Headline
RHSA-2023:0343: Red Hat Security Advisory: libtasn1 security update
An update for libtasn1 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2021-46848: libtasn1: Out-of-bound access in ETYPE_OK
Skip to navigation Skip to main content
Utilities
- Subscriptions
- Downloads
- Containers
- Support Cases
Infrastructure and Management
- Red Hat Enterprise Linux
- Red Hat Virtualization
- Red Hat Identity Management
- Red Hat Directory Server
- Red Hat Certificate System
- Red Hat Satellite
- Red Hat Subscription Management
- Red Hat Update Infrastructure
- Red Hat Insights
- Red Hat Ansible Automation Platform
Cloud Computing
- Red Hat OpenShift
- Red Hat CloudForms
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Data Science
- Red Hat OpenShift Online
- Red Hat OpenShift Dedicated
- Red Hat Advanced Cluster Security for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes
- Red Hat Quay
- OpenShift Dev Spaces
- Red Hat OpenShift Service on AWS
Storage
- Red Hat Gluster Storage
- Red Hat Hyperconverged Infrastructure
- Red Hat Ceph Storage
- Red Hat OpenShift Data Foundation
Runtimes
- Red Hat Runtimes
- Red Hat JBoss Enterprise Application Platform
- Red Hat Data Grid
- Red Hat JBoss Web Server
- Red Hat Single Sign On
- Red Hat support for Spring Boot
- Red Hat build of Node.js
- Red Hat build of Thorntail
- Red Hat build of Eclipse Vert.x
- Red Hat build of OpenJDK
- Red Hat build of Quarkus
Integration and Automation
- Red Hat Process Automation
- Red Hat Process Automation Manager
- Red Hat Decision Manager
All Products
Issued:
2023-01-23
Updated:
2023-01-23
RHSA-2023:0343 - Security Advisory
- Overview
- Updated Packages
Synopsis
Moderate: libtasn1 security update
Type/Severity
Security Advisory: Moderate
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for libtasn1 is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions.
Security Fix(es):
- libtasn1: Out-of-bound access in ETYPE_OK (CVE-2021-46848)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Products
- Red Hat Enterprise Linux for x86_64 9 x86_64
- Red Hat Enterprise Linux for IBM z Systems 9 s390x
- Red Hat Enterprise Linux for Power, little endian 9 ppc64le
- Red Hat Enterprise Linux for ARM 64 9 aarch64
Fixes
- BZ - 2140058 - CVE-2021-46848 libtasn1: Out-of-bound access in ETYPE_OK
Red Hat Enterprise Linux for x86_64 9
SRPM
libtasn1-4.16.0-8.el9_1.src.rpm
SHA-256: 52b8bbc5e57c352d20b2e274db7541661dded3b3c14ba30af8d50170c8d4ff59
x86_64
libtasn1-4.16.0-8.el9_1.i686.rpm
SHA-256: 9272ffe4dc9c14b937b116a569624fb36b4cd95fe4288d03cf79193217f3ecd6
libtasn1-4.16.0-8.el9_1.x86_64.rpm
SHA-256: 20670ac5d570fb9adf0d11000eb3e9b95f05ba580752cae912f3fa8347f18279
libtasn1-debuginfo-4.16.0-8.el9_1.i686.rpm
SHA-256: ba13c57c65ee57aa210caa0df2585fc7187f0577a075f1d15a80e27082eeefca
libtasn1-debuginfo-4.16.0-8.el9_1.i686.rpm
SHA-256: ba13c57c65ee57aa210caa0df2585fc7187f0577a075f1d15a80e27082eeefca
libtasn1-debuginfo-4.16.0-8.el9_1.x86_64.rpm
SHA-256: 43184a61a3447c0d41e7b8e2550c700eaca44dc270c7b758722a50b5aa98af58
libtasn1-debuginfo-4.16.0-8.el9_1.x86_64.rpm
SHA-256: 43184a61a3447c0d41e7b8e2550c700eaca44dc270c7b758722a50b5aa98af58
libtasn1-debugsource-4.16.0-8.el9_1.i686.rpm
SHA-256: 51e3bb0fb68007cd470f62c34c1744c90db2f496f7d989e08d4b5d7f62ebeccf
libtasn1-debugsource-4.16.0-8.el9_1.i686.rpm
SHA-256: 51e3bb0fb68007cd470f62c34c1744c90db2f496f7d989e08d4b5d7f62ebeccf
