Security
Headlines
HeadlinesLatestCVEs

Headline

RHSA-2022:5314: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

  • CVE-2022-25313: expat: stack exhaustion in doctype parsing
  • CVE-2022-25314: expat: integer overflow in copyString()
Red Hat Security Data
#vulnerability#linux#red_hat#ibm#sap

Synopsis

Moderate: expat security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for expat is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: stack exhaustion in doctype parsing (CVE-2022-25313)
  • expat: integer overflow in copyString() (CVE-2022-25314)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, applications using the Expat library must be restarted for the update to take effect.

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
  • Red Hat Enterprise Linux Server - AUS 8.6 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.6 x86_64
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64

Fixes

  • BZ - 2056350 - CVE-2022-25313 expat: stack exhaustion in doctype parsing
  • BZ - 2056354 - CVE-2022-25314 expat: integer overflow in copyString()

Red Hat Enterprise Linux for x86_64 8

SRPM

expat-2.2.5-8.el8_6.2.src.rpm

SHA-256: a56875fbe3028204aa133a0b0b0ba120ef712e68282e0d79d9f9e2f5b7af9368

x86_64

expat-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 6b62dcdc35805e3939bbe3fa8b0cec48f1563be67be11378fe4c11fd841c25a9

expat-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 39ec73b49c6b132dd2ee1ba77927a88f39b45cd37186db70053f781177e81ebe

expat-debuginfo-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 5459f17f03560b97093ea231dee31d1f406c0f8da0ff78f62c320af7dd5c5fbd

expat-debuginfo-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 7abd5e88610488061f06a0cc67bdd62ea4eab31b0d670a4e36c04e315633ddb0

expat-debugsource-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 8339255d025492275ebacf6b3c30bcbd0c197d42acd2fb4c87a80a0023ca2d6f

expat-debugsource-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: ab86c9e94e864a4937d5bec0e761c956f952cc25f40ab0beac00b3d89f0d3c86

expat-devel-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 96764a9f6f234c7bc7c43f171ef51b4e7c5abc75ae02d3b580093fc7ddab1083

expat-devel-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 0ad5098f06ef0a5f04fe00f0377b3422f5795cdbc7f83b2693126ef558b4d147

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6

SRPM

expat-2.2.5-8.el8_6.2.src.rpm

SHA-256: a56875fbe3028204aa133a0b0b0ba120ef712e68282e0d79d9f9e2f5b7af9368

x86_64

expat-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 6b62dcdc35805e3939bbe3fa8b0cec48f1563be67be11378fe4c11fd841c25a9

expat-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 39ec73b49c6b132dd2ee1ba77927a88f39b45cd37186db70053f781177e81ebe

expat-debuginfo-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 5459f17f03560b97093ea231dee31d1f406c0f8da0ff78f62c320af7dd5c5fbd

expat-debuginfo-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 7abd5e88610488061f06a0cc67bdd62ea4eab31b0d670a4e36c04e315633ddb0

expat-debugsource-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 8339255d025492275ebacf6b3c30bcbd0c197d42acd2fb4c87a80a0023ca2d6f

expat-debugsource-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: ab86c9e94e864a4937d5bec0e761c956f952cc25f40ab0beac00b3d89f0d3c86

expat-devel-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 96764a9f6f234c7bc7c43f171ef51b4e7c5abc75ae02d3b580093fc7ddab1083

expat-devel-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 0ad5098f06ef0a5f04fe00f0377b3422f5795cdbc7f83b2693126ef558b4d147

Red Hat Enterprise Linux Server - AUS 8.6

SRPM

expat-2.2.5-8.el8_6.2.src.rpm

SHA-256: a56875fbe3028204aa133a0b0b0ba120ef712e68282e0d79d9f9e2f5b7af9368

x86_64

expat-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 6b62dcdc35805e3939bbe3fa8b0cec48f1563be67be11378fe4c11fd841c25a9

expat-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 39ec73b49c6b132dd2ee1ba77927a88f39b45cd37186db70053f781177e81ebe

expat-debuginfo-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 5459f17f03560b97093ea231dee31d1f406c0f8da0ff78f62c320af7dd5c5fbd

expat-debuginfo-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 7abd5e88610488061f06a0cc67bdd62ea4eab31b0d670a4e36c04e315633ddb0

expat-debugsource-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 8339255d025492275ebacf6b3c30bcbd0c197d42acd2fb4c87a80a0023ca2d6f

expat-debugsource-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: ab86c9e94e864a4937d5bec0e761c956f952cc25f40ab0beac00b3d89f0d3c86

expat-devel-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 96764a9f6f234c7bc7c43f171ef51b4e7c5abc75ae02d3b580093fc7ddab1083

expat-devel-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 0ad5098f06ef0a5f04fe00f0377b3422f5795cdbc7f83b2693126ef558b4d147

