Headline
RHSA-2022:5244: Red Hat Security Advisory: expat security update
An update for expat is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2022-25313: expat: stack exhaustion in doctype parsing
- CVE-2022-25314: expat: integer overflow in copyString()
Synopsis
Moderate: expat security update
Type/Severity
Security Advisory: Moderate
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for expat is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
Expat is a C library for parsing XML documents.
Security Fix(es):
- expat: stack exhaustion in doctype parsing (CVE-2022-25313)
- expat: integer overflow in copyString() (CVE-2022-25314)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Solution
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, applications using the Expat library must be restarted for the update to take effect.
Affected Products
- Red Hat Enterprise Linux for x86_64 9 x86_64
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0 x86_64
- Red Hat Enterprise Linux for IBM z Systems 9 s390x
- Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.0 s390x
- Red Hat Enterprise Linux for Power, little endian 9 ppc64le
- Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.0 ppc64le
- Red Hat Enterprise Linux for ARM 64 9 aarch64
- Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.0 aarch64
- Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le
- Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
- Red Hat Enterprise Linux Server for ARM 64 - 4 years of updates 9.0 aarch64
- Red Hat Enterprise Linux Server for IBM z Systems - 4 years of updates 9.0 s390x
Fixes
- BZ - 2056350 - CVE-2022-25313 expat: stack exhaustion in doctype parsing
- BZ - 2056354 - CVE-2022-25314 expat: integer overflow in copyString()
Red Hat Enterprise Linux for x86_64 9
SRPM
expat-2.2.10-12.el9_0.2.src.rpm
SHA-256: 9e5297bd7c241cb54060cf067efd18f52d2d41bf4539bf82f15ec47f780e80a7
x86_64
expat-2.2.10-12.el9_0.2.i686.rpm
SHA-256: 7402af3a222ccb6a6bab2b4145abf30312c01d032c3984f6c5e42f6a5e71f4f9
expat-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: f0ca7a7831305298ac82e26d1f98054e552e8ca7b937ef9492749740a1b1f367
expat-debuginfo-2.2.10-12.el9_0.2.i686.rpm
SHA-256: e8e8a38930999778246261992542a494c337b6770bfcd3c9a7d5c5401cdd31a6
expat-debuginfo-2.2.10-12.el9_0.2.i686.rpm
SHA-256: e8e8a38930999778246261992542a494c337b6770bfcd3c9a7d5c5401cdd31a6
expat-debuginfo-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 050ec5350d922de7dedb11db1026c48e7345e1414505952fc1d76e4d45d6a12b
expat-debuginfo-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 050ec5350d922de7dedb11db1026c48e7345e1414505952fc1d76e4d45d6a12b
expat-debugsource-2.2.10-12.el9_0.2.i686.rpm
SHA-256: af493a94dd923565d7a4bff830471fd86d280e746e3051a2f9c99f0e9baef8cb
expat-debugsource-2.2.10-12.el9_0.2.i686.rpm
SHA-256: af493a94dd923565d7a4bff830471fd86d280e746e3051a2f9c99f0e9baef8cb
expat-debugsource-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 29c9c488ef3c7495bc58b68d1c8c669d7f12ac6c990124745be1ef9c2b2a0e6e
expat-debugsource-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 29c9c488ef3c7495bc58b68d1c8c669d7f12ac6c990124745be1ef9c2b2a0e6e
expat-devel-2.2.10-12.el9_0.2.i686.rpm
SHA-256: 878f3451605076c1c417e5ff3fdad9073272049cbd49af35a638a578ec85544d
expat-devel-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 6ae221a63ac1feb67f8824e3f9e996d22e8c6135442de2f19ee69bac1e42c9d0
Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.0
SRPM
expat-2.2.10-12.el9_0.2.src.rpm
SHA-256: 9e5297bd7c241cb54060cf067efd18f52d2d41bf4539bf82f15ec47f780e80a7
x86_64
expat-2.2.10-12.el9_0.2.i686.rpm
SHA-256: 7402af3a222ccb6a6bab2b4145abf30312c01d032c3984f6c5e42f6a5e71f4f9
expat-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: f0ca7a7831305298ac82e26d1f98054e552e8ca7b937ef9492749740a1b1f367
expat-debuginfo-2.2.10-12.el9_0.2.i686.rpm
SHA-256: e8e8a38930999778246261992542a494c337b6770bfcd3c9a7d5c5401cdd31a6
