Headline
RHSA-2022:7186: Red Hat Security Advisory: device-mapper-multipath security update
An update for device-mapper-multipath is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2022-41974: device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket
Synopsis
Important: device-mapper-multipath security update
Type/Severity
Security Advisory: Important
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for device-mapper-multipath is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices.
Security Fix(es):
- device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket (CVE-2022-41974)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Products
- Red Hat Enterprise Linux Server 7 x86_64
- Red Hat Enterprise Linux Workstation 7 x86_64
- Red Hat Enterprise Linux Desktop 7 x86_64
- Red Hat Enterprise Linux for IBM z Systems 7 s390x
- Red Hat Enterprise Linux for Power, big endian 7 ppc64
- Red Hat Enterprise Linux for Scientific Computing 7 x86_64
- Red Hat Enterprise Linux for Power, little endian 7 ppc64le
Fixes
- BZ - 2133988 - CVE-2022-41974 device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket
Red Hat Enterprise Linux Server 7
SRPM
device-mapper-multipath-0.4.9-136.el7_9.src.rpm
SHA-256: f469d09feb3c3a57f310b17824be1af2fc5085ad3c894605d80116b4b222b3e3
x86_64
device-mapper-multipath-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 292527d56526694d35146e4d365121adc9b6bd404b7e1a1efcfac7b9d5e7ff71
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.i686.rpm
SHA-256: 55bd8d06c356cb6b1f5f4d3ef2445363fafe048e2d19a7f7e2e00f3a2179e149
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.i686.rpm
SHA-256: 55bd8d06c356cb6b1f5f4d3ef2445363fafe048e2d19a7f7e2e00f3a2179e149
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 9fcc64fc03ee6f8cd576728cab512172e09ac3a28b51eff902eda749649f3f98
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 9fcc64fc03ee6f8cd576728cab512172e09ac3a28b51eff902eda749649f3f98
device-mapper-multipath-devel-0.4.9-136.el7_9.i686.rpm
SHA-256: abc657f949c1fe5afb450635243410d59de0ed6556382470ffecfa1d0133c605
device-mapper-multipath-devel-0.4.9-136.el7_9.x86_64.rpm
SHA-256: dfb3e9a8a689d64ac26c29dfa8a337e20f46139330c5d73de9bfffb78c078963
device-mapper-multipath-libs-0.4.9-136.el7_9.i686.rpm
SHA-256: 9c3359a893a9a4dd3ab3e2a73481313acdf6b52fee73070d3ff092c7f5e16851
device-mapper-multipath-libs-0.4.9-136.el7_9.x86_64.rpm
SHA-256: db1b75a73ec99df7754eb59af4cd153fa83121d6da525c9c1a408a5bee0e8e51
device-mapper-multipath-sysvinit-0.4.9-136.el7_9.x86_64.rpm
SHA-256: ac1a08c19458eb7f073beed4cc68fb304973ab6c42b16446c3c45032a7cdfcb8
kpartx-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 2b0a409a8a651aa52c9b24fdc109ce081257758e3a74b3cc9648172124666b4b
libdmmp-0.4.9-136.el7_9.i686.rpm
SHA-256: 90cb6b906c0bea400449b8e9f1bd6ea669ec1a2d72e91ee5755ec37fe578b2f6
libdmmp-0.4.9-136.el7_9.x86_64.rpm
SHA-256: c77144eb8f314a5e4fe313d65e8f45ed811f3b797b0f36f26b79c6e8e44509a9
libdmmp-devel-0.4.9-136.el7_9.i686.rpm