Red Hat Enterprise Linux for IBM z Systems 8

SRPM

expat-2.2.5-8.el8_6.2.src.rpm

SHA-256: a56875fbe3028204aa133a0b0b0ba120ef712e68282e0d79d9f9e2f5b7af9368

s390x

expat-2.2.5-8.el8_6.2.s390x.rpm

SHA-256: 9d90727abdcd56f23f2327dafff3ac042a90a0bbe9c2b0f13c3287825d9b78e6

expat-debuginfo-2.2.5-8.el8_6.2.s390x.rpm

SHA-256: d8e40fc07e725df3ae108eea70db525f2b71b6f04adf5c7b282f0d3fc7d75c0d

expat-debugsource-2.2.5-8.el8_6.2.s390x.rpm

SHA-256: c36d7ed00b69da246d9cacba850811b40c1cdef7bf8dbb1268ae2aa0709669a0

expat-devel-2.2.5-8.el8_6.2.s390x.rpm

SHA-256: 81d92fda87a645db06419977ad6bc87e699e366cd7da92c4cc29dd55150faee7

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6

SRPM

expat-2.2.5-8.el8_6.2.src.rpm

SHA-256: a56875fbe3028204aa133a0b0b0ba120ef712e68282e0d79d9f9e2f5b7af9368

s390x

expat-2.2.5-8.el8_6.2.s390x.rpm

SHA-256: 9d90727abdcd56f23f2327dafff3ac042a90a0bbe9c2b0f13c3287825d9b78e6

expat-debuginfo-2.2.5-8.el8_6.2.s390x.rpm

SHA-256: d8e40fc07e725df3ae108eea70db525f2b71b6f04adf5c7b282f0d3fc7d75c0d

expat-debugsource-2.2.5-8.el8_6.2.s390x.rpm

SHA-256: c36d7ed00b69da246d9cacba850811b40c1cdef7bf8dbb1268ae2aa0709669a0

expat-devel-2.2.5-8.el8_6.2.s390x.rpm

SHA-256: 81d92fda87a645db06419977ad6bc87e699e366cd7da92c4cc29dd55150faee7

Red Hat Enterprise Linux for Power, little endian 8

SRPM

expat-2.2.5-8.el8_6.2.src.rpm

SHA-256: a56875fbe3028204aa133a0b0b0ba120ef712e68282e0d79d9f9e2f5b7af9368

ppc64le

expat-2.2.5-8.el8_6.2.ppc64le.rpm

SHA-256: 4160f4b75f19cde9120c3a9a4404ad5e860893f3ef53ca6b15a7b69d848e8663

expat-debuginfo-2.2.5-8.el8_6.2.ppc64le.rpm

SHA-256: e20e8debf070462f9b0c0fea12170be1d07eeaaf0b4072bde22b3d0f3b862662

expat-debugsource-2.2.5-8.el8_6.2.ppc64le.rpm

SHA-256: c2ee0a32be23d9cfac392c455436a098b09526aabda9d89e3545e478b7f94931

expat-devel-2.2.5-8.el8_6.2.ppc64le.rpm

SHA-256: ba6191a0faff139b1da69ed402e7ca5bc83c9086e94c072e3b67997800d0a308

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6

SRPM

expat-2.2.5-8.el8_6.2.src.rpm

SHA-256: a56875fbe3028204aa133a0b0b0ba120ef712e68282e0d79d9f9e2f5b7af9368

ppc64le

expat-2.2.5-8.el8_6.2.ppc64le.rpm

SHA-256: 4160f4b75f19cde9120c3a9a4404ad5e860893f3ef53ca6b15a7b69d848e8663

expat-debuginfo-2.2.5-8.el8_6.2.ppc64le.rpm

SHA-256: e20e8debf070462f9b0c0fea12170be1d07eeaaf0b4072bde22b3d0f3b862662

expat-debugsource-2.2.5-8.el8_6.2.ppc64le.rpm

SHA-256: c2ee0a32be23d9cfac392c455436a098b09526aabda9d89e3545e478b7f94931

expat-devel-2.2.5-8.el8_6.2.ppc64le.rpm

SHA-256: ba6191a0faff139b1da69ed402e7ca5bc83c9086e94c072e3b67997800d0a308

Red Hat Enterprise Linux Server - TUS 8.6

SRPM

expat-2.2.5-8.el8_6.2.src.rpm

SHA-256: a56875fbe3028204aa133a0b0b0ba120ef712e68282e0d79d9f9e2f5b7af9368

x86_64

expat-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 6b62dcdc35805e3939bbe3fa8b0cec48f1563be67be11378fe4c11fd841c25a9

