Security
Headlines
HeadlinesLatestCVEs

Headline

RHSA-2023:0343: Red Hat Security Advisory: libtasn1 security update

An update for libtasn1 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

  • CVE-2021-46848: libtasn1: Out-of-bound access in ETYPE_OK
Red Hat Security Data
#vulnerability#web#linux#red_hat#nodejs#js#java#kubernetes#aws#ibm

Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Virtualization
  • Red Hat Identity Management
  • Red Hat Directory Server
  • Red Hat Certificate System
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Update Infrastructure
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat CloudForms
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Online
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • OpenShift Dev Spaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Thorntail
  • Red Hat build of Eclipse Vert.x
  • Red Hat build of OpenJDK
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Process Automation
  • Red Hat Process Automation Manager
  • Red Hat Decision Manager

All Products

Issued:

2023-01-23

Updated:

2023-01-23

RHSA-2023:0343 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Moderate: libtasn1 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libtasn1 is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions.

Security Fix(es):

  • libtasn1: Out-of-bound access in ETYPE_OK (CVE-2021-46848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2140058 - CVE-2021-46848 libtasn1: Out-of-bound access in ETYPE_OK

Red Hat Enterprise Linux for x86_64 9

SRPM

libtasn1-4.16.0-8.el9_1.src.rpm

SHA-256: 52b8bbc5e57c352d20b2e274db7541661dded3b3c14ba30af8d50170c8d4ff59

x86_64

libtasn1-4.16.0-8.el9_1.i686.rpm

SHA-256: 9272ffe4dc9c14b937b116a569624fb36b4cd95fe4288d03cf79193217f3ecd6

libtasn1-4.16.0-8.el9_1.x86_64.rpm

SHA-256: 20670ac5d570fb9adf0d11000eb3e9b95f05ba580752cae912f3fa8347f18279

libtasn1-debuginfo-4.16.0-8.el9_1.i686.rpm

SHA-256: ba13c57c65ee57aa210caa0df2585fc7187f0577a075f1d15a80e27082eeefca

libtasn1-debuginfo-4.16.0-8.el9_1.i686.rpm

SHA-256: ba13c57c65ee57aa210caa0df2585fc7187f0577a075f1d15a80e27082eeefca

libtasn1-debuginfo-4.16.0-8.el9_1.x86_64.rpm

SHA-256: 43184a61a3447c0d41e7b8e2550c700eaca44dc270c7b758722a50b5aa98af58

libtasn1-debuginfo-4.16.0-8.el9_1.x86_64.rpm

SHA-256: 43184a61a3447c0d41e7b8e2550c700eaca44dc270c7b758722a50b5aa98af58

libtasn1-debugsource-4.16.0-8.el9_1.i686.rpm

SHA-256: 51e3bb0fb68007cd470f62c34c1744c90db2f496f7d989e08d4b5d7f62ebeccf

libtasn1-debugsource-4.16.0-8.el9_1.i686.rpm

SHA-256: 51e3bb0fb68007cd470f62c34c1744c90db2f496f7d989e08d4b5d7f62ebeccf

libtasn1-debugsource-4.16.0-8.el9_1.x86_64.rpm

SHA-256: a026165ce3b12c68eb1da5002e5b01c2fdbe2337fee409779a02fad4cd7245b1

