://bugzilla.redhat.com/show_bug.cgi?id=2227309https://bugzilla.redhat.com/show_bug.cgi?id=2227314https://bugzilla.redhat.com/show_bug.cgi?id=2233659https://bugzilla.redhat.com/show_bug.cgi?id=2235753https://bugzilla.redhat.com/show_bug.cgi?id=2237038https://bugzilla.redhat.com/show_bug.cgi?id=2237574https://bugzilla.redhat.com/show_bug.cgi?id=2238301https://bugzilla.redhat.com/show_bug.cgi?id=2238537https://bugzilla.redhat.com/show_bug.cgi?id=2238926https://bugzilla.redhat.com/show_bug.cgi?id=2239726https://bugzilla.redhat.com/show_bug.cgi?id=2240138https://bugzilla.redhat.com/show_bug.cgi?id=2240583https://bugzilla.redhat.com/show_bug.cgi?id=2241030https://bugzilla.redhat.com/show_bug.cgi?id=2241056https://bugzilla.redhat.com/show_bug.cgi?id=2241104https://bugzilla.redhat.com/show_bug.cgi?id=2241165https://bugzilla.redhat.com/show_bug.cgi?id=2242431https://bugzilla.redhat.com/show_bug.cgi?id=2243105https://bugzilla.redhat.com/show_bug.cgi?id=2243626https://bugzilla.redhat.com/show_bug.cgi?id=2244417https://bugzilla.redhat.com/show_bug.cgi?id=2245261https://bugzilla.redhat.com/show_bug.cgi?id=2247074https://bugzilla.redhat.com/show_bug.cgi?id=2247140https://bugzilla.redhat.com/show_bug.cgi?id=2247183https://bugzilla.redhat.com/show_bug.cgi?id=2247531https://bugzilla.redhat.com/show_bug.cgi?id=2247586https://bugzilla.redhat.com/show_bug.cgi?id=2247718https://bugzilla.redhat.com/show_bug.cgi?id=2248639https://bugzilla.redhat.com/show_bug.cgi?id=2248855https://bugzilla.redhat.com/show_bug.cgi?id=2249003https://bugzilla.redhat.com/show_bug.cgi?id=2249068https://bugzilla.redhat.com/show_bug.cgi?id=2249518https://bugzilla.redhat.com/show_bug.cgi?id=2249573https://bugzilla.redhat.com/show_bug.cgi?id=2249651https://bugzilla.redhat.com/show_bug.cgi?id=2249744https://bugzilla.redhat.com/show_bug.cgi?id=2249812https://bugzilla.redhat.com/show_bug.cgi?id=2251004https://bugzilla.redhat.com/show_bug.cgi?id=2251192https://bugzilla.redhat.com/show_bug.cgi?id=2252048https://bugzilla.redhat.com/show_bug.cgi?id=2252396https://bugzilla.redhat.com/show_bug.cgi?id=2253313https://bugzilla.redhat.com/show_bug.cgi?id=2254121https://bugzilla.redhat.com/show_bug.cgi?id=2254122https://bugzilla.redhat.com/show_bug.cgi?id=2254125https://bugzilla.redhat.com/show_bug.cgi?id=2254480https://bugzilla.redhat.com/show_bug.cgi?id=2254582https://bugzilla.redhat.com/show_bug.cgi?id=2255030https://bugzilla.redhat.com/show_bug.cgi?id=2255255https://bugzilla.redhat.com/show_bug.cgi?id=2255938https://bugzilla.redhat.com/show_bug.cgi?id=2256560https://bugzilla.redhat.com/show_bug.cgi?id=2256967https://bugzilla.redhat.com/show_bug.cgi?id=2257978https://bugzilla.redhat.com/show_bug.cgi?id=2258143https://bugzilla.redhat.com/show_bug.cgi?id=2258165https://bugzilla.redhat.com/show_bug.cgi?id=2258542https://bugzilla.redhat.com/show_bug.cgi?id=2258879https://bugzilla.redhat.com/show_bug.cgi?id=2258940https://bugzilla.redhat.com/show_bug.cgi?id=2258951https://bugzilla.redhat.com/show_bug.cgi?id=2258997https://bugzilla.redhat.com/show_bug.cgi?id=2259179https://bugzilla.redhat.com/show_bug.cgi?id=2259461https://bugzilla.redhat.com/show_bug.cgi?id=2259938https://bugzilla.redhat.com/show_bug.cgi?id=2260003https://bugzilla.redhat.com/show_bug.cgi?id=2260835https://bugzilla.redhat.com/show_bug.cgi?id=2261239https://bugzilla.redhat.com/show_bug.cgi?id=2262094https://bugzilla.redhat.com/show_bug.cgi?id=2262400https://bugzilla.redhat.com/show_bug.cgi?id=2262469https://bugzilla.redhat.com/show_bug.cgi?id=2262650https://bugzilla.redhat.com/show_bug.cgi?id=2262741https://bugzilla.redhat.com/show_bug.cgi?id=2262919https://bugzilla.redhat.com/show_bug.cgi?id=2262984https://bugzilla.redhat.com/show_bug.cgi?id=2263813https://bugzilla.redhat.com/show_bug.cgi?id=2263898https://bugzilla.redhat.com/show_bug.cgi?id=2263990https://bugzilla.redhat.com/show_bug.cgi?id=2264141https://bugzilla.redhat.com/show_bug.cgi?id=2264142https://bugzilla.redhat.com/show_bug.cgi?id=2264145https://bugzilla.redhat.com/show_bug.cgi?id=2264158https://bugzilla.redhat.com/show_bug.cgi?id=2264168https://bugzilla.redhat.com/show_bug.cgi?id=2264177https://bugzilla.redhat.com/show_bug.cgi?id=2264212https://bugzilla.redhat.com/show_bug.cgi?id=2264213https://bugzilla.redhat.com/show_bug.cgi?id=2264222https://bugzilla.redhat.com/show_bug.cgi?id=2264348https://bugzilla.redhat.com/show_bug.cgi?id=2264812https://bugzilla.redhat.com/show_bug.cgi?id=2264836https://bugzilla.redhat.com/show_bug.cgi?id=2265059https://bugzilla.redhat.com/show_bug.cgi?id=2265148https://bugzilla.redhat.com/show_bug.cgi?id=2265262https://bugzilla.redhat.com/show_bug.cgi?id=2265322https://bugzilla.redhat.com/show_bug.cgi?id=2265415https://bugzilla.redhat.com/show_bug.cgi?id=2265558https://bugzilla.redhat.com/show_bug.cgi?id=2265574https://bugzilla.redhat.com/show_bug.cgi?id=2265890https://bugzilla.redhat.com/show_bug.cgi?id=2265994https://bugzilla.redhat.com/show_bug.cgi?id=2266020https://bugzilla.redhat.com/show_bug.cgi?id=2266092https://bugzilla.redhat.com/show_bug.cgi?id=2266223https://bugzilla.redhat.com/show_bug.cgi?id=2266227https://bugzilla.redhat.com/show_bug.cgi?id=2266248https://bugzilla.redhat.com/show_bug.cgi?id=2266256https://bugzilla.redhat.com/show_bug.cgi?id=2266411https://bugzilla.redhat.com/show_bug.cgi?id=2266529https://bugzilla.redhat.com/show_bug.cgi?id=2266530https://bugzilla.redhat.com/show_bug.cgi?id=2266579https://bugzilla.redhat.com/show_bug.cgi?id=2267040https://bugzilla.redhat.com/show_bug.cgi?id=2267624https://bugzilla.redhat.com/show_bug.cgi?id=2267625https://bugzilla.redhat.com/show_bug.cgi?id=2267715https://bugzilla.redhat.com/show_bug.cgi?id=2267763https://bugzilla.redhat.com/show_bug.cgi?id=2267814https://bugzilla.redhat.com/show_bug.cgi?id=2267957https://bugzilla.redhat.com/show_bug.cgi?id=2268036https://bugzilla.redhat.com/show_bug.cgi?id=2268039https://bugzilla.redhat.com/show_bug.cgi?id=2268040https://bugzilla.redhat.com/show_bug.cgi?id=2268059https://bugzilla.redhat.com/show_bug.cgi?id=2268414https://bugzilla.redhat.com/show_bug.cgi?id=2268560https://bugzilla.redhat.com/show_bug.cgi?id=2268567https://bugzilla.redhat.com/show_bug.cgi?id=2268996https://bugzilla.redhat.com/show_bug.cgi?id=2269038https://bugzilla.redhat.com/show_bug.cgi?id=2269321https://bugzilla.redhat.com/show_bug.cgi?id=2269337https://bugzilla.redhat.com/show_bug.cgi?id=2269347https://bugzilla.redhat.com/show_bug.cgi?id=2269374https://bugzilla.redhat.com/show_bug.cgi?id=2269381https://bugzilla.redhat.com/show_bug.cgi?id=2269526https://bugzilla.redhat.com/show_bug.cgi?id=2269662https://bugzilla.redhat.com/show_bug.cgi?id=2269664https://bugzilla.redhat.com/show_bug.cgi?id=2269687https://bugzilla.redhat.com/show_bug.cgi?id=2270211https://bugzilla.redhat.com/show_bug.cgi?id=2270237https://bugzilla.redhat.com/show_bug.cgi?id=2270245https://bugzilla.redhat.com/show_bug.cgi?id=2270334https://bugzilla.redhat.com/show_bug.cgi?id=2270402https://bugzilla.redhat.com/show_bug.cgi?id=2270442https://bugzilla.redhat.com/show_bug.cgi?id=2270625https://bugzilla.redhat.com/show_bug.cgi?id=2270645https://bugzilla.redhat.com/show_bug.cgi?id=2270656https://bugzilla.redhat.com/show_bug.cgi?id=2270785https://bugzilla.redhat.com/show_bug.cgi?id=2271096https://bugzilla.redhat.com/show_bug.cgi?id=2271110https://bugzilla.redhat.com/show_bug.cgi?id=2271135https://bugzilla.redhat.com/show_bug.cgi?id=2271399https://bugzilla.redhat.com/show_bug.cgi?id=2271806https://bugzilla.redhat.com/show_bug.cgi?id=2271835https://bugzilla.redhat.com/show_bug.cgi?id=2271938https://bugzilla.redhat.com/show_bug.cgi?id=2272031https://bugzilla.redhat.com/show_bug.cgi?id=2272038https://bugzilla.redhat.com/show_bug.cgi?id=2272157https://bugzilla.redhat.com/show_bug.cgi?id=2272437https://bugzilla.redhat.com/show_bug.cgi?id=2272468https://bugzilla.redhat.com/show_bug.cgi?id=2272621https://bugzilla.redhat.com/show_bug.cgi?id=2272622https://bugzilla.redhat.com/show_bug.cgi?id=2272632https://bugzilla.redhat.com/show_bug.cgi?id=2272647https://bugzilla.redhat.com/show_bug.cgi?id=2272661https://bugzilla.redhat.com/show_bug.cgi?id=2272662https://bugzilla.redhat.com/show_bug.cgi?id=2272979https://bugzilla.redhat.com/show_bug.cgi?id=2273000https://bugzilla.redhat.com/show_bug.cgi?id=2273608https://bugzilla.redhat.com/show_bug.cgi?id=2273693https://bugzilla.redhat.com/show_bug.cgi?id=2273836https://bugzilla.redhat.com/show_bug.cgi?id=2273837https://bugzilla.redhat.com/show_bug.cgi?id=2273927https://bugzilla.redhat.com/show_bug.cgi?id=2273935https://bugzilla.redhat.com/show_bug.cgi?id=2273936https://bugzilla.redhat.com/show_bug.cgi?id=2273938https://bugzilla.redhat.com/show_bug.cgi?id=2274305https://bugzilla.redhat.com/show_bug.cgi?id=2274703https://bugzilla.redhat.com/show_bug.cgi?id=2274704https://bugzilla.redhat.com/show_bug.cgi?id=2275103https://bugzilla.redhat.com/show_bug.cgi?id=2275323https://bugzilla.redhat.com/show_bug.cgi?id=2275459https://bugzilla.redhat.com/show_bug.cgi?id=2275463https://bugzilla.redhat.com/show_bug.cgi?id=2275506https://bugzilla.redhat.com/show_bug.cgi?id=2275861https://bugzilla.redhat.com/show_bug.cgi?id=2276031https://bugzilla.redhat.com/show_bug.cgi?id=2276034https://bugzilla.redhat.com/show_bug.cgi?id=2276038https://bugzilla.redhat.com/show_bug.cgi?id=2276340https://bugzilla.redhat.com/show_bug.cgi?id=2276361https://bugzilla.redhat.com/show_bug.cgi?id=2276