expat-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 39ec73b49c6b132dd2ee1ba77927a88f39b45cd37186db70053f781177e81ebe

expat-debuginfo-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 5459f17f03560b97093ea231dee31d1f406c0f8da0ff78f62c320af7dd5c5fbd

expat-debuginfo-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 7abd5e88610488061f06a0cc67bdd62ea4eab31b0d670a4e36c04e315633ddb0

expat-debugsource-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 8339255d025492275ebacf6b3c30bcbd0c197d42acd2fb4c87a80a0023ca2d6f

expat-debugsource-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: ab86c9e94e864a4937d5bec0e761c956f952cc25f40ab0beac00b3d89f0d3c86

expat-devel-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 96764a9f6f234c7bc7c43f171ef51b4e7c5abc75ae02d3b580093fc7ddab1083

expat-devel-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 0ad5098f06ef0a5f04fe00f0377b3422f5795cdbc7f83b2693126ef558b4d147

Red Hat Enterprise Linux for ARM 64 8

SRPM

expat-2.2.5-8.el8_6.2.src.rpm

SHA-256: a56875fbe3028204aa133a0b0b0ba120ef712e68282e0d79d9f9e2f5b7af9368

aarch64

expat-2.2.5-8.el8_6.2.aarch64.rpm

SHA-256: 83494432f64acc26939c3cbba298fa920b13ed2393c7ac242f321a0e5af4a842

expat-debuginfo-2.2.5-8.el8_6.2.aarch64.rpm

SHA-256: 70d65b88def624186b83cc5eea188931327d6fb9e749d33e2a3ce8532c04d0ea

expat-debugsource-2.2.5-8.el8_6.2.aarch64.rpm

SHA-256: 3d7519ffc8736be4bf5b6c15dd8662574c43135dc945314b3a2ecd1d4344bb7a

expat-devel-2.2.5-8.el8_6.2.aarch64.rpm

SHA-256: 5cff038a9b85814254b2d2cd09db8782e83e907930399ad5aa350b313cbbf622

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6

SRPM

expat-2.2.5-8.el8_6.2.src.rpm

SHA-256: a56875fbe3028204aa133a0b0b0ba120ef712e68282e0d79d9f9e2f5b7af9368

aarch64

expat-2.2.5-8.el8_6.2.aarch64.rpm

SHA-256: 83494432f64acc26939c3cbba298fa920b13ed2393c7ac242f321a0e5af4a842

expat-debuginfo-2.2.5-8.el8_6.2.aarch64.rpm

SHA-256: 70d65b88def624186b83cc5eea188931327d6fb9e749d33e2a3ce8532c04d0ea

expat-debugsource-2.2.5-8.el8_6.2.aarch64.rpm

SHA-256: 3d7519ffc8736be4bf5b6c15dd8662574c43135dc945314b3a2ecd1d4344bb7a

expat-devel-2.2.5-8.el8_6.2.aarch64.rpm

SHA-256: 5cff038a9b85814254b2d2cd09db8782e83e907930399ad5aa350b313cbbf622

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6

SRPM

expat-2.2.5-8.el8_6.2.src.rpm

SHA-256: a56875fbe3028204aa133a0b0b0ba120ef712e68282e0d79d9f9e2f5b7af9368

ppc64le

expat-2.2.5-8.el8_6.2.ppc64le.rpm

SHA-256: 4160f4b75f19cde9120c3a9a4404ad5e860893f3ef53ca6b15a7b69d848e8663

expat-debuginfo-2.2.5-8.el8_6.2.ppc64le.rpm

SHA-256: e20e8debf070462f9b0c0fea12170be1d07eeaaf0b4072bde22b3d0f3b862662

expat-debugsource-2.2.5-8.el8_6.2.ppc64le.rpm

SHA-256: c2ee0a32be23d9cfac392c455436a098b09526aabda9d89e3545e478b7f94931

expat-devel-2.2.5-8.el8_6.2.ppc64le.rpm

SHA-256: ba6191a0faff139b1da69ed402e7ca5bc83c9086e94c072e3b67997800d0a308

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6

SRPM

expat-2.2.5-8.el8_6.2.src.rpm

SHA-256: a56875fbe3028204aa133a0b0b0ba120ef712e68282e0d79d9f9e2f5b7af9368

x86_64

expat-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 6b62dcdc35805e3939bbe3fa8b0cec48f1563be67be11378fe4c11fd841c25a9

