Security
Headlines
HeadlinesLatestCVEs

Headline

RHSA-2023:2532: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

  • CVE-2022-36227: A flaw was found in libarchive. A missing check of the return value of the calloc function can cause a NULL pointer dereference in an out-of-memory condition or when a memory allocation limit is reached, resulting in the program linked with libarchive to crash.
Red Hat Security Data
#vulnerability#linux#red_hat#ibm

Synopsis

Low: libarchive security update

Type/Severity

Security Advisory: Low

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libarchive is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

  • libarchive: NULL pointer dereference in archive_write.c (CVE-2022-36227)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 9 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x

Fixes

  • BZ - 2144972 - CVE-2022-36227 libarchive: NULL pointer dereference in archive_write.c

References

  • https://access.redhat.com/security/updates/classification/#low
  • https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index

Red Hat Enterprise Linux for x86_64 9

SRPM

libarchive-3.5.3-4.el9.src.rpm

SHA-256: 9d7c7ddde6a8bfe92e4bbdb5e63c25419cb2e997047097ac8fbc7e7c4a3fbd91

x86_64

bsdcat-debuginfo-3.5.3-4.el9.i686.rpm

SHA-256: d841c78aec59c38481d9b2b3d8e0b8f19789185f9b8dc4d36f9029e7d91794dd

bsdcat-debuginfo-3.5.3-4.el9.x86_64.rpm

SHA-256: ada462b9a1c65b2f73b0205ccef8f6efad6567101d21b1359bf9cca91dbf59d4

bsdcat-debuginfo-3.5.3-4.el9.x86_64.rpm

SHA-256: ada462b9a1c65b2f73b0205ccef8f6efad6567101d21b1359bf9cca91dbf59d4

bsdcpio-debuginfo-3.5.3-4.el9.i686.rpm

SHA-256: 114dac7f81d257f267bbb7d819a060fba2feca46f48f6e500a0318d760821479

bsdcpio-debuginfo-3.5.3-4.el9.x86_64.rpm

SHA-256: 5f97728d355e197d5cad216db73be521bf1cb84710e4ee0f2594007bd289450e

bsdcpio-debuginfo-3.5.3-4.el9.x86_64.rpm

SHA-256: 5f97728d355e197d5cad216db73be521bf1cb84710e4ee0f2594007bd289450e

bsdtar-3.5.3-4.el9.x86_64.rpm

SHA-256: df015c061e8a5e4df56be71d1730f13a5dd17f937e232276af1861c2ebeace39

bsdtar-debuginfo-3.5.3-4.el9.i686.rpm

SHA-256: 8d7b01fe9389f46d15809be198059b1a56c1def20fa2f24d700dd6aac43084e7

bsdtar-debuginfo-3.5.3-4.el9.x86_64.rpm

SHA-256: 61aa960a18adddf8ad4ef19467b30153cb170a35c8ff5c525d68e49293b16acb

bsdtar-debuginfo-3.5.3-4.el9.x86_64.rpm

SHA-256: 61aa960a18adddf8ad4ef19467b30153cb170a35c8ff5c525d68e49293b16acb

libarchive-3.5.3-4.el9.i686.rpm

SHA-256: 2121fc32079e1fc698338ca4e3f045701df01bb10abcd29117613296dd1ceb4f

libarchive-3.5.3-4.el9.x86_64.rpm

SHA-256: 3adc7a9ace1115daa32a327c9f257fc113c1a3a7e561443189f6318222e30238

libarchive-debuginfo-3.5.3-4.el9.i686.rpm

SHA-256: 72006c87d5062741b6f183a9eea6a94d0624f029c5c698e4becf66950d894ebe

libarchive-debuginfo-3.5.3-4.el9.x86_64.rpm

SHA-256: bf7868bee4bb22f2c690baad252b475de5b8b58fa09c8ba86c61c769031e66be