expat-debuginfo-2.2.10-12.el9_0.2.i686.rpm
SHA-256: e8e8a38930999778246261992542a494c337b6770bfcd3c9a7d5c5401cdd31a6
expat-debuginfo-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 050ec5350d922de7dedb11db1026c48e7345e1414505952fc1d76e4d45d6a12b
expat-debuginfo-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 050ec5350d922de7dedb11db1026c48e7345e1414505952fc1d76e4d45d6a12b
expat-debugsource-2.2.10-12.el9_0.2.i686.rpm
SHA-256: af493a94dd923565d7a4bff830471fd86d280e746e3051a2f9c99f0e9baef8cb
expat-debugsource-2.2.10-12.el9_0.2.i686.rpm
SHA-256: af493a94dd923565d7a4bff830471fd86d280e746e3051a2f9c99f0e9baef8cb
expat-debugsource-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 29c9c488ef3c7495bc58b68d1c8c669d7f12ac6c990124745be1ef9c2b2a0e6e
expat-debugsource-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 29c9c488ef3c7495bc58b68d1c8c669d7f12ac6c990124745be1ef9c2b2a0e6e
expat-devel-2.2.10-12.el9_0.2.i686.rpm
SHA-256: 878f3451605076c1c417e5ff3fdad9073272049cbd49af35a638a578ec85544d
expat-devel-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 6ae221a63ac1feb67f8824e3f9e996d22e8c6135442de2f19ee69bac1e42c9d0
Red Hat Enterprise Linux for IBM z Systems 9
SRPM
expat-2.2.10-12.el9_0.2.src.rpm
SHA-256: 9e5297bd7c241cb54060cf067efd18f52d2d41bf4539bf82f15ec47f780e80a7
s390x
expat-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: 60ef46870e227d4c17069e0ccc95015373d533f9655b95e3bd4b39d47f89fed9
expat-debuginfo-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: bbfa4c662e95442191f7236a6790c2e40c541c2dae126d87e2df2de3405235f7
expat-debuginfo-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: bbfa4c662e95442191f7236a6790c2e40c541c2dae126d87e2df2de3405235f7
expat-debugsource-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: ed4174f8c12e24746caa47ffb5f4d115130cc5ca8fb53d3aa0896d85df62b664
expat-debugsource-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: ed4174f8c12e24746caa47ffb5f4d115130cc5ca8fb53d3aa0896d85df62b664
expat-devel-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: ef0b9246cf4afe03302ce13cb21dcc111d18c2e16d9b6c985cf66908d62c97af
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.0
SRPM
expat-2.2.10-12.el9_0.2.src.rpm
SHA-256: 9e5297bd7c241cb54060cf067efd18f52d2d41bf4539bf82f15ec47f780e80a7
s390x
expat-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: 60ef46870e227d4c17069e0ccc95015373d533f9655b95e3bd4b39d47f89fed9
expat-debuginfo-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: bbfa4c662e95442191f7236a6790c2e40c541c2dae126d87e2df2de3405235f7
expat-debuginfo-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: bbfa4c662e95442191f7236a6790c2e40c541c2dae126d87e2df2de3405235f7
expat-debugsource-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: ed4174f8c12e24746caa47ffb5f4d115130cc5ca8fb53d3aa0896d85df62b664
expat-debugsource-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: ed4174f8c12e24746caa47ffb5f4d115130cc5ca8fb53d3aa0896d85df62b664
expat-devel-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: ef0b9246cf4afe03302ce13cb21dcc111d18c2e16d9b6c985cf66908d62c97af
Red Hat Enterprise Linux for Power, little endian 9
SRPM
expat-2.2.10-12.el9_0.2.src.rpm
SHA-256: 9e5297bd7c241cb54060cf067efd18f52d2d41bf4539bf82f15ec47f780e80a7
ppc64le
expat-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: 13f5d6cec263151bfb823df1029e71a63de4a864c144fea793cc5f8798157a4b
expat-debuginfo-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: 8aad667087c75e7bdf89b81b953651223f9c880569c219503dfebe31abf94183
expat-debuginfo-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: 8aad667087c75e7bdf89b81b953651223f9c880569c219503dfebe31abf94183
expat-debugsource-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: f776ea231cc9325a3964ac5eb088c3d658ee64c1476a62ec44f3efed7b340a4b
expat-debugsource-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: f776ea231cc9325a3964ac5eb088c3d658ee64c1476a62ec44f3efed7b340a4b
