Headline
RHSA-2023:2532: Red Hat Security Advisory: libarchive security update
An update for libarchive is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2022-36227: A flaw was found in libarchive. A missing check of the return value of the calloc function can cause a NULL pointer dereference in an out-of-memory condition or when a memory allocation limit is reached, resulting in the program linked with libarchive to crash.
Synopsis
Low: libarchive security update
Type/Severity
Security Advisory: Low
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for libarchive is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.
Security Fix(es):
- libarchive: NULL pointer dereference in archive_write.c (CVE-2022-36227)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.
Affected Products
- Red Hat Enterprise Linux for x86_64 9 x86_64
- Red Hat Enterprise Linux for IBM z Systems 9 s390x
- Red Hat Enterprise Linux for Power, little endian 9 ppc64le
- Red Hat Enterprise Linux for ARM 64 9 aarch64
- Red Hat CodeReady Linux Builder for x86_64 9 x86_64
- Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
- Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
- Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x
Fixes
- BZ - 2144972 - CVE-2022-36227 libarchive: NULL pointer dereference in archive_write.c
References
- https://access.redhat.com/security/updates/classification/#low
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
Red Hat Enterprise Linux for x86_64 9
SRPM
libarchive-3.5.3-4.el9.src.rpm
SHA-256: 9d7c7ddde6a8bfe92e4bbdb5e63c25419cb2e997047097ac8fbc7e7c4a3fbd91
x86_64
bsdcat-debuginfo-3.5.3-4.el9.i686.rpm
SHA-256: d841c78aec59c38481d9b2b3d8e0b8f19789185f9b8dc4d36f9029e7d91794dd
bsdcat-debuginfo-3.5.3-4.el9.x86_64.rpm
SHA-256: ada462b9a1c65b2f73b0205ccef8f6efad6567101d21b1359bf9cca91dbf59d4
bsdcat-debuginfo-3.5.3-4.el9.x86_64.rpm
SHA-256: ada462b9a1c65b2f73b0205ccef8f6efad6567101d21b1359bf9cca91dbf59d4
bsdcpio-debuginfo-3.5.3-4.el9.i686.rpm
SHA-256: 114dac7f81d257f267bbb7d819a060fba2feca46f48f6e500a0318d760821479
bsdcpio-debuginfo-3.5.3-4.el9.x86_64.rpm
SHA-256: 5f97728d355e197d5cad216db73be521bf1cb84710e4ee0f2594007bd289450e
bsdcpio-debuginfo-3.5.3-4.el9.x86_64.rpm
SHA-256: 5f97728d355e197d5cad216db73be521bf1cb84710e4ee0f2594007bd289450e
bsdtar-3.5.3-4.el9.x86_64.rpm
SHA-256: df015c061e8a5e4df56be71d1730f13a5dd17f937e232276af1861c2ebeace39
bsdtar-debuginfo-3.5.3-4.el9.i686.rpm
SHA-256: 8d7b01fe9389f46d15809be198059b1a56c1def20fa2f24d700dd6aac43084e7
bsdtar-debuginfo-3.5.3-4.el9.x86_64.rpm