expat-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 39ec73b49c6b132dd2ee1ba77927a88f39b45cd37186db70053f781177e81ebe

expat-debuginfo-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 5459f17f03560b97093ea231dee31d1f406c0f8da0ff78f62c320af7dd5c5fbd

expat-debuginfo-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 7abd5e88610488061f06a0cc67bdd62ea4eab31b0d670a4e36c04e315633ddb0

expat-debugsource-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 8339255d025492275ebacf6b3c30bcbd0c197d42acd2fb4c87a80a0023ca2d6f

expat-debugsource-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: ab86c9e94e864a4937d5bec0e761c956f952cc25f40ab0beac00b3d89f0d3c86

expat-devel-2.2.5-8.el8_6.2.i686.rpm

SHA-256: 96764a9f6f234c7bc7c43f171ef51b4e7c5abc75ae02d3b580093fc7ddab1083

expat-devel-2.2.5-8.el8_6.2.x86_64.rpm

SHA-256: 0ad5098f06ef0a5f04fe00f0377b3422f5795cdbc7f83b2693126ef558b4d147

Related news

CVE-2023-28864: Chef Infra Server Release Notes

Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. (The data typically includes credentials for additional systems.) The attacker must wait for an admin to run the "chef-server-ctl reconfigure" command.

CVE-2023-28069: DSA-2022-258: Dell Streaming Data Platform Security Update for Multiple Third-Party Component Vulnerabilities

Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. An attacker with privileges same as a legitimate user can phish the legitimate the user to redirect to malicious website leading to information disclosure and launch of phishing attacks.

CVE-2023-21850: Oracle Critical Patch Update Advisory - January 2023

Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demantra Demand Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demantra Demand Management accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs

Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]

RHSA-2022:7811: Red Hat Security Advisory: mingw-expat security update

An update for mingw-expat is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-23990: expat: integer overflow in the doProlog function * CVE-2022-25235: expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution * CVE-2022-25236: expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution * CVE-2022-25313: expat: Stack exhaustion in doctype parsing *...

RHSA-2022:7143: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 security update

An update is now available for Red Hat JBoss Core Services. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-33193: httpd: Request splitting via HTTP/2 method injection and mod_proxy * CVE-2021-36160: httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path * CVE-2021-39275: httpd: Out-of-bounds write in ap_escape_quotes() via malicious input * CVE-2021-41524: httpd: NULL pointer dereference via crafted request during HTTP/2 request processing * CVE-202...

RHSA-2022:7144: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 security update

An update is now available for Red Hat JBoss Core Services. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-33193: httpd: Request splitting via HTTP/2 method injection and mod_proxy * CVE-2021-36160: httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path * CVE-2021-39275: httpd: Out-of-bounds write in ap_escape_quotes() via malicious input * CVE-2021-41524: httpd: NULL pointer dereference via crafted request during HTTP/2 request processing * CVE-202...

CVE-2022-41587: October

Uncaptured exceptions in the home screen module. Successful exploitation of this vulnerability may affect stability.

Red Hat Security Advisory 2022-6696-01

Red Hat Security Advisory 2022-6696-01 - Red Hat Advanced Cluster Management for Kubernetes 2.4.6 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. Issues addressed include crlf injection and denial of service vulnerabilities.

Red Hat Security Advisory 2022-6526-01

Red Hat Security Advisory 2022-6526-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains the following OpenShift Virtualization 4.11.0 images: RHEL-8-CNV-4.11. Issues addressed include denial of service, memory leak, and out of bounds read vulnerabilities.

Red Hat Security Advisory 2022-6429-01

Red Hat Security Advisory 2022-6429-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Issues addressed include bypass, code execution, and denial of service vulnerabilities.

Red Hat Security Advisory 2022-6430-01

Red Hat Security Advisory 2022-6430-01 - OpenShift API for Data Protection enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and snapshot-based backups for persistent volumes. Issues addressed include a denial of service vulnerability.

