Security
Headlines
HeadlinesLatestCVEs

Headline

RHSA-2022:5311: Red Hat Security Advisory: libgcrypt security update

An update for libgcrypt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

  • CVE-2021-40528: libgcrypt: ElGamal implementation allows plaintext recovery
Red Hat Security Data
#vulnerability#linux#red_hat#ibm#sap

Synopsis

Moderate: libgcrypt security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libgcrypt is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libgcrypt library provides general-purpose implementations of various cryptographic algorithms.

Security Fix(es):

  • libgcrypt: ElGamal implementation allows plaintext recovery (CVE-2021-40528)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
  • Red Hat Enterprise Linux Server - AUS 8.6 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.6 x86_64
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64

Fixes

  • BZ - 2002816 - CVE-2021-40528 libgcrypt: ElGamal implementation allows plaintext recovery

Red Hat Enterprise Linux for x86_64 8

SRPM

libgcrypt-1.8.5-7.el8_6.src.rpm

SHA-256: 99734fb837bc7026c65eb15c0525f68288e73672fc2a3d583c3279786e47a13d

x86_64

libgcrypt-1.8.5-7.el8_6.i686.rpm

SHA-256: 70477a828e837801c2905343ba3998140d21b2c6e76ec0d5da82bbafc9ece0dc

libgcrypt-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 8af1caa726c0b3b398eed421511ff26222f3ddfa131b90fedaa4fe464216338c

libgcrypt-debuginfo-1.8.5-7.el8_6.i686.rpm

SHA-256: b9dc8640b900796b39ce122a868ed7ce84aefbae50989423916c06d41e6c4295

libgcrypt-debuginfo-1.8.5-7.el8_6.x86_64.rpm

SHA-256: d07f3d0d3220d27414ea9338e4b05ffe8f6f79e4bbba5a5262e580d3e0095abf

libgcrypt-debugsource-1.8.5-7.el8_6.i686.rpm

SHA-256: 0c724ddf22172a3454c0259226cd31433082ccadfda0995268314a29b32b4e9d

libgcrypt-debugsource-1.8.5-7.el8_6.x86_64.rpm

SHA-256: b5f47d5bf9583d7b4416e7c99676c013d998e1b480cacd1b72cad723f5de0ff1

libgcrypt-devel-1.8.5-7.el8_6.i686.rpm

SHA-256: 4fcb065d6e13b7c1875167fe5449579822476cb8c72140bc39ef7186c510d5ba

libgcrypt-devel-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 94dfe4b3dfcdf0ec71e7c3ad41ef6c0a78912b3e9d9ae40636cd5188e9b874cb

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.i686.rpm

SHA-256: 7082c62cd12859f2ded03642696e7ae6c97d0ade625b33f766c0a681b5fb7805

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 1ea2f3a4fc0146d4f5cca94d15480c14db818792d833180ed708d2e4714397fb

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6

SRPM

libgcrypt-1.8.5-7.el8_6.src.rpm

SHA-256: 99734fb837bc7026c65eb15c0525f68288e73672fc2a3d583c3279786e47a13d

x86_64

libgcrypt-1.8.5-7.el8_6.i686.rpm

SHA-256: 70477a828e837801c2905343ba3998140d21b2c6e76ec0d5da82bbafc9ece0dc

libgcrypt-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 8af1caa726c0b3b398eed421511ff26222f3ddfa131b90fedaa4fe464216338c