SHA-256: 61aa960a18adddf8ad4ef19467b30153cb170a35c8ff5c525d68e49293b16acb
bsdtar-debuginfo-3.5.3-4.el9.x86_64.rpm
SHA-256: 61aa960a18adddf8ad4ef19467b30153cb170a35c8ff5c525d68e49293b16acb
libarchive-3.5.3-4.el9.i686.rpm
SHA-256: 2121fc32079e1fc698338ca4e3f045701df01bb10abcd29117613296dd1ceb4f
libarchive-3.5.3-4.el9.x86_64.rpm
SHA-256: 3adc7a9ace1115daa32a327c9f257fc113c1a3a7e561443189f6318222e30238
libarchive-debuginfo-3.5.3-4.el9.i686.rpm
SHA-256: 72006c87d5062741b6f183a9eea6a94d0624f029c5c698e4becf66950d894ebe
libarchive-debuginfo-3.5.3-4.el9.x86_64.rpm
SHA-256: bf7868bee4bb22f2c690baad252b475de5b8b58fa09c8ba86c61c769031e66be
libarchive-debuginfo-3.5.3-4.el9.x86_64.rpm
SHA-256: bf7868bee4bb22f2c690baad252b475de5b8b58fa09c8ba86c61c769031e66be
libarchive-debugsource-3.5.3-4.el9.i686.rpm
SHA-256: 4fa4a616e6e0252db6415e91256364aba226092f8909aace6395fdf15147c0b4
libarchive-debugsource-3.5.3-4.el9.x86_64.rpm
SHA-256: e89b60a6af17129c40be79c47d8c5f992525e11453306614b0328e8abae538f0
libarchive-debugsource-3.5.3-4.el9.x86_64.rpm
SHA-256: e89b60a6af17129c40be79c47d8c5f992525e11453306614b0328e8abae538f0
Red Hat Enterprise Linux for IBM z Systems 9
SRPM
libarchive-3.5.3-4.el9.src.rpm
SHA-256: 9d7c7ddde6a8bfe92e4bbdb5e63c25419cb2e997047097ac8fbc7e7c4a3fbd91
s390x
bsdcat-debuginfo-3.5.3-4.el9.s390x.rpm
SHA-256: 0415c14bea1586a63e656f8234db98993eadfc16422c48548239953274befcfb
bsdcat-debuginfo-3.5.3-4.el9.s390x.rpm
SHA-256: 0415c14bea1586a63e656f8234db98993eadfc16422c48548239953274befcfb
bsdcpio-debuginfo-3.5.3-4.el9.s390x.rpm
SHA-256: 1629b39f957951485fee1be2e1767c81db8d13887b656d7088bb87f4540ec409
bsdcpio-debuginfo-3.5.3-4.el9.s390x.rpm
SHA-256: 1629b39f957951485fee1be2e1767c81db8d13887b656d7088bb87f4540ec409
bsdtar-3.5.3-4.el9.s390x.rpm
SHA-256: ce9f42304fbee78a22530cf08258c0c6800578e540a969bf2d99a53018ef21f3
bsdtar-debuginfo-3.5.3-4.el9.s390x.rpm
SHA-256: 98be66a22f7486fbc7560a86c0e4214a2c74e411f3ab0989f145dc4f60bb3234
bsdtar-debuginfo-3.5.3-4.el9.s390x.rpm
SHA-256: 98be66a22f7486fbc7560a86c0e4214a2c74e411f3ab0989f145dc4f60bb3234
libarchive-3.5.3-4.el9.s390x.rpm
SHA-256: 5a9223d1ec0101b15ba1dd4565d60a330ebe608654a19580cb039493f914ddb9
libarchive-debuginfo-3.5.3-4.el9.s390x.rpm
SHA-256: 5c1d4bef86ef52f458892ef10cd094d316989060e1efc91fbc34b86bb2c4e374
libarchive-debuginfo-3.5.3-4.el9.s390x.rpm
SHA-256: 5c1d4bef86ef52f458892ef10cd094d316989060e1efc91fbc34b86bb2c4e374
libarchive-debugsource-3.5.3-4.el9.s390x.rpm
SHA-256: 3d017821d44dbe6b3b0a63a00c0af6332b023ab815f552f86a1701d92528f811