RHSA-2022:6430: Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.0.4 security and bug fix update

OpenShift API for Data Protection (OADP) 1.0.4 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1705: golang: net/http: improper sanitization of Transfer-Encoding header * CVE-2022-1962: golang: go/parser: stack exhaustion in all Parse* functions * CVE-2022-21698: prometheus/client_golang: Denial of service using InstrumentHandlerCounter * CVE-2022-24675: golang: encoding/pem: fix stack overflow in Decode * CVE-2022-30629: golang: crypto/tls: session ti...

RHSA-2022:6429: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.4 security and bug fix update

The Migration Toolkit for Containers (MTC) 1.7.4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-28500: nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions * CVE-2021-23337: nodejs-lodash: command injection via template * CVE-2022-0512: nodejs-url-parse: authorization bypass through user-controlled key * CVE-2022-0639: npm-url-parse: Authorization Bypass Through User-Controlled Key * CVE-2022-0686: npm-url-parse: Authorization bypass thr...

Red Hat Security Advisory 2022-6290-01

Red Hat Security Advisory 2022-6290-01 - OpenShift API for Data Protection enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. Issues addressed include a denial of service vulnerability.

RHSA-2022:6290: Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.1.0 security and bug fix update

OpenShift API for Data Protection (OADP) 1.1.0 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-21698: prometheus/client_golang: Denial of service using InstrumentHandlerCounter * CVE-2022-24675: golang: encoding/pem: fix stack overflow in Decode * CVE-2022-28327: golang: crypto/elliptic: panic caused by oversized scalar * CVE-2022-30629: golang: crypto/tls: session tickets lack random ticket_age_add * CVE-2022-30631: golang: compress/gzip: stack exhaus...

CVE-2022-31238: DSA-2022-149: Dell EMC PowerScale OneFS Security Update for Multiple Vulnerabilities

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain a process invoked with sensitive information vulnerability. A CLI user may potentially exploit this vulnerability, leading to information disclosure.

Red Hat Security Advisory 2022-6040-01

Red Hat Security Advisory 2022-6040-01 - Version 1.24.0 of the OpenShift Serverless Operator is supported on Red Hat OpenShift Container Platform versions 4.6, 4.7, 4.8, 4.9, 4.10, and 4.11. This release includes security and bug fixes, and enhancements. Issues addressed include bypass and denial of service vulnerabilities.

Red Hat Security Advisory 2022-5069-01

Red Hat Security Advisory 2022-5069-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.0. Issues addressed include code execution, cross site scripting, denial of service, information leakage, and traversal vulnerabilities.

RHSA-2022:5069: Red Hat Security Advisory: OpenShift Container Platform 4.11.0 bug fix and security update

Red Hat OpenShift Container Platform release 4.11.0 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-23566: nanoid: Information disclosure via valueOf() function * CVE-2021-23648: sanitize-url: XSS * CVE-2021-41190: opencontainers: OCI manifest and index parsing confusion * CVE-2021-44906:...

RHSA-2022:6024: Red Hat Security Advisory: New container image for Red Hat Ceph Storage 5.2 Security update

A new container image for Red Hat Ceph Storage 5.2 is now available in the Red Hat Ecosystem Catalog. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-43813: grafana: directory traversal vulnerability * CVE-2022-21673: grafana: Forward OAuth Identity Token can allow users to access some data sources

Red Hat Security Advisory 2022-5909-01

Red Hat Security Advisory 2022-5909-01 - Openshift Logging Bug Fix Release. Issues addressed include denial of service and out of bounds read vulnerabilities.

Red Hat Security Advisory 2022-5908-01

Red Hat Security Advisory 2022-5908-01 - Openshift Logging Bug Fix Release. Issues addressed include denial of service and out of bounds read vulnerabilities.

Red Hat Security Advisory 2022-5840-01

Red Hat Security Advisory 2022-5840-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API.

Red Hat Security Advisory 2022-5556-01

Red Hat Security Advisory 2022-5556-01 - Logging Subsystem 5.4.3 has security updates. Issues addressed include denial of service and out of bounds read vulnerabilities.

RHSA-2022:5704: Red Hat Security Advisory: ACS 3.71 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes bug fixes and feature improvements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29173: go-tuf: No protection against rollback attacks for roles other than root

Red Hat Security Advisory 2022-5673-01

Red Hat Security Advisory 2022-5673-01 - Red Hat OpenStack Platform 16.2 (Train) director operator containers, with several Important security fixes, are available for technology preview. Issues addressed include a code execution vulnerability.