libgcrypt-debuginfo-1.8.5-7.el8_6.i686.rpm

SHA-256: b9dc8640b900796b39ce122a868ed7ce84aefbae50989423916c06d41e6c4295

libgcrypt-debuginfo-1.8.5-7.el8_6.x86_64.rpm

SHA-256: d07f3d0d3220d27414ea9338e4b05ffe8f6f79e4bbba5a5262e580d3e0095abf

libgcrypt-debugsource-1.8.5-7.el8_6.i686.rpm

SHA-256: 0c724ddf22172a3454c0259226cd31433082ccadfda0995268314a29b32b4e9d

libgcrypt-debugsource-1.8.5-7.el8_6.x86_64.rpm

SHA-256: b5f47d5bf9583d7b4416e7c99676c013d998e1b480cacd1b72cad723f5de0ff1

libgcrypt-devel-1.8.5-7.el8_6.i686.rpm

SHA-256: 4fcb065d6e13b7c1875167fe5449579822476cb8c72140bc39ef7186c510d5ba

libgcrypt-devel-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 94dfe4b3dfcdf0ec71e7c3ad41ef6c0a78912b3e9d9ae40636cd5188e9b874cb

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.i686.rpm

SHA-256: 7082c62cd12859f2ded03642696e7ae6c97d0ade625b33f766c0a681b5fb7805

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 1ea2f3a4fc0146d4f5cca94d15480c14db818792d833180ed708d2e4714397fb

Red Hat Enterprise Linux Server - AUS 8.6

SRPM

libgcrypt-1.8.5-7.el8_6.src.rpm

SHA-256: 99734fb837bc7026c65eb15c0525f68288e73672fc2a3d583c3279786e47a13d

x86_64

libgcrypt-1.8.5-7.el8_6.i686.rpm

SHA-256: 70477a828e837801c2905343ba3998140d21b2c6e76ec0d5da82bbafc9ece0dc

libgcrypt-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 8af1caa726c0b3b398eed421511ff26222f3ddfa131b90fedaa4fe464216338c

libgcrypt-debuginfo-1.8.5-7.el8_6.i686.rpm

SHA-256: b9dc8640b900796b39ce122a868ed7ce84aefbae50989423916c06d41e6c4295

libgcrypt-debuginfo-1.8.5-7.el8_6.x86_64.rpm

SHA-256: d07f3d0d3220d27414ea9338e4b05ffe8f6f79e4bbba5a5262e580d3e0095abf

libgcrypt-debugsource-1.8.5-7.el8_6.i686.rpm

SHA-256: 0c724ddf22172a3454c0259226cd31433082ccadfda0995268314a29b32b4e9d

libgcrypt-debugsource-1.8.5-7.el8_6.x86_64.rpm

SHA-256: b5f47d5bf9583d7b4416e7c99676c013d998e1b480cacd1b72cad723f5de0ff1

libgcrypt-devel-1.8.5-7.el8_6.i686.rpm

SHA-256: 4fcb065d6e13b7c1875167fe5449579822476cb8c72140bc39ef7186c510d5ba

libgcrypt-devel-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 94dfe4b3dfcdf0ec71e7c3ad41ef6c0a78912b3e9d9ae40636cd5188e9b874cb

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.i686.rpm

SHA-256: 7082c62cd12859f2ded03642696e7ae6c97d0ade625b33f766c0a681b5fb7805

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 1ea2f3a4fc0146d4f5cca94d15480c14db818792d833180ed708d2e4714397fb