libarchive-debuginfo-3.5.3-4.el9.x86_64.rpm

SHA-256: bf7868bee4bb22f2c690baad252b475de5b8b58fa09c8ba86c61c769031e66be

libarchive-debugsource-3.5.3-4.el9.i686.rpm

SHA-256: 4fa4a616e6e0252db6415e91256364aba226092f8909aace6395fdf15147c0b4

libarchive-debugsource-3.5.3-4.el9.x86_64.rpm

SHA-256: e89b60a6af17129c40be79c47d8c5f992525e11453306614b0328e8abae538f0

libarchive-debugsource-3.5.3-4.el9.x86_64.rpm

SHA-256: e89b60a6af17129c40be79c47d8c5f992525e11453306614b0328e8abae538f0

Red Hat Enterprise Linux for IBM z Systems 9

SRPM

libarchive-3.5.3-4.el9.src.rpm

SHA-256: 9d7c7ddde6a8bfe92e4bbdb5e63c25419cb2e997047097ac8fbc7e7c4a3fbd91

s390x

bsdcat-debuginfo-3.5.3-4.el9.s390x.rpm

SHA-256: 0415c14bea1586a63e656f8234db98993eadfc16422c48548239953274befcfb

bsdcat-debuginfo-3.5.3-4.el9.s390x.rpm

SHA-256: 0415c14bea1586a63e656f8234db98993eadfc16422c48548239953274befcfb

bsdcpio-debuginfo-3.5.3-4.el9.s390x.rpm

SHA-256: 1629b39f957951485fee1be2e1767c81db8d13887b656d7088bb87f4540ec409

bsdcpio-debuginfo-3.5.3-4.el9.s390x.rpm

SHA-256: 1629b39f957951485fee1be2e1767c81db8d13887b656d7088bb87f4540ec409

bsdtar-3.5.3-4.el9.s390x.rpm

SHA-256: ce9f42304fbee78a22530cf08258c0c6800578e540a969bf2d99a53018ef21f3

bsdtar-debuginfo-3.5.3-4.el9.s390x.rpm

SHA-256: 98be66a22f7486fbc7560a86c0e4214a2c74e411f3ab0989f145dc4f60bb3234

bsdtar-debuginfo-3.5.3-4.el9.s390x.rpm

SHA-256: 98be66a22f7486fbc7560a86c0e4214a2c74e411f3ab0989f145dc4f60bb3234

libarchive-3.5.3-4.el9.s390x.rpm

SHA-256: 5a9223d1ec0101b15ba1dd4565d60a330ebe608654a19580cb039493f914ddb9

libarchive-debuginfo-3.5.3-4.el9.s390x.rpm

SHA-256: 5c1d4bef86ef52f458892ef10cd094d316989060e1efc91fbc34b86bb2c4e374

libarchive-debuginfo-3.5.3-4.el9.s390x.rpm

SHA-256: 5c1d4bef86ef52f458892ef10cd094d316989060e1efc91fbc34b86bb2c4e374

libarchive-debugsource-3.5.3-4.el9.s390x.rpm

SHA-256: 3d017821d44dbe6b3b0a63a00c0af6332b023ab815f552f86a1701d92528f811

libarchive-debugsource-3.5.3-4.el9.s390x.rpm

SHA-256: 3d017821d44dbe6b3b0a63a00c0af6332b023ab815f552f86a1701d92528f811

Red Hat Enterprise Linux for Power, little endian 9

SRPM

libarchive-3.5.3-4.el9.src.rpm

SHA-256: 9d7c7ddde6a8bfe92e4bbdb5e63c25419cb2e997047097ac8fbc7e7c4a3fbd91

ppc64le

bsdcat-debuginfo-3.5.3-4.el9.ppc64le.rpm

SHA-256: 0d1286580f1d659515f685f44c422cfc30a15580d0462373296af6bd4e05e88c

bsdcat-debuginfo-3.5.3-4.el9.ppc64le.rpm

SHA-256: 0d1286580f1d659515f685f44c422cfc30a15580d0462373296af6bd4e05e88c

bsdcpio-debuginfo-3.5.3-4.el9.ppc64le.rpm

SHA-256: a202da0046a3cd95a775e39a895be6e66dbf9b3b4aa21df7d163e902450c9968

bsdcpio-debuginfo-3.5.3-4.el9.ppc64le.rpm

SHA-256: a202da0046a3cd95a775e39a895be6e66dbf9b3b4aa21df7d163e902450c9968

bsdtar-3.5.3-4.el9.ppc64le.rpm

SHA-256: ff022dea4725c209ffeb61ceb93d947f97e3078ae2deddb34996eb08a879cd6b

bsdtar-debuginfo-3.5.3-4.el9.ppc64le.rpm

SHA-256: d5e33ef4c2aeb78d24dfc0277dc7e46f1da3c868ae051746f8a733ff219d3195