libarchive-debugsource-3.5.3-4.el9.s390x.rpm
SHA-256: 3d017821d44dbe6b3b0a63a00c0af6332b023ab815f552f86a1701d92528f811
Red Hat Enterprise Linux for Power, little endian 9
SRPM
libarchive-3.5.3-4.el9.src.rpm
SHA-256: 9d7c7ddde6a8bfe92e4bbdb5e63c25419cb2e997047097ac8fbc7e7c4a3fbd91
ppc64le
bsdcat-debuginfo-3.5.3-4.el9.ppc64le.rpm
SHA-256: 0d1286580f1d659515f685f44c422cfc30a15580d0462373296af6bd4e05e88c
bsdcat-debuginfo-3.5.3-4.el9.ppc64le.rpm
SHA-256: 0d1286580f1d659515f685f44c422cfc30a15580d0462373296af6bd4e05e88c
bsdcpio-debuginfo-3.5.3-4.el9.ppc64le.rpm
SHA-256: a202da0046a3cd95a775e39a895be6e66dbf9b3b4aa21df7d163e902450c9968
bsdcpio-debuginfo-3.5.3-4.el9.ppc64le.rpm
SHA-256: a202da0046a3cd95a775e39a895be6e66dbf9b3b4aa21df7d163e902450c9968
bsdtar-3.5.3-4.el9.ppc64le.rpm
SHA-256: ff022dea4725c209ffeb61ceb93d947f97e3078ae2deddb34996eb08a879cd6b
bsdtar-debuginfo-3.5.3-4.el9.ppc64le.rpm
SHA-256: d5e33ef4c2aeb78d24dfc0277dc7e46f1da3c868ae051746f8a733ff219d3195
bsdtar-debuginfo-3.5.3-4.el9.ppc64le.rpm
SHA-256: d5e33ef4c2aeb78d24dfc0277dc7e46f1da3c868ae051746f8a733ff219d3195
libarchive-3.5.3-4.el9.ppc64le.rpm
SHA-256: d15f170b728c03aa9e21933c8a30b6b4011a29250a56495330a0a1337b8cd3b5
libarchive-debuginfo-3.5.3-4.el9.ppc64le.rpm
SHA-256: f844f43161be450c1cd1c223cef296f27aeed985b9c0a178c82b4006c1878b47
libarchive-debuginfo-3.5.3-4.el9.ppc64le.rpm
SHA-256: f844f43161be450c1cd1c223cef296f27aeed985b9c0a178c82b4006c1878b47
libarchive-debugsource-3.5.3-4.el9.ppc64le.rpm
SHA-256: ce8f8a314803d6f7ad47d9b8d617da28889e6176c1e6baa909c65b86b1ffe425
libarchive-debugsource-3.5.3-4.el9.ppc64le.rpm
SHA-256: ce8f8a314803d6f7ad47d9b8d617da28889e6176c1e6baa909c65b86b1ffe425
Red Hat Enterprise Linux for ARM 64 9
SRPM
libarchive-3.5.3-4.el9.src.rpm
SHA-256: 9d7c7ddde6a8bfe92e4bbdb5e63c25419cb2e997047097ac8fbc7e7c4a3fbd91
aarch64
bsdcat-debuginfo-3.5.3-4.el9.aarch64.rpm
SHA-256: bbd1af29390cee66e8c2a879609873a46af0777a37ecc9fd6a29dc6cc23d615b
bsdcat-debuginfo-3.5.3-4.el9.aarch64.rpm
SHA-256: bbd1af29390cee66e8c2a879609873a46af0777a37ecc9fd6a29dc6cc23d615b
bsdcpio-debuginfo-3.5.3-4.el9.aarch64.rpm
SHA-256: 56d975d819c5a7bd74d8a19828b80be72d8b81df7849b84e84a1c3067d04cc54
bsdcpio-debuginfo-3.5.3-4.el9.aarch64.rpm
SHA-256: 56d975d819c5a7bd74d8a19828b80be72d8b81df7849b84e84a1c3067d04cc54
bsdtar-3.5.3-4.el9.aarch64.rpm
SHA-256: ea360e40d326d2a629ba085da403e6d4cd78ce57fda1f9db308202c2bee17edf
bsdtar-debuginfo-3.5.3-4.el9.aarch64.rpm
SHA-256: 5d0967ec445ccdce541e1a3de47339d815a9141bca11f04737da8611261f2ec5
bsdtar-debuginfo-3.5.3-4.el9.aarch64.rpm