Red Hat Enterprise Linux for IBM z Systems 8

SRPM

libgcrypt-1.8.5-7.el8_6.src.rpm

SHA-256: 99734fb837bc7026c65eb15c0525f68288e73672fc2a3d583c3279786e47a13d

s390x

libgcrypt-1.8.5-7.el8_6.s390x.rpm

SHA-256: 15a227136f2596ba44a88a04dd460ecbcf90d5bd6bd13951cb28d43edb46dc55

libgcrypt-debuginfo-1.8.5-7.el8_6.s390x.rpm

SHA-256: 8202e3dc65961ddbb144dbb84f8a5ef22178b9456b5cb4647f745ad37bbfed74

libgcrypt-debugsource-1.8.5-7.el8_6.s390x.rpm

SHA-256: 049a67e2f1d8f49595e6564d388c7ce5164173ec7d4883abad9157da81211251

libgcrypt-devel-1.8.5-7.el8_6.s390x.rpm

SHA-256: c0c2de5121d3ddae40b2683f08ea452ddcfcffbed9007e3ce1df0d8a87d5ab23

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.s390x.rpm

SHA-256: 108175bf5b232a560ca671c44ffdf515a765c75c5d050c573abf165522c2c01e

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6

SRPM

libgcrypt-1.8.5-7.el8_6.src.rpm

SHA-256: 99734fb837bc7026c65eb15c0525f68288e73672fc2a3d583c3279786e47a13d

s390x

libgcrypt-1.8.5-7.el8_6.s390x.rpm

SHA-256: 15a227136f2596ba44a88a04dd460ecbcf90d5bd6bd13951cb28d43edb46dc55

libgcrypt-debuginfo-1.8.5-7.el8_6.s390x.rpm

SHA-256: 8202e3dc65961ddbb144dbb84f8a5ef22178b9456b5cb4647f745ad37bbfed74

libgcrypt-debugsource-1.8.5-7.el8_6.s390x.rpm

SHA-256: 049a67e2f1d8f49595e6564d388c7ce5164173ec7d4883abad9157da81211251

libgcrypt-devel-1.8.5-7.el8_6.s390x.rpm

SHA-256: c0c2de5121d3ddae40b2683f08ea452ddcfcffbed9007e3ce1df0d8a87d5ab23

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.s390x.rpm

SHA-256: 108175bf5b232a560ca671c44ffdf515a765c75c5d050c573abf165522c2c01e

Red Hat Enterprise Linux for Power, little endian 8

SRPM

libgcrypt-1.8.5-7.el8_6.src.rpm

SHA-256: 99734fb837bc7026c65eb15c0525f68288e73672fc2a3d583c3279786e47a13d

ppc64le

libgcrypt-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: 45f33fab13c06919b98bb5e2950f51bb3863f96de8bf82654eba71d22eb9c46b

libgcrypt-debuginfo-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: b53990b80dd690615d0d5d0dcb4546c8a60fb92abdcb20572b37e116a4904b3a

libgcrypt-debugsource-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: 3cf1c29f3529171e77c51dcdc50351bedb5ac02c5d68bc77b962afe76221938c

libgcrypt-devel-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: abd2677f21d7a4762bc786020090cc472cd8d515507c7275c579a49ed61e80f3

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: 65959fad327c75e8d2cf4fd9f25cdc8b1ff053bd01a8c550d188521ede7fb711

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6

SRPM

libgcrypt-1.8.5-7.el8_6.src.rpm

SHA-256: 99734fb837bc7026c65eb15c0525f68288e73672fc2a3d583c3279786e47a13d

ppc64le

libgcrypt-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: 45f33fab13c06919b98bb5e2950f51bb3863f96de8bf82654eba71d22eb9c46b

libgcrypt-debuginfo-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: b53990b80dd690615d0d5d0dcb4546c8a60fb92abdcb20572b37e116a4904b3a

libgcrypt-debugsource-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: 3cf1c29f3529171e77c51dcdc50351bedb5ac02c5d68bc77b962afe76221938c

libgcrypt-devel-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: abd2677f21d7a4762bc786020090cc472cd8d515507c7275c579a49ed61e80f3

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: 65959fad327c75e8d2cf4fd9f25cdc8b1ff053bd01a8c550d188521ede7fb711

Red Hat Enterprise Linux Server - TUS 8.6

SRPM

libgcrypt-1.8.5-7.el8_6.src.rpm

SHA-256: 99734fb837bc7026c65eb15c0525f68288e73672fc2a3d583c3279786e47a13d

x86_64

libgcrypt-1.8.5-7.el8_6.i686.rpm

SHA-256: 70477a828e837801c2905343ba3998140d21b2c6e76ec0d5da82bbafc9ece0dc

libgcrypt-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 8af1caa726c0b3b398eed421511ff26222f3ddfa131b90fedaa4fe464216338c