bsdtar-debuginfo-3.5.3-4.el9.ppc64le.rpm

SHA-256: d5e33ef4c2aeb78d24dfc0277dc7e46f1da3c868ae051746f8a733ff219d3195

libarchive-3.5.3-4.el9.ppc64le.rpm

SHA-256: d15f170b728c03aa9e21933c8a30b6b4011a29250a56495330a0a1337b8cd3b5

libarchive-debuginfo-3.5.3-4.el9.ppc64le.rpm

SHA-256: f844f43161be450c1cd1c223cef296f27aeed985b9c0a178c82b4006c1878b47

libarchive-debuginfo-3.5.3-4.el9.ppc64le.rpm

SHA-256: f844f43161be450c1cd1c223cef296f27aeed985b9c0a178c82b4006c1878b47

libarchive-debugsource-3.5.3-4.el9.ppc64le.rpm

SHA-256: ce8f8a314803d6f7ad47d9b8d617da28889e6176c1e6baa909c65b86b1ffe425

libarchive-debugsource-3.5.3-4.el9.ppc64le.rpm

SHA-256: ce8f8a314803d6f7ad47d9b8d617da28889e6176c1e6baa909c65b86b1ffe425

Red Hat Enterprise Linux for ARM 64 9

SRPM

libarchive-3.5.3-4.el9.src.rpm

SHA-256: 9d7c7ddde6a8bfe92e4bbdb5e63c25419cb2e997047097ac8fbc7e7c4a3fbd91

aarch64

bsdcat-debuginfo-3.5.3-4.el9.aarch64.rpm

SHA-256: bbd1af29390cee66e8c2a879609873a46af0777a37ecc9fd6a29dc6cc23d615b

bsdcat-debuginfo-3.5.3-4.el9.aarch64.rpm

SHA-256: bbd1af29390cee66e8c2a879609873a46af0777a37ecc9fd6a29dc6cc23d615b

bsdcpio-debuginfo-3.5.3-4.el9.aarch64.rpm

SHA-256: 56d975d819c5a7bd74d8a19828b80be72d8b81df7849b84e84a1c3067d04cc54

bsdcpio-debuginfo-3.5.3-4.el9.aarch64.rpm

SHA-256: 56d975d819c5a7bd74d8a19828b80be72d8b81df7849b84e84a1c3067d04cc54

bsdtar-3.5.3-4.el9.aarch64.rpm

SHA-256: ea360e40d326d2a629ba085da403e6d4cd78ce57fda1f9db308202c2bee17edf

bsdtar-debuginfo-3.5.3-4.el9.aarch64.rpm

SHA-256: 5d0967ec445ccdce541e1a3de47339d815a9141bca11f04737da8611261f2ec5

bsdtar-debuginfo-3.5.3-4.el9.aarch64.rpm

SHA-256: 5d0967ec445ccdce541e1a3de47339d815a9141bca11f04737da8611261f2ec5

libarchive-3.5.3-4.el9.aarch64.rpm

SHA-256: 9cc18ca21b0d234c0d0ac1a9b25743e0658cbd43bddc4bd055944d617772ab12

libarchive-debuginfo-3.5.3-4.el9.aarch64.rpm

SHA-256: d0539ceebbed882a6c36b54d00c99d08d224826eb3ecc7b6dbeeca598de756a0

libarchive-debuginfo-3.5.3-4.el9.aarch64.rpm

SHA-256: d0539ceebbed882a6c36b54d00c99d08d224826eb3ecc7b6dbeeca598de756a0

libarchive-debugsource-3.5.3-4.el9.aarch64.rpm

SHA-256: 2a43a05979caa68558040a306f6ee3706bd3c3cae4212d8c4bb2466a2daee2a1

libarchive-debugsource-3.5.3-4.el9.aarch64.rpm

SHA-256: 2a43a05979caa68558040a306f6ee3706bd3c3cae4212d8c4bb2466a2daee2a1

Red Hat CodeReady Linux Builder for x86_64 9

SRPM

x86_64

bsdcat-debuginfo-3.5.3-4.el9.i686.rpm

SHA-256: d841c78aec59c38481d9b2b3d8e0b8f19789185f9b8dc4d36f9029e7d91794dd

bsdcat-debuginfo-3.5.3-4.el9.x86_64.rpm

SHA-256: ada462b9a1c65b2f73b0205ccef8f6efad6567101d21b1359bf9cca91dbf59d4

bsdcpio-debuginfo-3.5.3-4.el9.i686.rpm

SHA-256: 114dac7f81d257f267bbb7d819a060fba2feca46f48f6e500a0318d760821479

bsdcpio-debuginfo-3.5.3-4.el9.x86_64.rpm

SHA-256: 5f97728d355e197d5cad216db73be521bf1cb84710e4ee0f2594007bd289450e

bsdtar-debuginfo-3.5.3-4.el9.i686.rpm

SHA-256: 8d7b01fe9389f46d15809be198059b1a56c1def20fa2f24d700dd6aac43084e7

bsdtar-debuginfo-3.5.3-4.el9.x86_64.rpm

SHA-256: 61aa960a18adddf8ad4ef19467b30153cb170a35c8ff5c525d68e49293b16acb

libarchive-debuginfo-3.5.3-4.el9.i686.rpm

SHA-256: 72006c87d5062741b6f183a9eea6a94d0624f029c5c698e4becf66950d894ebe

libarchive-debuginfo-3.5.3-4.el9.x86_64.rpm

SHA-256: bf7868bee4bb22f2c690baad252b475de5b8b58fa09c8ba86c61c769031e66be

libarchive-debugsource-3.5.3-4.el9.i686.rpm

SHA-256: 4fa4a616e6e0252db6415e91256364aba226092f8909aace6395fdf15147c0b4

libarchive-debugsource-3.5.3-4.el9.x86_64.rpm

SHA-256: e89b60a6af17129c40be79c47d8c5f992525e11453306614b0328e8abae538f0

libarchive-devel-3.5.3-4.el9.i686.rpm

SHA-256: a17d202f2e768173f54fcbc845193914f4851cbc077f208f8853c40f0ccd256e

libarchive-devel-3.5.3-4.el9.x86_64.rpm

SHA-256: 9bb8330d80109adcd2f6049cc376bdce41d330982ccd07c19f0e97641c21edd7

Red Hat CodeReady Linux Builder for Power, little endian 9

SRPM

ppc64le

bsdcat-debuginfo-3.5.3-4.el9.ppc64le.rpm

SHA-256: 0d1286580f1d659515f685f44c422cfc30a15580d0462373296af6bd4e05e88c

bsdcpio-debuginfo-3.5.3-4.el9.ppc64le.rpm

SHA-256: a202da0046a3cd95a775e39a895be6e66dbf9b3b4aa21df7d163e902450c9968

bsdtar-debuginfo-3.5.3-4.el9.ppc64le.rpm

SHA-256: d5e33ef4c2aeb78d24dfc0277dc7e46f1da3c868ae051746f8a733ff219d3195

libarchive-debuginfo-3.5.3-4.el9.ppc64le.rpm

SHA-256: f844f43161be450c1cd1c223cef296f27aeed985b9c0a178c82b4006c1878b47

libarchive-debugsource-3.5.3-4.el9.ppc64le.rpm

SHA-256: ce8f8a314803d6f7ad47d9b8d617da28889e6176c1e6baa909c65b86b1ffe425

libarchive-devel-3.5.3-4.el9.ppc64le.rpm

SHA-256: 2bd36eebf4a3cbce9d10b32af172d02c409810fde29b896c2021e05141c42f52

Red Hat CodeReady Linux Builder for ARM 64 9

SRPM

aarch64

bsdcat-debuginfo-3.5.3-4.el9.aarch64.rpm

SHA-256: bbd1af29390cee66e8c2a879609873a46af0777a37ecc9fd6a29dc6cc23d615b

bsdcpio-debuginfo-3.5.3-4.el9.aarch64.rpm

SHA-256: 56d975d819c5a7bd74d8a19828b80be72d8b81df7849b84e84a1c3067d04cc54

bsdtar-debuginfo-3.5.3-4.el9.aarch64.rpm

SHA-256: 5d0967ec445ccdce541e1a3de47339d815a9141bca11f04737da8611261f2ec5

libarchive-debuginfo-3.5.3-4.el9.aarch64.rpm

SHA-256: d0539ceebbed882a6c36b54d00c99d08d224826eb3ecc7b6dbeeca598de756a0

libarchive-debugsource-3.5.3-4.el9.aarch64.rpm

SHA-256: 2a43a05979caa68558040a306f6ee3706bd3c3cae4212d8c4bb2466a2daee2a1

libarchive-devel-3.5.3-4.el9.aarch64.rpm

SHA-256: 0dffdaf496bd0bb1b320be053b6366f0fcb522e59d27301bd76e26c95925ba78

Red Hat CodeReady Linux Builder for IBM z Systems 9

SRPM

s390x

bsdcat-debuginfo-3.5.3-4.el9.s390x.rpm

SHA-256: 0415c14bea1586a63e656f8234db98993eadfc16422c48548239953274befcfb

bsdcpio-debuginfo-3.5.3-4.el9.s390x.rpm

SHA-256: 1629b39f957951485fee1be2e1767c81db8d13887b656d7088bb87f4540ec409

bsdtar-debuginfo-3.5.3-4.el9.s390x.rpm

SHA-256: 98be66a22f7486fbc7560a86c0e4214a2c74e411f3ab0989f145dc4f60bb3234

libarchive-debuginfo-3.5.3-4.el9.s390x.rpm

SHA-256: 5c1d4bef86ef52f458892ef10cd094d316989060e1efc91fbc34b86bb2c4e374

libarchive-debugsource-3.5.3-4.el9.s390x.rpm

SHA-256: 3d017821d44dbe6b3b0a63a00c0af6332b023ab815f552f86a1701d92528f811

libarchive-devel-3.5.3-4.el9.s390x.rpm

SHA-256: 11d18da0c1a3cdb0ff8acc68c21ef80e1a30520a2a2181eb66dc121ac99534d5

Related news

Ubuntu Security Notice USN-7070-1

Ubuntu Security Notice 7070-1 - It was discovered that libarchive mishandled certain memory checks, which could result in a NULL pointer dereference. An attacker could potentially use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. It was discovered that libarchive mishandled certain memory operations, which could result in an out-of-bounds memory access. An attacker could potentially use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.

Gentoo Linux Security Advisory 202309-14

Gentoo Linux Security Advisory 202309-14 - Multiple vulnerabilities have been found in libarchive, the worst of which could result in denial of service. Versions greater than or equal to 3.7.1 are affected.

RHSA-2023:4657: Red Hat Security Advisory: Secondary Scheduler Operator for Red Hat OpenShift 1.1.2 security update

Secondary Scheduler Operator for Red Hat OpenShift 1.1.2 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-24532: A flaw was found in the crypto/internal/nistec golang library. The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars, such as a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh. * CVE-2023-24534: A flaw was found in Golang Go...

Red Hat Security Advisory 2023-4575-01

Red Hat Security Advisory 2023-4575-01 - VolSync is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters.

RHSA-2023:4335: Red Hat Security Advisory: Security Update for cert-manager Operator for Red Hat OpenShift 1.10.3

cert-manager Operator for Red Hat OpenShift 1.10.3 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41723: A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. * CVE-2022-41724: A flaw was found in Golang Go, where it is vulnerable to a denial of service caused when processing large TLS handshake records. By sending specia...

Red Hat Security Advisory 2023-4472-01

Red Hat Security Advisory 2023-4472-01 - Version 1.29.1 of the OpenShift Serverless Operator is supported on Red Hat OpenShift Container Platform versions 4.10, 4.11, 4.12, and 4.13. This release includes security and bug fixes, and enhancements.

RHSA-2023:4472: Red Hat Security Advisory: Release of OpenShift Serverless 1.29.1

Red Hat OpenShift Serverless version 1.29.1 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3089: A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated. * CVE-2023-24539: A flaw was found in golang where angle brackets (<>) were not considered dangerous characters when inserted into CSS contexts. Templates containin...

Red Hat Security Advisory 2023-4286-01

Red Hat Security Advisory 2023-4286-01 - Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development.

RHSA-2023:4290: Red Hat Security Advisory: OpenShift sandboxed containers 1.4.1 security update

OpenShift sandboxed containers 1.4.1 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3089: A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

RHSA-2023:4238: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.11.9 security and bug fix update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.11.9 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3089: A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

RHSA-2023:4025: Red Hat Security Advisory: Red Hat OpenShift support for Windows Containers 7.1.0 [security update]

The components for Red Hat OpenShift support for Windows Containers 7.1.0 are now available. This product release includes bug fixes and security updates for the following packages: windows-machine-config-operator and windows-machine-config-operator-bundle. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-25173: A flaw was found in containerd, where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates...

RHSA-2023:3905: Red Hat Security Advisory: Network observability 1.3.0 for Openshift

Network Observability 1.3.0 for OpenShift Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-24539: A flaw was found in golang where angle brackets (<>) were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in unexpectedly closing the CSS context and allowing for the injection of unexpected HMTL if executed with untrusted input. * CVE-2023-24540: A flaw was found in golang,...

RHSA-2023:3813: Red Hat Security Advisory: Migration Toolkit for Runtimes security update

An update for mtr-operator-bundle-container, mtr-operator-container, mtr-web-container, and mtr-web-executor-container is now available for Migration Toolkit for Runtimes 1 on RHEL 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-4492: A flaw was found in undertow. The undertow client is not checking the server identity the server certificate presents in HTTPS connections. This is a compulsory step ( that should at least be performed by default) in HTTPS and in http/2...

Red Hat Security Advisory 2023-3742-02

Red Hat Security Advisory 2023-3742-02 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, and remote SQL injection vulnerabilities.

RHSA-2023:3342: Red Hat Security Advisory: OpenShift Container Platform 4.13.4 CNF vRAN extras security update

An update for ztp-site-generate-container, topology-aware-lifecycle-manager and bare-metal-event-relay is now available for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-16250: A flaw was found in Vault and Vault Enterprise (“Vault”). In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM identities and roles may be manipulate...

RHSA-2023:3664: Red Hat Security Advisory: OpenShift Jenkins image and Jenkins agent base image security update

Release of Bug Advisories for the OpenShift Jenkins image and Jenkins agent base image. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1705: A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid. * CVE-2022-2880: A flaw was found in the golang package, where reques...

Red Hat Security Advisory 2023-3644-01

Red Hat Security Advisory 2023-3644-01 - Red Hat OpenShift Service Mesh is the Red Hat distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers container images for the release.

Red Hat Security Advisory 2023-3624-01

Red Hat Security Advisory 2023-3624-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Issues addressed include a denial of service vulnerability.

RHSA-2023:3645: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.2.7 security update

Red Hat OpenShift Service Mesh 2.2.7 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-20329: A flaw was found in Mongo. Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshaling Go objects into BSON. This flaw allows a malicious user to use a Go object with a specific string to inject additional fields into marshaled documents. * CVE-2021-43138: A vulnerability was found in the async package. This flaw allows a malicious user to obtai...

RHSA-2023:3609: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.12.4 security and Bug Fix update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.12.4 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3172: A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This issue leads to the client performing unexpected actions and forwarding the client's API server credentials to third parties.

Red Hat Security Advisory 2023-3495-01

Red Hat Security Advisory 2023-3495-01 - Logging Subsystem 5.7.2 - Red Hat OpenShift. Issues addressed include cross site scripting and denial of service vulnerabilities.

RHSA-2023:3495: Red Hat Security Advisory: Logging Subsystem 5.7.2 - Red Hat OpenShift security update

Logging Subsystem 5.7.2 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41723: A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. * CVE-2023-27539: A denial of service vulnerability was found in rubygem-rack in how it parses headers. A carefully crafted input can cause header parsing to take an unexpe...

RHSA-2023:3455: Red Hat Security Advisory: Release of OpenShift Serverless 1.29.0

OpenShift Serverless version 1.29.0 contains a moderate security impact. The References section contains CVE links providing detailed severity ratings for each vulnerability. Ratings are based on a Common Vulnerability Scoring System (CVSS) base score.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41723: A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. * CVE-2022-41724: A flaw was found in Golang Go, where it is vulnerable to a denial of service caused when processing large TLS handshake records. By sending specially-crafted TLS handshake records, a remote, authenticated attacker ...

Red Hat Security Advisory 2023-3379-01

Red Hat Security Advisory 2023-3379-01 - Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes (RHACS). The updated image includes security fixes. This release of RHACS includes a fix for CVE-2023-24540 by building RHACS with updated Golang.

Red Hat Security Advisory 2023-3356-01

Red Hat Security Advisory 2023-3356-01 - Red Hat Advanced Cluster Management for Kubernetes 2.5.9 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs.

RHSA-2023:3373: Red Hat Security Advisory: Migration Toolkit for Runtimes security update

An update for mtr-operator-bundle-container, mtr-operator-container, mtr-web-container, and mtr-web-executor-container is now available for Migration Toolkit for Runtimes 1 on RHEL 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46877: A flaw was found in Jackson Databind. This issue may allow a malicious user to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization. * CVE-2022-41854: Those using Sn...

RHSA-2023:3379: Red Hat Security Advisory: Red Hat Advanced Cluster Security for Kubernetes 3.73 security update

Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes (RHACS). The updated image includes security fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-24540: A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions...

RHSA-2023:3353: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.0.9 security fixes and container updates

Multicluster Engine for Kubernetes 2.0.9 General Availability release images, which fix security issues and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-32313: A flaw was found in the vm2. After making a vm, the inspect method is read-write for console.log, which allows an attacker to edit options for console.log. This issue impacts the integrity by changing the log subsystem. * CVE-2023-32314: A flaw was found in the vm2 sandbox. When a host o...

Red Hat Security Advisory 2023-3326-01

Red Hat Security Advisory 2023-3326-01 - Red Hat Advanced Cluster Management for Kubernetes 2.6.6 images. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs.

Red Hat Security Advisory 2023-3325-01

Red Hat Security Advisory 2023-3325-01 - Multicluster Engine for Kubernetes 2.1.7 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

RHSA-2023:3325: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.1.7 security fixes and container updates

Multicluster Engine for Kubernetes 2.1.7 General Availability release images, which address security issues and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-32313: A flaw was found in the vm2. After making a vm, the inspect method is read-write for console.log, which allows an attacker to edit options for console.log. This issue impacts the integrity by changing the log subsystem. * CVE-2023-32314: A flaw was found in the vm2 sandbox. When a ho...

Red Hat Security Advisory 2023-3296-01

Red Hat Security Advisory 2023-3296-01 - Multicluster Engine for Kubernetes 2.2.4 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

Red Hat Security Advisory 2023-3297-01

Red Hat Security Advisory 2023-3297-01 - Red Hat Advanced Cluster Management for Kubernetes 2.7.4 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs.

RHSA-2023:3297: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.7.4 security fixes and container updates

Red Hat Advanced Cluster Management for Kubernetes 2.7.4 General Availability release images, which fix security issues and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-32313: A flaw was found in the vm2. After making a vm, the inspect method is read-write for console.log, which allows an attacker to edit options for console.log. This issue impacts the integrity by changing the log subsystem. * CVE-2023-32314: A flaw was found in the vm2 sandbo...

RHSA-2023:3296: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.2.4 security fixes and container updates

Multicluster Engine for Kubernetes 2.2.4 General Availability release images, which fix security issues and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-32313: A flaw was found in the vm2. After making a vm, the inspect method is read-write for console.log, which allows an attacker to edit options for console.log. This issue impacts the integrity by changing the log subsystem. * CVE-2023-32314: A flaw was found in the vm2 sandbox. When a host ...

RHSA-2023:3265: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.12.3 Security and Bug fix update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.12.3 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-23539: A flaw was found in the jsonwebtoken package. The affected versions of the `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. *...

RHSA-2023:3018: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-36227: A flaw was found in libarchive. A missing check of the return value of the calloc function can cause a NULL pointer dereference in an out-of-memory condition or when a memory allocation limit is reached, resulting in the program linked with libarchive to crash.

CVE-2022-36227: There is a NULL pointer dereference vulnerability · Issue #1754 · libarchive/libarchive

In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference or, in some cases, even arbitrary code execution.