379https://bugzilla.redhat.com/show_bug.cgi?id=2276498https://bugzilla.redhat.com/show_bug.cgi?id=2276636https://bugzilla.redhat.com/show_bug.cgi?id=2276900https://bugzilla.redhat.com/show_bug.cgi?id=2276989https://bugzilla.redhat.com/show_bug.cgi?id=2277099https://bugzilla.redhat.com/show_bug.cgi?id=2277143https://bugzilla.redhat.com/show_bug.cgi?id=2277692https://bugzilla.redhat.com/show_bug.cgi?id=2277699https://bugzilla.redhat.com/show_bug.cgi?id=2277830https://bugzilla.redhat.com/show_bug.cgi?id=2277944https://bugzilla.redhat.com/show_bug.cgi?id=2277945https://bugzilla.redhat.com/show_bug.cgi?id=2277947https://bugzilla.redhat.com/show_bug.cgi?id=2278166https://bugzilla.redhat.com/show_bug.cgi?id=2278326https://bugzilla.redhat.com/show_bug.cgi?id=2278778https://bugzilla.redhat.com/show_bug.cgi?id=2279339https://bugzilla.redhat.com/show_bug.cgi?id=2279352https://bugzilla.redhat.com/show_bug.cgi?id=2279461https://bugzilla.redhat.com/show_bug.cgi?id=2279530https://bugzilla.redhat.com/show_bug.cgi?id=2279607https://bugzilla.redhat.com/show_bug.cgi?id=2279862https://bugzilla.redhat.com/show_bug.cgi?id=2280205https://bugzilla.redhat.com/show_bug.cgi?id=2280332https://bugzilla.redhat.com/show_bug.cgi?id=2280742https://bugzilla.redhat.com/show_bug.cgi?id=2280954https://bugzilla.redhat.com/show_bug.cgi?id=2281465https://bugzilla.redhat.com/show_bug.cgi?id=2281471https://bugzilla.redhat.com/show_bug.cgi?id=2282364https://bugzilla.redhat.com/show_bug.cgi?id=2282533https://bugzilla.redhat.com/show_bug.cgi?id=2283630Related news
Red Hat Security Advisory 2024-8425-03 - Red Hat OpenShift Container Platform release 4.15.37 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include denial of service and traversal vulnerabilities.
Good cyber security practices depend on trustworthy information sources about security vulnerabilities. This article offers guidance around who to trust for this information.In 1999, MITRE Corporation, a US Government-funded research and development company, realized the world needed a uniform standard for reporting and tracking software security bugs. MITRE worked with the IT industry to invent a concept called CVE, for Common Vulnerabilities and Exposures. The CVE concept caught on, and today, the industry acknowledges CVE as the universal standard for security vulnerability reporting.Softw
Red Hat Security Advisory 2024-4118-03 - An update is now available for Red Hat Ceph Storage 5.3. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-3889-03 - Red Hat OpenShift Container Platform release 4.15.18 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.
Red Hat Security Advisory 2024-2631-03 - An update is now available for Red Hat Ceph Storage 6.1 in the Red Hat Ecosystem Catalog.
Red Hat Security Advisory 2024-1891-03 - Red Hat OpenShift Container Platform release 4.14.22 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include cross site scripting, denial of service, and traversal vulnerabilities.
Red Hat Security Advisory 2024-1887-03 - Red Hat OpenShift Container Platform release 4.15.10 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.