expat-devel-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: abb7b98ce39094033d88cfecc5123868b521cb4fd49ce9d462bfe5ec9e2583b8
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.0
SRPM
expat-2.2.10-12.el9_0.2.src.rpm
SHA-256: 9e5297bd7c241cb54060cf067efd18f52d2d41bf4539bf82f15ec47f780e80a7
ppc64le
expat-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: 13f5d6cec263151bfb823df1029e71a63de4a864c144fea793cc5f8798157a4b
expat-debuginfo-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: 8aad667087c75e7bdf89b81b953651223f9c880569c219503dfebe31abf94183
expat-debuginfo-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: 8aad667087c75e7bdf89b81b953651223f9c880569c219503dfebe31abf94183
expat-debugsource-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: f776ea231cc9325a3964ac5eb088c3d658ee64c1476a62ec44f3efed7b340a4b
expat-debugsource-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: f776ea231cc9325a3964ac5eb088c3d658ee64c1476a62ec44f3efed7b340a4b
expat-devel-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: abb7b98ce39094033d88cfecc5123868b521cb4fd49ce9d462bfe5ec9e2583b8
Red Hat Enterprise Linux for ARM 64 9
SRPM
expat-2.2.10-12.el9_0.2.src.rpm
SHA-256: 9e5297bd7c241cb54060cf067efd18f52d2d41bf4539bf82f15ec47f780e80a7
aarch64
expat-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: d59783c5164678ca0e78af122979be7ca008a679a88d3822c3b25143dac56a8e
expat-debuginfo-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: f372aa33b2ba2623094a205e1b6bb015033262410f272aa8c83f87d530755a20
expat-debuginfo-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: f372aa33b2ba2623094a205e1b6bb015033262410f272aa8c83f87d530755a20
expat-debugsource-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: 3518a3b6ec44f9a8084841b5fd6350485ec687fed98a2ab33558cd6a5cc851d9
expat-debugsource-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: 3518a3b6ec44f9a8084841b5fd6350485ec687fed98a2ab33558cd6a5cc851d9
expat-devel-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: fd575027bb5c39fdfd7dd1f1b5f9eb4d858aa16469241510b58c20a5e278eb1a
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.0
SRPM
expat-2.2.10-12.el9_0.2.src.rpm
SHA-256: 9e5297bd7c241cb54060cf067efd18f52d2d41bf4539bf82f15ec47f780e80a7
aarch64
expat-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: d59783c5164678ca0e78af122979be7ca008a679a88d3822c3b25143dac56a8e
expat-debuginfo-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: f372aa33b2ba2623094a205e1b6bb015033262410f272aa8c83f87d530755a20
expat-debuginfo-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: f372aa33b2ba2623094a205e1b6bb015033262410f272aa8c83f87d530755a20
expat-debugsource-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: 3518a3b6ec44f9a8084841b5fd6350485ec687fed98a2ab33558cd6a5cc851d9
expat-debugsource-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: 3518a3b6ec44f9a8084841b5fd6350485ec687fed98a2ab33558cd6a5cc851d9
expat-devel-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: fd575027bb5c39fdfd7dd1f1b5f9eb4d858aa16469241510b58c20a5e278eb1a
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0
SRPM
expat-2.2.10-12.el9_0.2.src.rpm
SHA-256: 9e5297bd7c241cb54060cf067efd18f52d2d41bf4539bf82f15ec47f780e80a7
ppc64le
expat-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: 13f5d6cec263151bfb823df1029e71a63de4a864c144fea793cc5f8798157a4b
expat-debuginfo-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: 8aad667087c75e7bdf89b81b953651223f9c880569c219503dfebe31abf94183
expat-debuginfo-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: 8aad667087c75e7bdf89b81b953651223f9c880569c219503dfebe31abf94183
expat-debugsource-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: f776ea231cc9325a3964ac5eb088c3d658ee64c1476a62ec44f3efed7b340a4b
expat-debugsource-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: f776ea231cc9325a3964ac5eb088c3d658ee64c1476a62ec44f3efed7b340a4b