RHSA-2022:5673: Red Hat Security Advisory: Release of containers for OSP 16.2.z director operator tech preview

Red Hat OpenStack Platform 16.2 (Train) director operator containers, with several Important security fixes, are available for technology preview.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41103: containerd: insufficiently restricted permissions on container root and plugin directories * CVE-2021-43565: golang.org/x/crypto: empty plaintext packet causes panic * CVE-2022-26945: go-getter: command injection vulnerability * CVE-2022-30321: go-getter: unsafe download (issue 1 of 3) * CVE-2022-30322: go-getter: unsafe download (issue 2 of 3) * CVE-2022-30323: go-getter: unsafe download (issue 3 of 3)

RHSA-2022:5556: Red Hat Security Advisory: Logging Subsystem 5.4.3 - Red Hat OpenShift security update

Logging Subsystem 5.4.3 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-38561: golang: out-of-bounds read in golang.org/x/text/language leads to DoS

CVE-2022-32263: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.

CVE-2022-29286: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling.

CVE-2022-26655: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams.

CVE-2022-27931: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.

CVE-2022-26654: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.

CVE-2022-26656: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.

CVE-2022-26657: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.

CVE-2022-27928: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.

CVE-2022-27929: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.

CVE-2022-25357: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity 27.x before 27.2 has Improper Access Control. An attacker can sometimes join a conference (call join) if it has a lock but not a PIN.

CVE-2022-27933: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.

CVE-2022-27934: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.

CVE-2022-27935: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.

CVE-2022-27936: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.

CVE-2022-27937: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.

CVE-2022-27932: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.

CVE-2022-27930: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identifier is guessed.

RHSA-2022:5531: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.5.1 security updates and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.5.1 General Availability release images, which fix security issues and bugs. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-24450: nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account

Red Hat Security Advisory 2022-5244-01

Red Hat Security Advisory 2022-5244-01 - Expat is a C library for parsing XML documents. Issues addressed include an integer overflow vulnerability.

Red Hat Security Advisory 2022-5244-01

Red Hat Security Advisory 2022-5244-01 - Expat is a C library for parsing XML documents. Issues addressed include an integer overflow vulnerability.

RHSA-2022:5244: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-25313: expat: stack exhaustion in doctype parsing * CVE-2022-25314: expat: integer overflow in copyString()

RHSA-2022:5244: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-25313: expat: stack exhaustion in doctype parsing * CVE-2022-25314: expat: integer overflow in copyString()

CVE-2022-31229: DSA-2022-118: Dell EMC PowerScale OneFS Security Update

Dell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. An administrator could potentially exploit this vulnerability, leading to disclosure of sensitive information. This sensitive information can be used to access sensitive resources.

CVE-2022-31229: DSA-2022-118: Dell EMC PowerScale OneFS Security Update

Dell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. An administrator could potentially exploit this vulnerability, leading to disclosure of sensitive information. This sensitive information can be used to access sensitive resources.

CVE-2022-31230: DSA-2022-118: Dell EMC PowerScale OneFS Security Update

Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker could potentially exploit this vulnerability, leading to full system access.

CVE-2022-31230: DSA-2022-118: Dell EMC PowerScale OneFS Security Update

Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker could potentially exploit this vulnerability, leading to full system access.

CVE-2022-32973: [R2] Nessus Version 10.2.0 Fixes Multiple Vulnerabilities

An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges.

CVE-2022-32973: [R2] Nessus Version 10.2.0 Fixes Multiple Vulnerabilities

An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges.

CVE-2022-29085: DSA-2022-021: Dell Unity, Dell UnityVSA, and Dell Unity XT Security Update for Multiple Vulnerabilities

Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools are run on the system. The credentials of a user with high privileges are stored in plain text. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user.

CVE-2022-29085: DSA-2022-021: Dell Unity, Dell UnityVSA, and Dell Unity XT Security Update for Multiple Vulnerabilities

Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools are run on the system. The credentials of a user with high privileges are stored in plain text. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user.

CVE-2022-21496: Oracle Critical Patch Update Advisory - April 2022

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service ...

CVE-2022-21496: Oracle Critical Patch Update Advisory - April 2022

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service ...

CVE-2022-25313: [CVE-2022-25313] lib: Prevent stack exhaustion in build_model by ferivoz · Pull Request #558 · libexpat/libexpat

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.