SHA-256: 0af5d5524aaba1e438e167e09af5ce567961ce1ed149dee6b35127fe2df19b5d
libdmmp-devel-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 3acc626ea8f4594e062a0c4a3ff966a71ea40fedb14acb7b761d93b2cc0855f6
Red Hat Enterprise Linux Workstation 7
SRPM
device-mapper-multipath-0.4.9-136.el7_9.src.rpm
SHA-256: f469d09feb3c3a57f310b17824be1af2fc5085ad3c894605d80116b4b222b3e3
x86_64
device-mapper-multipath-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 292527d56526694d35146e4d365121adc9b6bd404b7e1a1efcfac7b9d5e7ff71
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.i686.rpm
SHA-256: 55bd8d06c356cb6b1f5f4d3ef2445363fafe048e2d19a7f7e2e00f3a2179e149
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.i686.rpm
SHA-256: 55bd8d06c356cb6b1f5f4d3ef2445363fafe048e2d19a7f7e2e00f3a2179e149
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 9fcc64fc03ee6f8cd576728cab512172e09ac3a28b51eff902eda749649f3f98
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 9fcc64fc03ee6f8cd576728cab512172e09ac3a28b51eff902eda749649f3f98
device-mapper-multipath-devel-0.4.9-136.el7_9.i686.rpm
SHA-256: abc657f949c1fe5afb450635243410d59de0ed6556382470ffecfa1d0133c605
device-mapper-multipath-devel-0.4.9-136.el7_9.x86_64.rpm
SHA-256: dfb3e9a8a689d64ac26c29dfa8a337e20f46139330c5d73de9bfffb78c078963
device-mapper-multipath-libs-0.4.9-136.el7_9.i686.rpm
SHA-256: 9c3359a893a9a4dd3ab3e2a73481313acdf6b52fee73070d3ff092c7f5e16851
device-mapper-multipath-libs-0.4.9-136.el7_9.x86_64.rpm
SHA-256: db1b75a73ec99df7754eb59af4cd153fa83121d6da525c9c1a408a5bee0e8e51
device-mapper-multipath-sysvinit-0.4.9-136.el7_9.x86_64.rpm
SHA-256: ac1a08c19458eb7f073beed4cc68fb304973ab6c42b16446c3c45032a7cdfcb8
kpartx-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 2b0a409a8a651aa52c9b24fdc109ce081257758e3a74b3cc9648172124666b4b
libdmmp-0.4.9-136.el7_9.i686.rpm
SHA-256: 90cb6b906c0bea400449b8e9f1bd6ea669ec1a2d72e91ee5755ec37fe578b2f6
libdmmp-0.4.9-136.el7_9.x86_64.rpm
SHA-256: c77144eb8f314a5e4fe313d65e8f45ed811f3b797b0f36f26b79c6e8e44509a9
libdmmp-devel-0.4.9-136.el7_9.i686.rpm
SHA-256: 0af5d5524aaba1e438e167e09af5ce567961ce1ed149dee6b35127fe2df19b5d
libdmmp-devel-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 3acc626ea8f4594e062a0c4a3ff966a71ea40fedb14acb7b761d93b2cc0855f6
Red Hat Enterprise Linux Desktop 7
SRPM
device-mapper-multipath-0.4.9-136.el7_9.src.rpm
SHA-256: f469d09feb3c3a57f310b17824be1af2fc5085ad3c894605d80116b4b222b3e3
x86_64
device-mapper-multipath-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 292527d56526694d35146e4d365121adc9b6bd404b7e1a1efcfac7b9d5e7ff71
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.i686.rpm
SHA-256: 55bd8d06c356cb6b1f5f4d3ef2445363fafe048e2d19a7f7e2e00f3a2179e149
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.i686.rpm
SHA-256: 55bd8d06c356cb6b1f5f4d3ef2445363fafe048e2d19a7f7e2e00f3a2179e149
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 9fcc64fc03ee6f8cd576728cab512172e09ac3a28b51eff902eda749649f3f98