expat-devel-2.2.10-12.el9_0.2.ppc64le.rpm
SHA-256: abb7b98ce39094033d88cfecc5123868b521cb4fd49ce9d462bfe5ec9e2583b8
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0
SRPM
expat-2.2.10-12.el9_0.2.src.rpm
SHA-256: 9e5297bd7c241cb54060cf067efd18f52d2d41bf4539bf82f15ec47f780e80a7
x86_64
expat-2.2.10-12.el9_0.2.i686.rpm
SHA-256: 7402af3a222ccb6a6bab2b4145abf30312c01d032c3984f6c5e42f6a5e71f4f9
expat-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: f0ca7a7831305298ac82e26d1f98054e552e8ca7b937ef9492749740a1b1f367
expat-debuginfo-2.2.10-12.el9_0.2.i686.rpm
SHA-256: e8e8a38930999778246261992542a494c337b6770bfcd3c9a7d5c5401cdd31a6
expat-debuginfo-2.2.10-12.el9_0.2.i686.rpm
SHA-256: e8e8a38930999778246261992542a494c337b6770bfcd3c9a7d5c5401cdd31a6
expat-debuginfo-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 050ec5350d922de7dedb11db1026c48e7345e1414505952fc1d76e4d45d6a12b
expat-debuginfo-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 050ec5350d922de7dedb11db1026c48e7345e1414505952fc1d76e4d45d6a12b
expat-debugsource-2.2.10-12.el9_0.2.i686.rpm
SHA-256: af493a94dd923565d7a4bff830471fd86d280e746e3051a2f9c99f0e9baef8cb
expat-debugsource-2.2.10-12.el9_0.2.i686.rpm
SHA-256: af493a94dd923565d7a4bff830471fd86d280e746e3051a2f9c99f0e9baef8cb
expat-debugsource-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 29c9c488ef3c7495bc58b68d1c8c669d7f12ac6c990124745be1ef9c2b2a0e6e
expat-debugsource-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 29c9c488ef3c7495bc58b68d1c8c669d7f12ac6c990124745be1ef9c2b2a0e6e
expat-devel-2.2.10-12.el9_0.2.i686.rpm
SHA-256: 878f3451605076c1c417e5ff3fdad9073272049cbd49af35a638a578ec85544d
expat-devel-2.2.10-12.el9_0.2.x86_64.rpm
SHA-256: 6ae221a63ac1feb67f8824e3f9e996d22e8c6135442de2f19ee69bac1e42c9d0
Red Hat Enterprise Linux Server for ARM 64 - 4 years of updates 9.0
SRPM
expat-2.2.10-12.el9_0.2.src.rpm
SHA-256: 9e5297bd7c241cb54060cf067efd18f52d2d41bf4539bf82f15ec47f780e80a7
aarch64
expat-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: d59783c5164678ca0e78af122979be7ca008a679a88d3822c3b25143dac56a8e
expat-debuginfo-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: f372aa33b2ba2623094a205e1b6bb015033262410f272aa8c83f87d530755a20
expat-debuginfo-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: f372aa33b2ba2623094a205e1b6bb015033262410f272aa8c83f87d530755a20
expat-debugsource-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: 3518a3b6ec44f9a8084841b5fd6350485ec687fed98a2ab33558cd6a5cc851d9
expat-debugsource-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: 3518a3b6ec44f9a8084841b5fd6350485ec687fed98a2ab33558cd6a5cc851d9
expat-devel-2.2.10-12.el9_0.2.aarch64.rpm
SHA-256: fd575027bb5c39fdfd7dd1f1b5f9eb4d858aa16469241510b58c20a5e278eb1a
Red Hat Enterprise Linux Server for IBM z Systems - 4 years of updates 9.0
SRPM
expat-2.2.10-12.el9_0.2.src.rpm
SHA-256: 9e5297bd7c241cb54060cf067efd18f52d2d41bf4539bf82f15ec47f780e80a7
s390x
expat-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: 60ef46870e227d4c17069e0ccc95015373d533f9655b95e3bd4b39d47f89fed9
expat-debuginfo-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: bbfa4c662e95442191f7236a6790c2e40c541c2dae126d87e2df2de3405235f7
expat-debuginfo-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: bbfa4c662e95442191f7236a6790c2e40c541c2dae126d87e2df2de3405235f7
expat-debugsource-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: ed4174f8c12e24746caa47ffb5f4d115130cc5ca8fb53d3aa0896d85df62b664
expat-debugsource-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: ed4174f8c12e24746caa47ffb5f4d115130cc5ca8fb53d3aa0896d85df62b664
expat-devel-2.2.10-12.el9_0.2.s390x.rpm
SHA-256: ef0b9246cf4afe03302ce13cb21dcc111d18c2e16d9b6c985cf66908d62c97af
Related news
Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. (The data typically includes credentials for additional systems.) The attacker must wait for an admin to run the "chef-server-ctl reconfigure" command.
Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. An attacker with privileges same as a legitimate user can phish the legitimate the user to redirect to malicious website leading to information disclosure and launch of phishing attacks.
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demantra Demand Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demantra Demand Management accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]
An update for mingw-expat is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-23990: expat: integer overflow in the doProlog function * CVE-2022-25235: expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution * CVE-2022-25236: expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution * CVE-2022-25313: expat: Stack exhaustion in doctype parsing *...
An update is now available for Red Hat JBoss Core Services. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-33193: httpd: Request splitting via HTTP/2 method injection and mod_proxy * CVE-2021-36160: httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path * CVE-2021-39275: httpd: Out-of-bounds write in ap_escape_quotes() via malicious input * CVE-2021-41524: httpd: NULL pointer dereference via crafted request during HTTP/2 request processing * CVE-202...
An update is now available for Red Hat JBoss Core Services. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-33193: httpd: Request splitting via HTTP/2 method injection and mod_proxy * CVE-2021-36160: httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path * CVE-2021-39275: httpd: Out-of-bounds write in ap_escape_quotes() via malicious input * CVE-2021-41524: httpd: NULL pointer dereference via crafted request during HTTP/2 request processing * CVE-202...
Uncaptured exceptions in the home screen module. Successful exploitation of this vulnerability may affect stability.
Red Hat Security Advisory 2022-6696-01 - Red Hat Advanced Cluster Management for Kubernetes 2.4.6 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. Issues addressed include crlf injection and denial of service vulnerabilities.
In the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due to an insecure default value. This could lead to local information disclosure of network data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-219808546References: Upstream kernel
Red Hat Security Advisory 2022-6429-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Issues addressed include bypass, code execution, and denial of service vulnerabilities.
Red Hat Security Advisory 2022-6430-01 - OpenShift API for Data Protection enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and snapshot-based backups for persistent volumes. Issues addressed include a denial of service vulnerability.
OpenShift API for Data Protection (OADP) 1.0.4 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1705: golang: net/http: improper sanitization of Transfer-Encoding header * CVE-2022-1962: golang: go/parser: stack exhaustion in all Parse* functions * CVE-2022-21698: prometheus/client_golang: Denial of service using InstrumentHandlerCounter * CVE-2022-24675: golang: encoding/pem: fix stack overflow in Decode * CVE-2022-30629: golang: crypto/tls: session ti...
The Migration Toolkit for Containers (MTC) 1.7.4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-28500: nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions * CVE-2021-23337: nodejs-lodash: command injection via template * CVE-2022-0512: nodejs-url-parse: authorization bypass through user-controlled key * CVE-2022-0639: npm-url-parse: Authorization Bypass Through User-Controlled Key * CVE-2022-0686: npm-url-parse: Authorization bypass thr...
Red Hat Security Advisory 2022-6271-01 - This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs. Issues addressed include a denial of service vulnerability.
OpenShift API for Data Protection (OADP) 1.1.0 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-21698: prometheus/client_golang: Denial of service using InstrumentHandlerCounter * CVE-2022-24675: golang: encoding/pem: fix stack overflow in Decode * CVE-2022-28327: golang: crypto/elliptic: panic caused by oversized scalar * CVE-2022-30629: golang: crypto/tls: session tickets lack random ticket_age_add * CVE-2022-30631: golang: compress/gzip: stack exhaus...
Updated images that include numerous enhancements, security, and bug fixes are now available for Red Hat OpenShift Data Foundation 4.11.0 on Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-23440: nodejs-set-value: type confusion allows bypass of CVE-2019-10747 * CVE-2021-23566: nanoid: Information disclosure via valueOf() function * CVE-2022-0235: node-fetch: exposure of sensitive information to an unauthorized actor * CVE-2022-0536: follow-...