libtasn1-debugsource-4.16.0-8.el9_1.x86_64.rpm

SHA-256: a026165ce3b12c68eb1da5002e5b01c2fdbe2337fee409779a02fad4cd7245b1

libtasn1-devel-4.16.0-8.el9_1.i686.rpm

SHA-256: adcdd3a8d836352ff99091fc90223efd19fe77ae7154b07d2255ea05d79ba3c5

libtasn1-devel-4.16.0-8.el9_1.x86_64.rpm

SHA-256: fbc3a1824c724929a82a6efa9d65a836e7c13c917a9ec92617e443f4ae840e76

libtasn1-tools-4.16.0-8.el9_1.x86_64.rpm

SHA-256: 6c116dd84963794481efcef2a46f167da1d5b13e3885576029fb6ba7a7a2188e

libtasn1-tools-debuginfo-4.16.0-8.el9_1.i686.rpm

SHA-256: 7576562f84d1ed2a0ce7285b38bdf3dd1f759a7d3ceb16edd1670a36ead5f69f

libtasn1-tools-debuginfo-4.16.0-8.el9_1.i686.rpm

SHA-256: 7576562f84d1ed2a0ce7285b38bdf3dd1f759a7d3ceb16edd1670a36ead5f69f

libtasn1-tools-debuginfo-4.16.0-8.el9_1.x86_64.rpm

SHA-256: 6879e6a803de834101f9409ddeeecb8701085711af4247825c7cb3d23ecdb5cb

libtasn1-tools-debuginfo-4.16.0-8.el9_1.x86_64.rpm

SHA-256: 6879e6a803de834101f9409ddeeecb8701085711af4247825c7cb3d23ecdb5cb

Red Hat Enterprise Linux for IBM z Systems 9

SRPM

libtasn1-4.16.0-8.el9_1.src.rpm

SHA-256: 52b8bbc5e57c352d20b2e274db7541661dded3b3c14ba30af8d50170c8d4ff59

s390x

libtasn1-4.16.0-8.el9_1.s390x.rpm

SHA-256: c91b7a172eaf21ea2ef57084154461be1ebb5b5e58d46c462fa78165b90feaaa

libtasn1-debuginfo-4.16.0-8.el9_1.s390x.rpm

SHA-256: c32a0913316d930550b0eb1cdffe5c07f9c596d9222fe47adf0fe028dee0907a

libtasn1-debuginfo-4.16.0-8.el9_1.s390x.rpm

SHA-256: c32a0913316d930550b0eb1cdffe5c07f9c596d9222fe47adf0fe028dee0907a

libtasn1-debugsource-4.16.0-8.el9_1.s390x.rpm

SHA-256: 4ee97c41ee3625880e295797f1e693f63335c9fab86aa4bf8d68f1b6e00b1fd8

libtasn1-debugsource-4.16.0-8.el9_1.s390x.rpm

SHA-256: 4ee97c41ee3625880e295797f1e693f63335c9fab86aa4bf8d68f1b6e00b1fd8

libtasn1-devel-4.16.0-8.el9_1.s390x.rpm

SHA-256: 7032f6bcc857e4302be70ce2354e63d909ad2230f73de3b4ffa3403b478bb1e3

libtasn1-tools-4.16.0-8.el9_1.s390x.rpm

SHA-256: 2e19593953f4cdaabc253c3e49168641de65585b1152e128b2876250dd380547

libtasn1-tools-debuginfo-4.16.0-8.el9_1.s390x.rpm

SHA-256: 17bdd95e09251afc7417722caa5f2340e4309e5474007597f6e0b0b07289c70b

libtasn1-tools-debuginfo-4.16.0-8.el9_1.s390x.rpm

SHA-256: 17bdd95e09251afc7417722caa5f2340e4309e5474007597f6e0b0b07289c70b

Red Hat Enterprise Linux for Power, little endian 9

SRPM

libtasn1-4.16.0-8.el9_1.src.rpm

SHA-256: 52b8bbc5e57c352d20b2e274db7541661dded3b3c14ba30af8d50170c8d4ff59

ppc64le

libtasn1-4.16.0-8.el9_1.ppc64le.rpm

SHA-256: 6620d02b0559745b05c838358e56643d67c8259a987829cc306803c402ada01b

libtasn1-debuginfo-4.16.0-8.el9_1.ppc64le.rpm

SHA-256: 6ea9932b34918ff63e2dc9cee7869498340d8d555d7a0ba986ae09f2b640b5be

libtasn1-debuginfo-4.16.0-8.el9_1.ppc64le.rpm