libtasn1-debugsource-4.16.0-8.el9_1.x86_64.rpm
SHA-256: a026165ce3b12c68eb1da5002e5b01c2fdbe2337fee409779a02fad4cd7245b1
libtasn1-debugsource-4.16.0-8.el9_1.x86_64.rpm
SHA-256: a026165ce3b12c68eb1da5002e5b01c2fdbe2337fee409779a02fad4cd7245b1
libtasn1-devel-4.16.0-8.el9_1.i686.rpm
SHA-256: adcdd3a8d836352ff99091fc90223efd19fe77ae7154b07d2255ea05d79ba3c5
libtasn1-devel-4.16.0-8.el9_1.x86_64.rpm
SHA-256: fbc3a1824c724929a82a6efa9d65a836e7c13c917a9ec92617e443f4ae840e76
libtasn1-tools-4.16.0-8.el9_1.x86_64.rpm
SHA-256: 6c116dd84963794481efcef2a46f167da1d5b13e3885576029fb6ba7a7a2188e
libtasn1-tools-debuginfo-4.16.0-8.el9_1.i686.rpm
SHA-256: 7576562f84d1ed2a0ce7285b38bdf3dd1f759a7d3ceb16edd1670a36ead5f69f
libtasn1-tools-debuginfo-4.16.0-8.el9_1.i686.rpm
SHA-256: 7576562f84d1ed2a0ce7285b38bdf3dd1f759a7d3ceb16edd1670a36ead5f69f
libtasn1-tools-debuginfo-4.16.0-8.el9_1.x86_64.rpm
SHA-256: 6879e6a803de834101f9409ddeeecb8701085711af4247825c7cb3d23ecdb5cb
libtasn1-tools-debuginfo-4.16.0-8.el9_1.x86_64.rpm
SHA-256: 6879e6a803de834101f9409ddeeecb8701085711af4247825c7cb3d23ecdb5cb
Red Hat Enterprise Linux for IBM z Systems 9
SRPM
libtasn1-4.16.0-8.el9_1.src.rpm
SHA-256: 52b8bbc5e57c352d20b2e274db7541661dded3b3c14ba30af8d50170c8d4ff59
s390x
libtasn1-4.16.0-8.el9_1.s390x.rpm
SHA-256: c91b7a172eaf21ea2ef57084154461be1ebb5b5e58d46c462fa78165b90feaaa
libtasn1-debuginfo-4.16.0-8.el9_1.s390x.rpm
SHA-256: c32a0913316d930550b0eb1cdffe5c07f9c596d9222fe47adf0fe028dee0907a
libtasn1-debuginfo-4.16.0-8.el9_1.s390x.rpm
SHA-256: c32a0913316d930550b0eb1cdffe5c07f9c596d9222fe47adf0fe028dee0907a
libtasn1-debugsource-4.16.0-8.el9_1.s390x.rpm
SHA-256: 4ee97c41ee3625880e295797f1e693f63335c9fab86aa4bf8d68f1b6e00b1fd8
libtasn1-debugsource-4.16.0-8.el9_1.s390x.rpm
SHA-256: 4ee97c41ee3625880e295797f1e693f63335c9fab86aa4bf8d68f1b6e00b1fd8
libtasn1-devel-4.16.0-8.el9_1.s390x.rpm
SHA-256: 7032f6bcc857e4302be70ce2354e63d909ad2230f73de3b4ffa3403b478bb1e3
libtasn1-tools-4.16.0-8.el9_1.s390x.rpm
SHA-256: 2e19593953f4cdaabc253c3e49168641de65585b1152e128b2876250dd380547
libtasn1-tools-debuginfo-4.16.0-8.el9_1.s390x.rpm
SHA-256: 17bdd95e09251afc7417722caa5f2340e4309e5474007597f6e0b0b07289c70b
libtasn1-tools-debuginfo-4.16.0-8.el9_1.s390x.rpm
SHA-256: 17bdd95e09251afc7417722caa5f2340e4309e5474007597f6e0b0b07289c70b
Red Hat Enterprise Linux for Power, little endian 9
SRPM
libtasn1-4.16.0-8.el9_1.src.rpm
SHA-256: 52b8bbc5e57c352d20b2e274db7541661dded3b3c14ba30af8d50170c8d4ff59
ppc64le
libtasn1-4.16.0-8.el9_1.ppc64le.rpm
SHA-256: 6620d02b0559745b05c838358e56643d67c8259a987829cc306803c402ada01b
libtasn1-debuginfo-4.16.0-8.el9_1.ppc64le.rpm
SHA-256: 6ea9932b34918ff63e2dc9cee7869498340d8d555d7a0ba986ae09f2b640b5be
libtasn1-debuginfo-4.16.0-8.el9_1.ppc64le.rpm
SHA-256: 6ea9932b34918ff63e2dc9cee7869498340d8d555d7a0ba986ae09f2b640b5be
libtasn1-debugsource-4.16.0-8.el9_1.ppc64le.rpm
SHA-256: 01ddf8401c79bc443dd0d298a20d96641cb9acce135cf13e3d657663febeeead
libtasn1-debugsource-4.16.0-8.el9_1.ppc64le.rpm
SHA-256: 01ddf8401c79bc443dd0d298a20d96641cb9acce135cf13e3d657663febeeead
libtasn1-devel-4.16.0-8.el9_1.ppc64le.rpm
SHA-256: 590d39c57b7c0fad96b61e74c92066fcba7b3fdb6f81cc29fa1e2dc15b124400
libtasn1-tools-4.16.0-8.el9_1.ppc64le.rpm
SHA-256: 769cc0dde02e1e7c504223994210a727824c006d3c5aba742ec2cfa9b04f334d
libtasn1-tools-debuginfo-4.16.0-8.el9_1.ppc64le.rpm
SHA-256: 796302bf778cbc1422aa18ddf83dc88f590aeb55998cf8590464d20d507a9347
libtasn1-tools-debuginfo-4.16.0-8.el9_1.ppc64le.rpm
SHA-256: 796302bf778cbc1422aa18ddf83dc88f590aeb55998cf8590464d20d507a9347
Red Hat Enterprise Linux for ARM 64 9
SRPM
libtasn1-4.16.0-8.el9_1.src.rpm
SHA-256: 52b8bbc5e57c352d20b2e274db7541661dded3b3c14ba30af8d50170c8d4ff59
aarch64
libtasn1-4.16.0-8.el9_1.aarch64.rpm
SHA-256: c03053ce8367f515a8574741d14bc33361841f7d9b0a5b434448de6427c17efa
libtasn1-debuginfo-4.16.0-8.el9_1.aarch64.rpm
SHA-256: 83bc8483c8199d8e65d930f86b2e21e9c656f0fef4ef877e15da9524d716d591
libtasn1-debuginfo-4.16.0-8.el9_1.aarch64.rpm
SHA-256: 83bc8483c8199d8e65d930f86b2e21e9c656f0fef4ef877e15da9524d716d591
libtasn1-debugsource-4.16.0-8.el9_1.aarch64.rpm
SHA-256: 88731a6b71c6dacedabff1478205499fef20ba9585444c9de36ef3251d6e7c25
libtasn1-debugsource-4.16.0-8.el9_1.aarch64.rpm
SHA-256: 88731a6b71c6dacedabff1478205499fef20ba9585444c9de36ef3251d6e7c25
libtasn1-devel-4.16.0-8.el9_1.aarch64.rpm
SHA-256: f661c96b92148d192b0597cc2bb236c5170087475843552af816693d29d35bb8
libtasn1-tools-4.16.0-8.el9_1.aarch64.rpm
SHA-256: 15444e20a10d6b2421c5e648b1b73f8e6e49407854abbbcb5de5f70397485e6a
libtasn1-tools-debuginfo-4.16.0-8.el9_1.aarch64.rpm
SHA-256: bc50463032f2d896f73a1a26249eb58fce9fb224093a14c0538502b919a0196a
libtasn1-tools-debuginfo-4.16.0-8.el9_1.aarch64.rpm
SHA-256: bc50463032f2d896f73a1a26249eb58fce9fb224093a14c0538502b919a0196a
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.
Related news
OpenShift sandboxed containers 1.4.1 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3089: A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.
Red Hat Security Advisory 2023-3742-02 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, and remote SQL injection vulnerabilities.
Red Hat Security Advisory 2023-3664-01 - Release of Security Advisory for the OpenShift Jenkins image and Jenkins agent base image.
Red Hat Security Advisory 2023-3624-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Issues addressed include a denial of service vulnerability.
Secondary Scheduler Operator for Red Hat OpenShift 1.1.1 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2880: A flaw was found in the golang package, where requests forwarded by reverse proxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This issue could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. After the fix, the reverse proxy sanitizes the query ...
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through...
Red Hat Security Advisory 2023-1448-01 - Red Hat OpenShift Service Mesh is the Red Hat distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers container images for the release.
Migration Toolkit for Runtimes 1.0.2 release Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-31690: A flaw was found in the Spring Security framework. Spring Security could allow a remote attacker to gain elevated privileges on the system. By modifying a request initiated by the Client (via the browser) to the Authorization Server, an attacker can gain elevated privileges on the system. * CVE-2022-41966: A flaw was found in the xstream package. This flaw allows an atta...
Red Hat Security Advisory 2023-1181-01 - OpenShift Serverless version 1.27.1 contains a moderate security impact. This release includes security and bug fixes, and enhancements.
Red Hat Security Advisory 2023-1174-01 - OpenShift API for Data Protection (OADP) 1.1.2 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate.
Red Hat Security Advisory 2023-1079-01 - An update for osp-director-downloader-container, osp-director-agent-container and osp-director-operator-container is now available for Red Hat OpenStack Platform 16.2 (Train).
An update for osp-director-downloader-container, osp-director-agent-container and osp-director-operator-container is now available for Red Hat OpenStack Platform 16.2 (Train). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2879: A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw allows a maliciously crafted archive to c...
Migration Toolkit for Applications 6.0.1 release Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-36567: A flaw was found in gin. This issue occurs when the default Formatter for the Logger middleware (LoggerConfig.Formatter), which is included in the Default engine, allows attackers to inject arbitrary log entries by manipulating the request path. * CVE-2021-35065: A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to...
An update for service-binding-operator-bundle-container and service-binding-operator-container is now available for OpenShift Developer Tools and Services for OCP 4.9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41717: A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. W...
Red Hat Security Advisory 2023-0795-01 - Submariner 0.13.3 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.6.
Red Hat Security Advisory 2023-0794-01 - Red Hat Advanced Cluster Management for Kubernetes 2.6.4 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs.
Submariner 0.13.3 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.6 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-32149: A vulnerability was found in the golang.org/x/text/language package. An attacker can craft an Accept-Language header which ParseAcceptLanguage will take significant time to parse. This issue leads to a denial of service, and can impact availability.
Red Hat Advanced Cluster Management for Kubernetes 2.6.4 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-24999: qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload i...
Red Hat Security Advisory 2023-0709-01 - Version 1.27.0 of the OpenShift Serverless Operator is supported on Red Hat OpenShift Container Platform versions 4.8, 4.9, 4.10, 4.11 and 4.12. This release includes security and bug fixes, and enhancements.
Red Hat Security Advisory 2023-0634-01 - Logging Subsystem 5.6.1 - Red Hat OpenShift. Issues addressed include a denial of service vulnerability.
The Migration Toolkit for Containers (MTC) 1.7.7 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-43138: A vulnerability was found in the async package. This flaw allows a malicious user to obtain privileges via the mapValues() method. * CVE-2022-2879: A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw a...
Red Hat Advanced Cluster Management for Kubernetes 2.7.0 General Availability release images, which provide security updates and fix bugs. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3517: A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service. * CVE-2022-30629: A flaw was found in the crypto/tls golang pa...
Red Hat Security Advisory 2023-0542-01 - Red Hat OpenShift Service Mesh is the Red Hat distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers container images for the release. Issues addressed include denial of service and spoofing vulnerabilities.
Red Hat OpenShift Service Mesh 2.3.1 Containers Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be * CVE-2022-2879: golang: archive/tar: unbounded memory consumption when reading headers * CVE-2022-2880: golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters * CVE-2022-3962: kiali: error message spoofing in kiali UI * CVE-2022-27664: golang: ...
The components for Red Hat OpenShift support for Windows Container 7.0.0 are now available. This product release includes bug fixes and a moderate security update for the following packages: windows-machine-config-operator and windows-machine-config-operator-bundle. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-25749: kubelet: runAsNonRoot logic bypass for Windows containers * CVE-2022-21698: prometheus/client_golang: Denial of service using InstrumentHandlerCounter *...
Red Hat Security Advisory 2023-0470-01 - An update is now available for Migration Toolkit for Runtimes (v1.0.1).
Red Hat Security Advisory 2023-0468-01 - Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.
Red Hat Security Advisory 2023-0466-01 - Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.
Red Hat Security Advisory 2023-0467-01 - Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications. Issues addressed include a bypass vulnerability.
An update is now available for Migration Toolkit for Runtimes (v1.0.1). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-42920: Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing
An update is now available for Red Hat OpenShift GitOps 1.5.9 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22482: ArgoCD: JWT audience claim is not verified
An update is now available for Red Hat OpenShift GitOps 1.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22482: ArgoCD: JWT audience claim is not verified * CVE-2023-22736: argocd: Controller reconciles apps outside configured namespaces when sharding is enabled
Red Hat Security Advisory 2023-0116-01 - A library that provides Abstract Syntax Notation One parsing and structures management, and Distinguished Encoding Rules encoding and decoding functions.
An update for libtasn1 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46848: libtasn1: Out-of-bound access in ETYPE_OK
Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]
Ubuntu Security Notice 5707-1 - It was discovered that Libtasn1 did not properly perform bounds checking. An attacker could possibly use this issue to cause a crash.
GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.