SHA-256: 5d0967ec445ccdce541e1a3de47339d815a9141bca11f04737da8611261f2ec5
libarchive-3.5.3-4.el9.aarch64.rpm
SHA-256: 9cc18ca21b0d234c0d0ac1a9b25743e0658cbd43bddc4bd055944d617772ab12
libarchive-debuginfo-3.5.3-4.el9.aarch64.rpm
SHA-256: d0539ceebbed882a6c36b54d00c99d08d224826eb3ecc7b6dbeeca598de756a0
libarchive-debuginfo-3.5.3-4.el9.aarch64.rpm
SHA-256: d0539ceebbed882a6c36b54d00c99d08d224826eb3ecc7b6dbeeca598de756a0
libarchive-debugsource-3.5.3-4.el9.aarch64.rpm
SHA-256: 2a43a05979caa68558040a306f6ee3706bd3c3cae4212d8c4bb2466a2daee2a1
libarchive-debugsource-3.5.3-4.el9.aarch64.rpm
SHA-256: 2a43a05979caa68558040a306f6ee3706bd3c3cae4212d8c4bb2466a2daee2a1
Red Hat CodeReady Linux Builder for x86_64 9
SRPM
x86_64
bsdcat-debuginfo-3.5.3-4.el9.i686.rpm
SHA-256: d841c78aec59c38481d9b2b3d8e0b8f19789185f9b8dc4d36f9029e7d91794dd
bsdcat-debuginfo-3.5.3-4.el9.x86_64.rpm
SHA-256: ada462b9a1c65b2f73b0205ccef8f6efad6567101d21b1359bf9cca91dbf59d4
bsdcpio-debuginfo-3.5.3-4.el9.i686.rpm
SHA-256: 114dac7f81d257f267bbb7d819a060fba2feca46f48f6e500a0318d760821479
bsdcpio-debuginfo-3.5.3-4.el9.x86_64.rpm
SHA-256: 5f97728d355e197d5cad216db73be521bf1cb84710e4ee0f2594007bd289450e
bsdtar-debuginfo-3.5.3-4.el9.i686.rpm
SHA-256: 8d7b01fe9389f46d15809be198059b1a56c1def20fa2f24d700dd6aac43084e7
bsdtar-debuginfo-3.5.3-4.el9.x86_64.rpm
SHA-256: 61aa960a18adddf8ad4ef19467b30153cb170a35c8ff5c525d68e49293b16acb
libarchive-debuginfo-3.5.3-4.el9.i686.rpm
SHA-256: 72006c87d5062741b6f183a9eea6a94d0624f029c5c698e4becf66950d894ebe
libarchive-debuginfo-3.5.3-4.el9.x86_64.rpm
SHA-256: bf7868bee4bb22f2c690baad252b475de5b8b58fa09c8ba86c61c769031e66be
libarchive-debugsource-3.5.3-4.el9.i686.rpm
SHA-256: 4fa4a616e6e0252db6415e91256364aba226092f8909aace6395fdf15147c0b4
libarchive-debugsource-3.5.3-4.el9.x86_64.rpm
SHA-256: e89b60a6af17129c40be79c47d8c5f992525e11453306614b0328e8abae538f0
libarchive-devel-3.5.3-4.el9.i686.rpm
SHA-256: a17d202f2e768173f54fcbc845193914f4851cbc077f208f8853c40f0ccd256e
libarchive-devel-3.5.3-4.el9.x86_64.rpm
SHA-256: 9bb8330d80109adcd2f6049cc376bdce41d330982ccd07c19f0e97641c21edd7
Red Hat CodeReady Linux Builder for Power, little endian 9
SRPM
ppc64le
bsdcat-debuginfo-3.5.3-4.el9.ppc64le.rpm
SHA-256: 0d1286580f1d659515f685f44c422cfc30a15580d0462373296af6bd4e05e88c
bsdcpio-debuginfo-3.5.3-4.el9.ppc64le.rpm
SHA-256: a202da0046a3cd95a775e39a895be6e66dbf9b3b4aa21df7d163e902450c9968
bsdtar-debuginfo-3.5.3-4.el9.ppc64le.rpm
SHA-256: d5e33ef4c2aeb78d24dfc0277dc7e46f1da3c868ae051746f8a733ff219d3195
libarchive-debuginfo-3.5.3-4.el9.ppc64le.rpm
SHA-256: f844f43161be450c1cd1c223cef296f27aeed985b9c0a178c82b4006c1878b47
libarchive-debugsource-3.5.3-4.el9.ppc64le.rpm
SHA-256: ce8f8a314803d6f7ad47d9b8d617da28889e6176c1e6baa909c65b86b1ffe425
libarchive-devel-3.5.3-4.el9.ppc64le.rpm
SHA-256: 2bd36eebf4a3cbce9d10b32af172d02c409810fde29b896c2021e05141c42f52
Red Hat CodeReady Linux Builder for ARM 64 9
SRPM
aarch64
bsdcat-debuginfo-3.5.3-4.el9.aarch64.rpm
SHA-256: bbd1af29390cee66e8c2a879609873a46af0777a37ecc9fd6a29dc6cc23d615b
bsdcpio-debuginfo-3.5.3-4.el9.aarch64.rpm
SHA-256: 56d975d819c5a7bd74d8a19828b80be72d8b81df7849b84e84a1c3067d04cc54
bsdtar-debuginfo-3.5.3-4.el9.aarch64.rpm
SHA-256: 5d0967ec445ccdce541e1a3de47339d815a9141bca11f04737da8611261f2ec5
libarchive-debuginfo-3.5.3-4.el9.aarch64.rpm
SHA-256: d0539ceebbed882a6c36b54d00c99d08d224826eb3ecc7b6dbeeca598de756a0
libarchive-debugsource-3.5.3-4.el9.aarch64.rpm
SHA-256: 2a43a05979caa68558040a306f6ee3706bd3c3cae4212d8c4bb2466a2daee2a1
libarchive-devel-3.5.3-4.el9.aarch64.rpm
SHA-256: 0dffdaf496bd0bb1b320be053b6366f0fcb522e59d27301bd76e26c95925ba78
Red Hat CodeReady Linux Builder for IBM z Systems 9
SRPM
s390x
bsdcat-debuginfo-3.5.3-4.el9.s390x.rpm
SHA-256: 0415c14bea1586a63e656f8234db98993eadfc16422c48548239953274befcfb
bsdcpio-debuginfo-3.5.3-4.el9.s390x.rpm
SHA-256: 1629b39f957951485fee1be2e1767c81db8d13887b656d7088bb87f4540ec409
bsdtar-debuginfo-3.5.3-4.el9.s390x.rpm
SHA-256: 98be66a22f7486fbc7560a86c0e4214a2c74e411f3ab0989f145dc4f60bb3234
libarchive-debuginfo-3.5.3-4.el9.s390x.rpm
SHA-256: 5c1d4bef86ef52f458892ef10cd094d316989060e1efc91fbc34b86bb2c4e374
libarchive-debugsource-3.5.3-4.el9.s390x.rpm
SHA-256: 3d017821d44dbe6b3b0a63a00c0af6332b023ab815f552f86a1701d92528f811
libarchive-devel-3.5.3-4.el9.s390x.rpm
SHA-256: 11d18da0c1a3cdb0ff8acc68c21ef80e1a30520a2a2181eb66dc121ac99534d5
Related news
Ubuntu Security Notice 7070-1 - It was discovered that libarchive mishandled certain memory checks, which could result in a NULL pointer dereference. An attacker could potentially use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. It was discovered that libarchive mishandled certain memory operations, which could result in an out-of-bounds memory access. An attacker could potentially use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
Gentoo Linux Security Advisory 202309-14 - Multiple vulnerabilities have been found in libarchive, the worst of which could result in denial of service. Versions greater than or equal to 3.7.1 are affected.