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 9fcc64fc03ee6f8cd576728cab512172e09ac3a28b51eff902eda749649f3f98
device-mapper-multipath-devel-0.4.9-136.el7_9.i686.rpm
SHA-256: abc657f949c1fe5afb450635243410d59de0ed6556382470ffecfa1d0133c605
device-mapper-multipath-devel-0.4.9-136.el7_9.x86_64.rpm
SHA-256: dfb3e9a8a689d64ac26c29dfa8a337e20f46139330c5d73de9bfffb78c078963
device-mapper-multipath-libs-0.4.9-136.el7_9.i686.rpm
SHA-256: 9c3359a893a9a4dd3ab3e2a73481313acdf6b52fee73070d3ff092c7f5e16851
device-mapper-multipath-libs-0.4.9-136.el7_9.x86_64.rpm
SHA-256: db1b75a73ec99df7754eb59af4cd153fa83121d6da525c9c1a408a5bee0e8e51
device-mapper-multipath-sysvinit-0.4.9-136.el7_9.x86_64.rpm
SHA-256: ac1a08c19458eb7f073beed4cc68fb304973ab6c42b16446c3c45032a7cdfcb8
kpartx-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 2b0a409a8a651aa52c9b24fdc109ce081257758e3a74b3cc9648172124666b4b
libdmmp-0.4.9-136.el7_9.i686.rpm
SHA-256: 90cb6b906c0bea400449b8e9f1bd6ea669ec1a2d72e91ee5755ec37fe578b2f6
libdmmp-0.4.9-136.el7_9.x86_64.rpm
SHA-256: c77144eb8f314a5e4fe313d65e8f45ed811f3b797b0f36f26b79c6e8e44509a9
libdmmp-devel-0.4.9-136.el7_9.i686.rpm
SHA-256: 0af5d5524aaba1e438e167e09af5ce567961ce1ed149dee6b35127fe2df19b5d
libdmmp-devel-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 3acc626ea8f4594e062a0c4a3ff966a71ea40fedb14acb7b761d93b2cc0855f6
Red Hat Enterprise Linux for IBM z Systems 7
SRPM
device-mapper-multipath-0.4.9-136.el7_9.src.rpm
SHA-256: f469d09feb3c3a57f310b17824be1af2fc5085ad3c894605d80116b4b222b3e3
s390x
device-mapper-multipath-0.4.9-136.el7_9.s390x.rpm
SHA-256: a623bcb4f511f5f4acdbb3ef26e7442ac035862e82c2fb943946cf90059edb76
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.s390.rpm
SHA-256: a26680c85f81745f7e9c5b0bf6d212915544922445e88318af8a884bb55bc568
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.s390.rpm
SHA-256: a26680c85f81745f7e9c5b0bf6d212915544922445e88318af8a884bb55bc568
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.s390x.rpm
SHA-256: 4028a8f5fb90e74837eda22a386a45cfd04c2df842d2d68fc194b51331dfbbfc
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.s390x.rpm
SHA-256: 4028a8f5fb90e74837eda22a386a45cfd04c2df842d2d68fc194b51331dfbbfc
device-mapper-multipath-devel-0.4.9-136.el7_9.s390.rpm
SHA-256: 0b4eab23f87d4ff384e2d2e9f9e5d86bec8a6ca856f2fbb8c1028e8e21c7b534
device-mapper-multipath-devel-0.4.9-136.el7_9.s390x.rpm
SHA-256: f00b3d1031d4c9b3d65b51e3f341bb6e2e7f748db2f0ea4627ec8cc279a70b2d
device-mapper-multipath-libs-0.4.9-136.el7_9.s390.rpm
SHA-256: d1788894cf1b5174ce2e8da8a6bb538669391d57377b4466722df88dc3d5e079
device-mapper-multipath-libs-0.4.9-136.el7_9.s390x.rpm
SHA-256: a646432c54e894b12421f3a8888f11cd7745ae7cace394454fb9dd5a66e99f6d
device-mapper-multipath-sysvinit-0.4.9-136.el7_9.s390x.rpm
SHA-256: c6711b710317933963815deffadc1a983365e9763cf3f26c4579571a7083304a
kpartx-0.4.9-136.el7_9.s390x.rpm
SHA-256: 84d0b38904eb95897f2ddb2f87576822a3251843b5bbbeb15d089c1d217b55d9
libdmmp-0.4.9-136.el7_9.s390.rpm
SHA-256: fc5764145f6a282b047621ef3703731a52dbf2c5e0568914975b46c6f3ebd29b