Red Hat Security Advisory 2022-6040-01 - Version 1.24.0 of the OpenShift Serverless Operator is supported on Red Hat OpenShift Container Platform versions 4.6, 4.7, 4.8, 4.9, 4.10, and 4.11. This release includes security and bug fixes, and enhancements. Issues addressed include bypass and denial of service vulnerabilities.
Red Hat Security Advisory 2022-5069-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.0. Issues addressed include code execution, cross site scripting, denial of service, information leakage, and traversal vulnerabilities.
Red Hat Security Advisory 2022-5909-01 - Openshift Logging Bug Fix Release. Issues addressed include denial of service and out of bounds read vulnerabilities.
Red Hat Security Advisory 2022-5908-01 - Openshift Logging Bug Fix Release. Issues addressed include denial of service and out of bounds read vulnerabilities.
Openshift Logging Bug Fix Release (5.2.13) Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-38561: golang: out-of-bounds read in golang.org/x/text/language leads to DoS
Openshift Logging Bug Fix Release (5.3.10) Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-38561: golang: out-of-bounds read in golang.org/x/text/language leads to DoS
The Migration Toolkit for Containers (MTC) 1.7.3 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1365: cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor * CVE-2022-24675: golang: encoding/pem: fix stack overflow in Decode * CVE-2022-28327: golang: crypto/elliptic: panic caused by oversized scalar * CVE-2022-29526: golang: syscall: faccessat checks wrong group
Red Hat Security Advisory 2022-5556-01 - Logging Subsystem 5.4.3 has security updates. Issues addressed include denial of service and out of bounds read vulnerabilities.
Red Hat Security Advisory 2022-5704-01 - Updated images are now available for Red Hat Advanced Cluster Security. Issues addressed include a privilege escalation vulnerability.
Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes bug fixes and feature improvements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29173: go-tuf: No protection against rollback attacks for roles other than root
Red Hat Security Advisory 2022-5673-01 - Red Hat OpenStack Platform 16.2 (Train) director operator containers, with several Important security fixes, are available for technology preview. Issues addressed include a code execution vulnerability.
Red Hat OpenStack Platform 16.2 (Train) director operator containers, with several Important security fixes, are available for technology preview.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41103: containerd: insufficiently restricted permissions on container root and plugin directories * CVE-2021-43565: golang.org/x/crypto: empty plaintext packet causes panic * CVE-2022-26945: go-getter: command injection vulnerability * CVE-2022-30321: go-getter: unsafe download (issue 1 of 3) * CVE-2022-30322: go-getter: unsafe download (issue 2 of 3) * CVE-2022-30323: go-getter: unsafe download (issue 3 of 3)
Logging Subsystem 5.4.3 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-38561: golang: out-of-bounds read in golang.org/x/text/language leads to DoS
Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling.
Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.
Pexip Infinity 27.x before 27.2 has Improper Access Control. An attacker can sometimes join a conference (call join) if it has a lock but not a PIN.
Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.
Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.
Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identifier is guessed.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.
Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.
Red Hat Advanced Cluster Management for Kubernetes 2.5.1 General Availability release images, which fix security issues and bugs. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-24450: nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account
Red Hat Security Advisory 2022-5244-01 - Expat is a C library for parsing XML documents. Issues addressed include an integer overflow vulnerability.
Red Hat Security Advisory 2022-5244-01 - Expat is a C library for parsing XML documents. Issues addressed include an integer overflow vulnerability.
An update for expat is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-25313: expat: stack exhaustion in doctype parsing * CVE-2022-25314: expat: integer overflow in copyString()
Dell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. An administrator could potentially exploit this vulnerability, leading to disclosure of sensitive information. This sensitive information can be used to access sensitive resources.
Dell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. An administrator could potentially exploit this vulnerability, leading to disclosure of sensitive information. This sensitive information can be used to access sensitive resources.
Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker could potentially exploit this vulnerability, leading to full system access.
Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker could potentially exploit this vulnerability, leading to full system access.
An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges.
An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges.
Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools are run on the system. The credentials of a user with high privileges are stored in plain text. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user.
Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools are run on the system. The credentials of a user with high privileges are stored in plain text. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user.
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service ...
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service ...
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.