Red Hat uses a four-point impact scale to classify security issues affecting our products. Have you ever asked yourself what it takes and what the requirements are for each point of the scale? We will talk through the highlights of our process in this article.Is this a CVE?First and foremost, what is a CVE? Short for Common Vulnerabilities and Exposures, it is a list of publicly disclosed computer security flaws. Learn more in this Red Hat post.To receive a severity rating, the issue needs to be a CVE. But what does it take to be a CVE? In order to warrant a CVE ID, a vulnerability has to comp
Red Hat Security Advisory 2024-1570-03 - Updated images are now available for Red Hat Advanced Cluster Security. Issues addressed include a denial of service vulnerability.
Red Hat Security Advisory 2024-1557-03 - An update is now available for Red Hat OpenShift Builds 1.0. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-1557-03 - An update is now available for Red Hat OpenShift Builds 1.0. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-1549-03 - Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes bug and security fixes. Issues addressed include a traversal vulnerability.
Red Hat Security Advisory 2024-0989-03 - Red Hat Multicluster GlobalHub 1.0.2 General Availability release images, which fix bugs, provide security updates, and update container images. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-0845-03 - Red Hat OpenShift Container Platform release 4.13.34 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-0832-03 - Red Hat OpenShift Container Platform release 4.12.50 is now available with updates to packages and images that fix several bugs. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-0820-03 - Red Hat Advanced Cluster Management for Kubernetes 2.8.5 General Availability release images, which provide security updates and fix bugs. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-0741-03 - Red Hat OpenShift Container Platform release 4.13.33 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-0740-03 - Red Hat OpenShift Container Platform release 4.13.33 is now available with updates to packages and images that fix several bugs. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-0735-03 - Red Hat OpenShift Container Platform release 4.14.12 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-0729-03 - Red Hat Advanced Cluster Management for Kubernetes 2.7.11 General Availability release images, which provide security updates and fix bugs. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-0642-03 - An update is now available for Red Hat OpenShift Container Platform 4.14. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-0641-03 - An update is now available for Red Hat OpenShift Container Platform 4.14. Issues addressed include denial of service and traversal vulnerabilities.
Red Hat Security Advisory 2024-0298-03 - Red Hat Advanced Cluster Management for Kubernetes 2.9.2 General Availability release images, which provide security updates and fix bugs. Issues addressed include denial of service and traversal vulnerabilities.
### Impact A path traversal vulnerability was discovered in go-git versions prior to `v5.11`. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the [ChrootOS](https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS), which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using [BoundOS](https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS) or in-memory filesystems are not affected by this issue. This is a `go-git` implementation issue and does not affect the upstream `git` cli. ### Patches Users running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.11` in order to mitigate this vulnerability. ### Workarounds In cases where a bump to the latest version of `go-git` is not possible in a timely manner, we recommend limiting its use to only t...
### Impact A denial of service (DoS) vulnerability was discovered in go-git versions prior to `v5.11`. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in `go-git` clients. Applications using only the in-memory filesystem supported by `go-git` are not affected by this vulnerability. This is a `go-git` implementation issue and does not affect the upstream `git` cli. ### Patches Users running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.11` in order to mitigate this vulnerability. ### Workarounds In cases where a bump to the latest version of `go-git` is not possible, we recommend limiting its use to only trust-worthy Git servers. ## Credit Thanks to Ionut Lalu for responsibly disclosing this vulnerability to us. ### References - [GHSA-mw99-9chc-xw7r](https://github.com/go-git/go-git/security/advisories/GHSA-mw99-9chc-xw7r)
Grafana is an open-source platform for monitoring and observability. The vulnerability impacts instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It also allows an Organization Admin to assign or revoke any permissions that they have to any user globally. This means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user. The vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.
The vulnerability impacts instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It also allows an Organization Admin to assign or revoke any permissions that they have to any user globally. This means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user. The vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.
Red Hat Security Advisory 2023-4030-01 - Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
An update for grafana is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3128: A flaw was found in Grafana, which validates Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique across Azure AD tenants, which enables Grafana account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant AzureAD OAuth application. This may allow an attacker to gain com...
Fortinet has rolled out updates to address a critical security vulnerability impacting its FortiNAC network access control solution that could lead to the execution of arbitrary code. Tracked as CVE-2023-33299, the flaw is rated 9.6 out of 10 for severity on the CVSS scoring system. It has been described as a case of Java untrusted object deserialization. "A deserialization of untrusted data
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.