libdmmp-0.4.9-136.el7_9.s390x.rpm
SHA-256: 9233d3afb320b23a7ad432143c81355385e1d96df781e0fc2e68decad869d10a
libdmmp-devel-0.4.9-136.el7_9.s390.rpm
SHA-256: a2946d581eefe207f4a33a23fd83255d8e880a5a16eb4afaabb4d2efbb3e64f6
libdmmp-devel-0.4.9-136.el7_9.s390x.rpm
SHA-256: 96c3b1e4a0b2b5077fb09c07b703b77a4f2bc7e081721e383cff6d6955399aaf
Red Hat Enterprise Linux for Power, big endian 7
SRPM
device-mapper-multipath-0.4.9-136.el7_9.src.rpm
SHA-256: f469d09feb3c3a57f310b17824be1af2fc5085ad3c894605d80116b4b222b3e3
ppc64
device-mapper-multipath-0.4.9-136.el7_9.ppc64.rpm
SHA-256: ee224d2986b9014edbaf45791988498367fabb43f333f03b0d0ce07ae8b0914b
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.ppc.rpm
SHA-256: 1c52b679160ff87924e85137af21db59cbb2c283a1863a508b9ad0bda943eadb
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.ppc.rpm
SHA-256: 1c52b679160ff87924e85137af21db59cbb2c283a1863a508b9ad0bda943eadb
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.ppc64.rpm
SHA-256: be368b55eda6fd2b0671a349b605b47a3fb98ada6a9c047767ae0b2e2c8be164
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.ppc64.rpm
SHA-256: be368b55eda6fd2b0671a349b605b47a3fb98ada6a9c047767ae0b2e2c8be164
device-mapper-multipath-devel-0.4.9-136.el7_9.ppc.rpm
SHA-256: f6b615e6675c8cc3f5c8b4fdf0fe21a32629072351c84969a788014edcdb9ab8
device-mapper-multipath-devel-0.4.9-136.el7_9.ppc64.rpm
SHA-256: 9c7d74d39e11868ac0927039c17e6e65b54b9b8c0765d3742e0dceb062eaa909
device-mapper-multipath-libs-0.4.9-136.el7_9.ppc.rpm
SHA-256: 3e626adf719c3e94250c06521a2047c53648b4789d3b0bd9ea18c25a7d2a0886
device-mapper-multipath-libs-0.4.9-136.el7_9.ppc64.rpm
SHA-256: 35ebd45eacf47bb84fd7ab62fe0226dccaa538d8863eb392aef3c5b3cf7e0524
device-mapper-multipath-sysvinit-0.4.9-136.el7_9.ppc64.rpm
SHA-256: 9497cdc4f09853bcad478922f783241281c75effcf2f81e13ffdfe18e4543431
kpartx-0.4.9-136.el7_9.ppc64.rpm
SHA-256: 2e4298a6b4e63b5c808558c4ad1e144e3d8c717f1a873e2368cce26c5be71629
libdmmp-0.4.9-136.el7_9.ppc.rpm
SHA-256: d08a97b0579c25938b127ff39f4bdaa7f29f5747edfb762a2f59b7f068a1b6d4
libdmmp-0.4.9-136.el7_9.ppc64.rpm
SHA-256: 653c686e721810cc05014ca63654c3a9fd2e410d584d000384730b6caee5287c
libdmmp-devel-0.4.9-136.el7_9.ppc.rpm
SHA-256: d5e591e72a08cb7332b487466356adf9f0dd41ff28ff80ac96cb4ed567c8da6b
libdmmp-devel-0.4.9-136.el7_9.ppc64.rpm
SHA-256: 1c356aa08756ac327625e8976e27db07168759de7b11a048a4b42327c92866f0
Red Hat Enterprise Linux for Scientific Computing 7
SRPM
device-mapper-multipath-0.4.9-136.el7_9.src.rpm
SHA-256: f469d09feb3c3a57f310b17824be1af2fc5085ad3c894605d80116b4b222b3e3
x86_64
device-mapper-multipath-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 292527d56526694d35146e4d365121adc9b6bd404b7e1a1efcfac7b9d5e7ff71
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.i686.rpm
SHA-256: 55bd8d06c356cb6b1f5f4d3ef2445363fafe048e2d19a7f7e2e00f3a2179e149
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.i686.rpm
SHA-256: 55bd8d06c356cb6b1f5f4d3ef2445363fafe048e2d19a7f7e2e00f3a2179e149