Secondary Scheduler Operator for Red Hat OpenShift 1.1.2 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-24532: A flaw was found in the crypto/internal/nistec golang library. The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars, such as a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh. * CVE-2023-24534: A flaw was found in Golang Go...
Red Hat Security Advisory 2023-4575-01 - VolSync is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters.
cert-manager Operator for Red Hat OpenShift 1.10.3 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41723: A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. * CVE-2022-41724: A flaw was found in Golang Go, where it is vulnerable to a denial of service caused when processing large TLS handshake records. By sending specia...
Red Hat Security Advisory 2023-4472-01 - Version 1.29.1 of the OpenShift Serverless Operator is supported on Red Hat OpenShift Container Platform versions 4.10, 4.11, 4.12, and 4.13. This release includes security and bug fixes, and enhancements.
Red Hat OpenShift Serverless version 1.29.1 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3089: A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated. * CVE-2023-24539: A flaw was found in golang where angle brackets (<>) were not considered dangerous characters when inserted into CSS contexts. Templates containin...
Red Hat Security Advisory 2023-4286-01 - Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development.
OpenShift sandboxed containers 1.4.1 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3089: A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.
Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.11.9 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3089: A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.
The components for Red Hat OpenShift support for Windows Containers 7.1.0 are now available. This product release includes bug fixes and security updates for the following packages: windows-machine-config-operator and windows-machine-config-operator-bundle. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-25173: A flaw was found in containerd, where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates...
Network Observability 1.3.0 for OpenShift Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-24539: A flaw was found in golang where angle brackets (<>) were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in unexpectedly closing the CSS context and allowing for the injection of unexpected HMTL if executed with untrusted input. * CVE-2023-24540: A flaw was found in golang,...
An update for mtr-operator-bundle-container, mtr-operator-container, mtr-web-container, and mtr-web-executor-container is now available for Migration Toolkit for Runtimes 1 on RHEL 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-4492: A flaw was found in undertow. The undertow client is not checking the server identity the server certificate presents in HTTPS connections. This is a compulsory step ( that should at least be performed by default) in HTTPS and in http/2...
Red Hat Security Advisory 2023-3742-02 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, and remote SQL injection vulnerabilities.
An update for ztp-site-generate-container, topology-aware-lifecycle-manager and bare-metal-event-relay is now available for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-16250: A flaw was found in Vault and Vault Enterprise (“Vault”). In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM identities and roles may be manipulate...
Release of Bug Advisories for the OpenShift Jenkins image and Jenkins agent base image. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1705: A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid. * CVE-2022-2880: A flaw was found in the golang package, where reques...
Red Hat Security Advisory 2023-3644-01 - Red Hat OpenShift Service Mesh is the Red Hat distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers container images for the release.
Red Hat Security Advisory 2023-3624-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Issues addressed include a denial of service vulnerability.
Red Hat OpenShift Service Mesh 2.2.7 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-20329: A flaw was found in Mongo. Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshaling Go objects into BSON. This flaw allows a malicious user to use a Go object with a specific string to inject additional fields into marshaled documents. * CVE-2021-43138: A vulnerability was found in the async package. This flaw allows a malicious user to obtai...
Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.12.4 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3172: A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This issue leads to the client performing unexpected actions and forwarding the client's API server credentials to third parties.
Red Hat Security Advisory 2023-3495-01 - Logging Subsystem 5.7.2 - Red Hat OpenShift. Issues addressed include cross site scripting and denial of service vulnerabilities.
Logging Subsystem 5.7.2 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41723: A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. * CVE-2023-27539: A denial of service vulnerability was found in rubygem-rack in how it parses headers. A carefully crafted input can cause header parsing to take an unexpe...
OpenShift Serverless version 1.29.0 contains a moderate security impact. The References section contains CVE links providing detailed severity ratings for each vulnerability. Ratings are based on a Common Vulnerability Scoring System (CVSS) base score.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41723: A flaw was found in golang. A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. * CVE-2022-41724: A flaw was found in Golang Go, where it is vulnerable to a denial of service caused when processing large TLS handshake records. By sending specially-crafted TLS handshake records, a remote, authenticated attacker ...
Red Hat Security Advisory 2023-3379-01 - Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes (RHACS). The updated image includes security fixes. This release of RHACS includes a fix for CVE-2023-24540 by building RHACS with updated Golang.
Red Hat Security Advisory 2023-3356-01 - Red Hat Advanced Cluster Management for Kubernetes 2.5.9 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs.
An update for mtr-operator-bundle-container, mtr-operator-container, mtr-web-container, and mtr-web-executor-container is now available for Migration Toolkit for Runtimes 1 on RHEL 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46877: A flaw was found in Jackson Databind. This issue may allow a malicious user to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization. * CVE-2022-41854: Those using Sn...
Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes (RHACS). The updated image includes security fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-24540: A flaw was found in golang, where not all valid JavaScript white-space characters were considered white space. Due to this issue, templates containing white-space characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions...
Multicluster Engine for Kubernetes 2.0.9 General Availability release images, which fix security issues and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-32313: A flaw was found in the vm2. After making a vm, the inspect method is read-write for console.log, which allows an attacker to edit options for console.log. This issue impacts the integrity by changing the log subsystem. * CVE-2023-32314: A flaw was found in the vm2 sandbox. When a host o...
Red Hat Security Advisory 2023-3326-01 - Red Hat Advanced Cluster Management for Kubernetes 2.6.6 images. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs.
Red Hat Security Advisory 2023-3325-01 - Multicluster Engine for Kubernetes 2.1.7 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.
Multicluster Engine for Kubernetes 2.1.7 General Availability release images, which address security issues and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-32313: A flaw was found in the vm2. After making a vm, the inspect method is read-write for console.log, which allows an attacker to edit options for console.log. This issue impacts the integrity by changing the log subsystem. * CVE-2023-32314: A flaw was found in the vm2 sandbox. When a ho...
Red Hat Security Advisory 2023-3296-01 - Multicluster Engine for Kubernetes 2.2.4 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.
Red Hat Security Advisory 2023-3297-01 - Red Hat Advanced Cluster Management for Kubernetes 2.7.4 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs.
Red Hat Advanced Cluster Management for Kubernetes 2.7.4 General Availability release images, which fix security issues and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-32313: A flaw was found in the vm2. After making a vm, the inspect method is read-write for console.log, which allows an attacker to edit options for console.log. This issue impacts the integrity by changing the log subsystem. * CVE-2023-32314: A flaw was found in the vm2 sandbo...
Multicluster Engine for Kubernetes 2.2.4 General Availability release images, which fix security issues and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-32313: A flaw was found in the vm2. After making a vm, the inspect method is read-write for console.log, which allows an attacker to edit options for console.log. This issue impacts the integrity by changing the log subsystem. * CVE-2023-32314: A flaw was found in the vm2 sandbox. When a host ...
Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.12.3 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-23539: A flaw was found in the jsonwebtoken package. The affected versions of the `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. *...
An update for libarchive is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-36227: A flaw was found in libarchive. A missing check of the return value of the calloc function can cause a NULL pointer dereference in an out-of-memory condition or when a memory allocation limit is reached, resulting in the program linked with libarchive to crash.
In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference or, in some cases, even arbitrary code execution.