SHA-256: 6ea9932b34918ff63e2dc9cee7869498340d8d555d7a0ba986ae09f2b640b5be

libtasn1-debugsource-4.16.0-8.el9_1.ppc64le.rpm

SHA-256: 01ddf8401c79bc443dd0d298a20d96641cb9acce135cf13e3d657663febeeead

libtasn1-debugsource-4.16.0-8.el9_1.ppc64le.rpm

SHA-256: 01ddf8401c79bc443dd0d298a20d96641cb9acce135cf13e3d657663febeeead

libtasn1-devel-4.16.0-8.el9_1.ppc64le.rpm

SHA-256: 590d39c57b7c0fad96b61e74c92066fcba7b3fdb6f81cc29fa1e2dc15b124400

libtasn1-tools-4.16.0-8.el9_1.ppc64le.rpm

SHA-256: 769cc0dde02e1e7c504223994210a727824c006d3c5aba742ec2cfa9b04f334d

libtasn1-tools-debuginfo-4.16.0-8.el9_1.ppc64le.rpm

SHA-256: 796302bf778cbc1422aa18ddf83dc88f590aeb55998cf8590464d20d507a9347

libtasn1-tools-debuginfo-4.16.0-8.el9_1.ppc64le.rpm

SHA-256: 796302bf778cbc1422aa18ddf83dc88f590aeb55998cf8590464d20d507a9347

Red Hat Enterprise Linux for ARM 64 9

SRPM

libtasn1-4.16.0-8.el9_1.src.rpm

SHA-256: 52b8bbc5e57c352d20b2e274db7541661dded3b3c14ba30af8d50170c8d4ff59

aarch64

libtasn1-4.16.0-8.el9_1.aarch64.rpm

SHA-256: c03053ce8367f515a8574741d14bc33361841f7d9b0a5b434448de6427c17efa

libtasn1-debuginfo-4.16.0-8.el9_1.aarch64.rpm

SHA-256: 83bc8483c8199d8e65d930f86b2e21e9c656f0fef4ef877e15da9524d716d591

libtasn1-debuginfo-4.16.0-8.el9_1.aarch64.rpm

SHA-256: 83bc8483c8199d8e65d930f86b2e21e9c656f0fef4ef877e15da9524d716d591

libtasn1-debugsource-4.16.0-8.el9_1.aarch64.rpm

SHA-256: 88731a6b71c6dacedabff1478205499fef20ba9585444c9de36ef3251d6e7c25

libtasn1-debugsource-4.16.0-8.el9_1.aarch64.rpm

SHA-256: 88731a6b71c6dacedabff1478205499fef20ba9585444c9de36ef3251d6e7c25

libtasn1-devel-4.16.0-8.el9_1.aarch64.rpm

SHA-256: f661c96b92148d192b0597cc2bb236c5170087475843552af816693d29d35bb8

libtasn1-tools-4.16.0-8.el9_1.aarch64.rpm

SHA-256: 15444e20a10d6b2421c5e648b1b73f8e6e49407854abbbcb5de5f70397485e6a

libtasn1-tools-debuginfo-4.16.0-8.el9_1.aarch64.rpm

SHA-256: bc50463032f2d896f73a1a26249eb58fce9fb224093a14c0538502b919a0196a

libtasn1-tools-debuginfo-4.16.0-8.el9_1.aarch64.rpm

SHA-256: bc50463032f2d896f73a1a26249eb58fce9fb224093a14c0538502b919a0196a

The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.

Related news

RHSA-2023:4290: Red Hat Security Advisory: OpenShift sandboxed containers 1.4.1 security update

OpenShift sandboxed containers 1.4.1 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-3089: A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

Red Hat Security Advisory 2023-3742-02

Red Hat Security Advisory 2023-3742-02 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, and remote SQL injection vulnerabilities.

Red Hat Security Advisory 2023-3664-01

Red Hat Security Advisory 2023-3664-01 - Release of Security Advisory for the OpenShift Jenkins image and Jenkins agent base image.

Red Hat Security Advisory 2023-3624-01

Red Hat Security Advisory 2023-3624-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Issues addressed include a denial of service vulnerability.

RHSA-2023:0584: Red Hat Security Advisory: Secondary Scheduler Operator for Red Hat OpenShift 1.1.1 security update

Secondary Scheduler Operator for Red Hat OpenShift 1.1.1 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2880: A flaw was found in the golang package, where requests forwarded by reverse proxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This issue could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. After the fix, the reverse proxy sanitizes the query ...

CVE-2023-21954: Oracle Critical Patch Update Advisory - April 2023

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through...

Red Hat Security Advisory 2023-1448-01

Red Hat Security Advisory 2023-1448-01 - Red Hat OpenShift Service Mesh is the Red Hat distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers container images for the release.

RHSA-2023:1286: Red Hat Security Advisory: Migration Toolkit for Runtimes security bug fix and enhancement update

Migration Toolkit for Runtimes 1.0.2 release Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-31690: A flaw was found in the Spring Security framework. Spring Security could allow a remote attacker to gain elevated privileges on the system. By modifying a request initiated by the Client (via the browser) to the Authorization Server, an attacker can gain elevated privileges on the system. * CVE-2022-41966: A flaw was found in the xstream package. This flaw allows an atta...

Red Hat Security Advisory 2023-1181-01

Red Hat Security Advisory 2023-1181-01 - OpenShift Serverless version 1.27.1 contains a moderate security impact. This release includes security and bug fixes, and enhancements.

Red Hat Security Advisory 2023-1174-01

Red Hat Security Advisory 2023-1174-01 - OpenShift API for Data Protection (OADP) 1.1.2 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate.

Red Hat Security Advisory 2023-1079-01

Red Hat Security Advisory 2023-1079-01 - An update for osp-director-downloader-container, osp-director-agent-container and osp-director-operator-container is now available for Red Hat OpenStack Platform 16.2 (Train).

RHSA-2023:1079: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (osp-director-downloader-container, osp-director-agent-container and osp-director-operator-container) security update

An update for osp-director-downloader-container, osp-director-agent-container and osp-director-operator-container is now available for Red Hat OpenStack Platform 16.2 (Train). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2879: A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw allows a maliciously crafted archive to c...

RHSA-2023:0934: Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update

Migration Toolkit for Applications 6.0.1 release Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-36567: A flaw was found in gin. This issue occurs when the default Formatter for the Logger middleware (LoggerConfig.Formatter), which is included in the Default engine, allows attackers to inject arbitrary log entries by manipulating the request path. * CVE-2021-35065: A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to...

RHSA-2023:0918: Red Hat Security Advisory: Service Binding Operator security update

An update for service-binding-operator-bundle-container and service-binding-operator-container is now available for OpenShift Developer Tools and Services for OCP 4.9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-41717: A flaw was found in the net/http library of the golang package. This flaw allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. W...

Red Hat Security Advisory 2023-0795-01

Red Hat Security Advisory 2023-0795-01 - Submariner 0.13.3 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.6.

Red Hat Security Advisory 2023-0794-01

Red Hat Security Advisory 2023-0794-01 - Red Hat Advanced Cluster Management for Kubernetes 2.6.4 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs.

RHSA-2023:0795: Red Hat Security Advisory: RHSA: Submariner 0.13.3 - security updates and bug fixes

Submariner 0.13.3 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.6 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-32149: A vulnerability was found in the golang.org/x/text/language package. An attacker can craft an Accept-Language header which ParseAcceptLanguage will take significant time to parse. This issue leads to a denial of service, and can impact availability.

RHSA-2023:0794: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.6.4 bug fixes and security updates

Red Hat Advanced Cluster Management for Kubernetes 2.6.4 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-24999: qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload i...

Red Hat Security Advisory 2023-0709-01

Red Hat Security Advisory 2023-0709-01 - Version 1.27.0 of the OpenShift Serverless Operator is supported on Red Hat OpenShift Container Platform versions 4.8, 4.9, 4.10, 4.11 and 4.12. This release includes security and bug fixes, and enhancements.

Red Hat Security Advisory 2023-0634-01

Red Hat Security Advisory 2023-0634-01 - Logging Subsystem 5.6.1 - Red Hat OpenShift. Issues addressed include a denial of service vulnerability.

RHSA-2023:0693: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.7 security and bug fix update

The Migration Toolkit for Containers (MTC) 1.7.7 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-43138: A vulnerability was found in the async package. This flaw allows a malicious user to obtain privileges via the mapValues() method. * CVE-2022-2879: A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw a...

RHSA-2023:0630: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.7.0 security and bug fix updates

Red Hat Advanced Cluster Management for Kubernetes 2.7.0 General Availability release images, which provide security updates and fix bugs. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3517: A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service. * CVE-2022-30629: A flaw was found in the crypto/tls golang pa...

Red Hat Security Advisory 2023-0542-01

Red Hat Security Advisory 2023-0542-01 - Red Hat OpenShift Service Mesh is the Red Hat distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers container images for the release. Issues addressed include denial of service and spoofing vulnerabilities.

RHSA-2023:0542: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.3.1 Containers security update

Red Hat OpenShift Service Mesh 2.3.1 Containers Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-4238: goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be * CVE-2022-2879: golang: archive/tar: unbounded memory consumption when reading headers * CVE-2022-2880: golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters * CVE-2022-3962: kiali: error message spoofing in kiali UI * CVE-2022-27664: golang: ...

RHSA-2022:9096: Red Hat Security Advisory: Red Hat OpenShift support for Windows Containers 7.0.0 [security update]

The components for Red Hat OpenShift support for Windows Container 7.0.0 are now available. This product release includes bug fixes and a moderate security update for the following packages: windows-machine-config-operator and windows-machine-config-operator-bundle. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-25749: kubelet: runAsNonRoot logic bypass for Windows containers * CVE-2022-21698: prometheus/client_golang: Denial of service using InstrumentHandlerCounter *...

Red Hat Security Advisory 2023-0470-01

Red Hat Security Advisory 2023-0470-01 - An update is now available for Migration Toolkit for Runtimes (v1.0.1).

Red Hat Security Advisory 2023-0468-01

Red Hat Security Advisory 2023-0468-01 - Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.

Red Hat Security Advisory 2023-0466-01

Red Hat Security Advisory 2023-0466-01 - Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.

Red Hat Security Advisory 2023-0467-01

Red Hat Security Advisory 2023-0467-01 - Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications. Issues addressed include a bypass vulnerability.

RHSA-2023:0470: Red Hat Security Advisory: Migration Toolkit for Runtimes security update

An update is now available for Migration Toolkit for Runtimes (v1.0.1). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-42920: Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing

RHSA-2023:0468: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.5.9 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22482: ArgoCD: JWT audience claim is not verified

RHSA-2023:0467: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-22482: ArgoCD: JWT audience claim is not verified * CVE-2023-22736: argocd: Controller reconciles apps outside configured namespaces when sharding is enabled

Red Hat Security Advisory 2023-0116-01

Red Hat Security Advisory 2023-0116-01 - A library that provides Abstract Syntax Notation One parsing and structures management, and Distinguished Encoding Rules encoding and decoding functions.

RHSA-2023:0116: Red Hat Security Advisory: libtasn1 security update

An update for libtasn1 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-46848: libtasn1: Out-of-bound access in ETYPE_OK

Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs

Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]

Ubuntu Security Notice USN-5707-1

Ubuntu Security Notice 5707-1 - It was discovered that Libtasn1 did not properly perform bounds checking. An attacker could possibly use this issue to cause a crash.

CVE-2021-46848: Out-of-bound access in ETYPE_OK (#32) · Issues · gnutls / libtasn1 · GitLab

GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.