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 9fcc64fc03ee6f8cd576728cab512172e09ac3a28b51eff902eda749649f3f98
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 9fcc64fc03ee6f8cd576728cab512172e09ac3a28b51eff902eda749649f3f98
device-mapper-multipath-devel-0.4.9-136.el7_9.i686.rpm
SHA-256: abc657f949c1fe5afb450635243410d59de0ed6556382470ffecfa1d0133c605
device-mapper-multipath-devel-0.4.9-136.el7_9.x86_64.rpm
SHA-256: dfb3e9a8a689d64ac26c29dfa8a337e20f46139330c5d73de9bfffb78c078963
device-mapper-multipath-libs-0.4.9-136.el7_9.i686.rpm
SHA-256: 9c3359a893a9a4dd3ab3e2a73481313acdf6b52fee73070d3ff092c7f5e16851
device-mapper-multipath-libs-0.4.9-136.el7_9.x86_64.rpm
SHA-256: db1b75a73ec99df7754eb59af4cd153fa83121d6da525c9c1a408a5bee0e8e51
device-mapper-multipath-sysvinit-0.4.9-136.el7_9.x86_64.rpm
SHA-256: ac1a08c19458eb7f073beed4cc68fb304973ab6c42b16446c3c45032a7cdfcb8
kpartx-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 2b0a409a8a651aa52c9b24fdc109ce081257758e3a74b3cc9648172124666b4b
libdmmp-0.4.9-136.el7_9.i686.rpm
SHA-256: 90cb6b906c0bea400449b8e9f1bd6ea669ec1a2d72e91ee5755ec37fe578b2f6
libdmmp-0.4.9-136.el7_9.x86_64.rpm
SHA-256: c77144eb8f314a5e4fe313d65e8f45ed811f3b797b0f36f26b79c6e8e44509a9
libdmmp-devel-0.4.9-136.el7_9.i686.rpm
SHA-256: 0af5d5524aaba1e438e167e09af5ce567961ce1ed149dee6b35127fe2df19b5d
libdmmp-devel-0.4.9-136.el7_9.x86_64.rpm
SHA-256: 3acc626ea8f4594e062a0c4a3ff966a71ea40fedb14acb7b761d93b2cc0855f6
Red Hat Enterprise Linux for Power, little endian 7
SRPM
device-mapper-multipath-0.4.9-136.el7_9.src.rpm
SHA-256: f469d09feb3c3a57f310b17824be1af2fc5085ad3c894605d80116b4b222b3e3
ppc64le
device-mapper-multipath-0.4.9-136.el7_9.ppc64le.rpm
SHA-256: 23809fca0d36e998c1b8b27d1ee259f58fda2dfcd77d543ce289d6b42f78542a
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.ppc64le.rpm
SHA-256: f1c1f7ce17fb2c6c0e00f3ac74a4fbb4f10fd0efb3ee9b7a929027d53607e0e6
device-mapper-multipath-debuginfo-0.4.9-136.el7_9.ppc64le.rpm
SHA-256: f1c1f7ce17fb2c6c0e00f3ac74a4fbb4f10fd0efb3ee9b7a929027d53607e0e6
device-mapper-multipath-devel-0.4.9-136.el7_9.ppc64le.rpm
SHA-256: 7111c0c3516120e8cff7276d0cbfe8da6bb8c8f694b488623e627addef49d751
device-mapper-multipath-libs-0.4.9-136.el7_9.ppc64le.rpm
SHA-256: 54cc6fc265d92a9480517dae9f5e515e73b9109cce11b2b9632290aee420ed6d
device-mapper-multipath-sysvinit-0.4.9-136.el7_9.ppc64le.rpm
SHA-256: e54773c8913affc0a3fae2eb8347c26cfd56fd01423f5f930cec34e37f73c56e
kpartx-0.4.9-136.el7_9.ppc64le.rpm
SHA-256: 8600700e0a715223705ff37c20e9b32a001ae2c127b48ade038b623e01721e70
libdmmp-0.4.9-136.el7_9.ppc64le.rpm
SHA-256: 22b28d23d402e78dc128751029b276b24175e44fed0041ac1d38ca5e09a9ff6c
libdmmp-devel-0.4.9-136.el7_9.ppc64le.rpm
SHA-256: 54b608085e6e7cdd5fbbcd881033747e83560667989abdc1d4b3a624fbddaa6b
Related news
Gentoo Linux Security Advisory 202311-6 - Multiple vulnerabilities have been discovered in multipath-tools, the worst of which can lead to root privilege escalation. Versions greater than or equal to 0.9.3 are affected.
IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks. IBM X-Force ID: 216753.
Red Hat Security Advisory 2023-0795-01 - Submariner 0.13.3 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.6.
Qualys discovered a race condition (CVE-2022-3328) in snap-confine, a SUID-root program installed by default on Ubuntu. In this advisory,they tell the story of this vulnerability (which was introduced in February 2022 by the patch for CVE-2021-44731) and detail how they exploited it in Ubuntu Server (a local privilege escalation, from any user to root) by combining it with two vulnerabilities in multipathd (an authorization bypass and a symlink attack, CVE-2022-41974 and CVE-2022-41973).
The maintainers of the FreeBSD operating system have released updates to remediate a security vulnerability impacting the ping module that could be potentially exploited to crash the program or trigger remote code execution. The issue, assigned the identifier CVE-2022-23093, impacts all supported versions of FreeBSD and concerns a stack-based buffer overflow vulnerability in the ping service. "
Red Hat Security Advisory 2022-8609-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift Virtualization 4.9.7 images. Issues addressed include a bypass vulnerability.
An update for redhat-release-virtualization-host, redhat-virtualization-host, and redhat-virtualization-host-productimg is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3515: libksba: integer overflow may lead to remote code execution * CVE-2022-38177: bind: memory leak in ECDSA DNSSEC verification code * CVE-2022-38178: bind: memory leaks in EdDSA DNSSEC verification code * CVE-2022-40674: ex...
Red Hat OpenShift Container Platform release 4.8.53 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-26945: go-getter: command injection vulnerability * CVE-2022-30321: go-getter: unsafe download (issue 1 of 3) * CVE-2022-30322: go-getter: unsafe download (issue 2 of 3) * CVE-2022-30323: go...
An update for device-mapper-multipath is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3787: device-mapper-multipath: Regression of CVE-2022-41974 fix in Red Hat Enterprise Linux
Red Hat Security Advisory 2022-7201-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.12. Issues addressed include a code execution vulnerability.
Red Hat Security Advisory 2022-7276-01 - Red Hat Advanced Cluster Management for Kubernetes 2.4.8 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs. Issues addressed include denial of service, server-side request forgery, and remote SQL injection vulnerabilities.
Red Hat Advanced Cluster Management for Kubernetes 2.4.8 General Availability release images, which fix security issues. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2238: search-api: SQL injection leads to remote denial of service * CVE-2022-25858: terser: insecure use of regular expressions leads to ReDoS * CVE-2022-31129: moment: inefficient parsing algorithm resulting in DoS * CVE-2022-35948: nodejs: undici vulnerable to CRLF via content headers * CVE-2022-35949: n...
The Qualys Research Team has discovered authorization bypass and symlink vulnerabilities in multipathd. The authorization bypass was introduced in version 0.7.0 and the symlink vulnerability was introduced in version 0.7.7.
Red Hat Security Advisory 2022-7191-01 - The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Issues addressed include a bypass vulnerability.
An update for device-mapper-multipath is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41974: device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket
Red Hat Security Advisory 2022-7186-01 - The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Issues addressed include a bypass vulnerability.
Red Hat Security Advisory 2022-7185-01 - The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Issues addressed include a bypass vulnerability.
Red Hat Security Advisory 2022-7192-01 - The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Issues addressed include a bypass vulnerability.
Red Hat Security Advisory 2022-7187-01 - The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Issues addressed include a bypass vulnerability.
Red Hat Security Advisory 2022-7188-01 - The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Issues addressed include a bypass vulnerability.
An update for device-mapper-multipath is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41974: device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket
An update for device-mapper-multipath is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41974: device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket
An update for device-mapper-multipath is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41974: device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket