Headline
RHSA-2023:1976: Red Hat Security Advisory: qatzip security and bug fix update
An update for qatzip is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2022-36369: A potential flaw was found in QATzip. This vulnerability may allow escalation of privileges.
Skip to navigation Skip to main content
Utilities
- Subscriptions
- Downloads
- Containers
- Support Cases
Infrastructure and Management
- Red Hat Enterprise Linux
- Red Hat Virtualization
- Red Hat Identity Management
- Red Hat Directory Server
- Red Hat Certificate System
- Red Hat Satellite
- Red Hat Subscription Management
- Red Hat Update Infrastructure
- Red Hat Insights
- Red Hat Ansible Automation Platform
Cloud Computing
- Red Hat OpenShift
- Red Hat CloudForms
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Data Science
- Red Hat OpenShift Online
- Red Hat OpenShift Dedicated
- Red Hat Advanced Cluster Security for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes
- Red Hat Quay
- Red Hat CodeReady Workspaces
- Red Hat OpenShift Service on AWS
Storage
- Red Hat Gluster Storage
- Red Hat Hyperconverged Infrastructure
- Red Hat Ceph Storage
- Red Hat OpenShift Data Foundation
Runtimes
- Red Hat Runtimes
- Red Hat JBoss Enterprise Application Platform
- Red Hat Data Grid
- Red Hat JBoss Web Server
- Red Hat Single Sign On
- Red Hat support for Spring Boot
- Red Hat build of Node.js
- Red Hat build of Thorntail
- Red Hat build of Eclipse Vert.x
- Red Hat build of OpenJDK
- Red Hat build of Quarkus
Integration and Automation
- Red Hat Process Automation
- Red Hat Process Automation Manager
- Red Hat Decision Manager
All Products
Issued:
2023-04-25
Updated:
2023-04-25
RHSA-2023:1976 - Security Advisory
- Overview
- Updated Packages
Synopsis
Important: qatzip security and bug fix update
Type/Severity
Security Advisory: Important
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for qatzip is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
QATzip is a user space library which builds on top of the Intel QuickAssist Technology user space library, to provide extended accelerated compression and decompression services by offloading the actual compression and decompression request(s) to the Intel Chipset Series.
Security Fix(es):
- qatzip: local privilege escalation (CVE-2022-36369)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- Intel QAT Update - QATzip (User Space Changes) (BZ#2178633)
Affected Products
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0 x86_64
- Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
- Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.0 x86_64
Fixes
- BZ - 2170784 - CVE-2022-36369 qatzip: local privilege escalation
References
- https://access.redhat.com/security/updates/classification/#important
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.0_release_notes/index
Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0
SRPM
qatzip-1.1.2-1.el9_0.src.rpm
SHA-256: 1fc83b2bf5f70c062c2dfe4e9eabb761b349d126360dddd013291208333aeee5
x86_64
qatzip-1.1.2-1.el9_0.x86_64.rpm
SHA-256: 9656f64efabeae2c637e36a9e5a3bdd2c60b3774228d7ed58c72390937b3ed70
qatzip-debuginfo-1.1.2-1.el9_0.x86_64.rpm
SHA-256: dc2d07fdc9df3f9626232fefc67253e5f01c114c743bc7ec28c05008abba255a
qatzip-debugsource-1.1.2-1.el9_0.x86_64.rpm
SHA-256: dd2bc976c7b81c2f08fe2ee70cddd9f25a784efabaae9e88b3da83416877a244
qatzip-libs-1.1.2-1.el9_0.x86_64.rpm
SHA-256: 93a82d67b3887b4359f0c1d6f9702cdcd6a4215e7442937b6df97b45f4e30830
qatzip-libs-debuginfo-1.1.2-1.el9_0.x86_64.rpm
SHA-256: 9141aadc897756a7e9606ed617b0ebf32e9d745870f5ef2f53e028681c801fb1
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0
SRPM
qatzip-1.1.2-1.el9_0.src.rpm
SHA-256: 1fc83b2bf5f70c062c2dfe4e9eabb761b349d126360dddd013291208333aeee5
x86_64
qatzip-1.1.2-1.el9_0.x86_64.rpm
SHA-256: 9656f64efabeae2c637e36a9e5a3bdd2c60b3774228d7ed58c72390937b3ed70
qatzip-debuginfo-1.1.2-1.el9_0.x86_64.rpm
SHA-256: dc2d07fdc9df3f9626232fefc67253e5f01c114c743bc7ec28c05008abba255a
qatzip-debugsource-1.1.2-1.el9_0.x86_64.rpm
SHA-256: dd2bc976c7b81c2f08fe2ee70cddd9f25a784efabaae9e88b3da83416877a244
qatzip-libs-1.1.2-1.el9_0.x86_64.rpm
SHA-256: 93a82d67b3887b4359f0c1d6f9702cdcd6a4215e7442937b6df97b45f4e30830
qatzip-libs-debuginfo-1.1.2-1.el9_0.x86_64.rpm
SHA-256: 9141aadc897756a7e9606ed617b0ebf32e9d745870f5ef2f53e028681c801fb1
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.0
SRPM
x86_64
qatzip-debuginfo-1.1.2-1.el9_0.x86_64.rpm
SHA-256: dc2d07fdc9df3f9626232fefc67253e5f01c114c743bc7ec28c05008abba255a
qatzip-debugsource-1.1.2-1.el9_0.x86_64.rpm
SHA-256: dd2bc976c7b81c2f08fe2ee70cddd9f25a784efabaae9e88b3da83416877a244
qatzip-devel-1.1.2-1.el9_0.x86_64.rpm
SHA-256: 655d6c1f5c92e25c9d73b26e92d4a0060b5c80827d660eab552d5b722f9b8bdf
qatzip-libs-debuginfo-1.1.2-1.el9_0.x86_64.rpm
SHA-256: 9141aadc897756a7e9606ed617b0ebf32e9d745870f5ef2f53e028681c801fb1
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.
Related news
Red Hat Security Advisory 2023-3397-01 - QATzip is a user space library which builds on top of the Intel QuickAssist Technology user space library, to provide extended accelerated compression and decompression services by offloading the actual compression and decompression request to the Intel Chipset Series. Issues addressed include a privilege escalation vulnerability.
An update for qatzip is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-36369: A potential flaw was found in QATzip. This vulnerability may allow escalation of privileges.
Red Hat Security Advisory 2023-1976-01 - QATzip is a user space library which builds on top of the Intel QuickAssist Technology user space library, to provide extended accelerated compression and decompression services by offloading the actual compression and decompression request to the Intel Chipset Series. Issues addressed include a privilege escalation vulnerability.
Improper access control in some QATzip software maintained by Intel(R) before version 1.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access.