libgcrypt-debuginfo-1.8.5-7.el8_6.i686.rpm

SHA-256: b9dc8640b900796b39ce122a868ed7ce84aefbae50989423916c06d41e6c4295

libgcrypt-debuginfo-1.8.5-7.el8_6.x86_64.rpm

SHA-256: d07f3d0d3220d27414ea9338e4b05ffe8f6f79e4bbba5a5262e580d3e0095abf

libgcrypt-debugsource-1.8.5-7.el8_6.i686.rpm

SHA-256: 0c724ddf22172a3454c0259226cd31433082ccadfda0995268314a29b32b4e9d

libgcrypt-debugsource-1.8.5-7.el8_6.x86_64.rpm

SHA-256: b5f47d5bf9583d7b4416e7c99676c013d998e1b480cacd1b72cad723f5de0ff1

libgcrypt-devel-1.8.5-7.el8_6.i686.rpm

SHA-256: 4fcb065d6e13b7c1875167fe5449579822476cb8c72140bc39ef7186c510d5ba

libgcrypt-devel-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 94dfe4b3dfcdf0ec71e7c3ad41ef6c0a78912b3e9d9ae40636cd5188e9b874cb

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.i686.rpm

SHA-256: 7082c62cd12859f2ded03642696e7ae6c97d0ade625b33f766c0a681b5fb7805

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 1ea2f3a4fc0146d4f5cca94d15480c14db818792d833180ed708d2e4714397fb

Red Hat Enterprise Linux for ARM 64 8

SRPM

libgcrypt-1.8.5-7.el8_6.src.rpm

SHA-256: 99734fb837bc7026c65eb15c0525f68288e73672fc2a3d583c3279786e47a13d

aarch64

libgcrypt-1.8.5-7.el8_6.aarch64.rpm

SHA-256: 821780ed5e37ef027ea154d497a80e44f874669e3a89ad11f18bd9a09bf23f64

libgcrypt-debuginfo-1.8.5-7.el8_6.aarch64.rpm

SHA-256: e40e97b006330ff7b7133a1276dc07b5fd9b9104abec6889fc09cc887e951c53

libgcrypt-debugsource-1.8.5-7.el8_6.aarch64.rpm

SHA-256: 6c477056d1ab36bee2d7439b7174cd7cf7c9107c294a21e872023db1a5915654

libgcrypt-devel-1.8.5-7.el8_6.aarch64.rpm

SHA-256: 861a25e9a7f331ca4b9b86bb27d6e4e288c1542a5fc66d21fc679e8fe4caf595

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.aarch64.rpm

SHA-256: 513cd386bde1ccf1db1062401b1a8b0ade10339bd423d773ca8cbcb649232bc9

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6

SRPM

libgcrypt-1.8.5-7.el8_6.src.rpm

SHA-256: 99734fb837bc7026c65eb15c0525f68288e73672fc2a3d583c3279786e47a13d

aarch64

libgcrypt-1.8.5-7.el8_6.aarch64.rpm

SHA-256: 821780ed5e37ef027ea154d497a80e44f874669e3a89ad11f18bd9a09bf23f64

libgcrypt-debuginfo-1.8.5-7.el8_6.aarch64.rpm

SHA-256: e40e97b006330ff7b7133a1276dc07b5fd9b9104abec6889fc09cc887e951c53

libgcrypt-debugsource-1.8.5-7.el8_6.aarch64.rpm

SHA-256: 6c477056d1ab36bee2d7439b7174cd7cf7c9107c294a21e872023db1a5915654

libgcrypt-devel-1.8.5-7.el8_6.aarch64.rpm

SHA-256: 861a25e9a7f331ca4b9b86bb27d6e4e288c1542a5fc66d21fc679e8fe4caf595

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.aarch64.rpm

SHA-256: 513cd386bde1ccf1db1062401b1a8b0ade10339bd423d773ca8cbcb649232bc9

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6

SRPM

libgcrypt-1.8.5-7.el8_6.src.rpm

SHA-256: 99734fb837bc7026c65eb15c0525f68288e73672fc2a3d583c3279786e47a13d

ppc64le

libgcrypt-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: 45f33fab13c06919b98bb5e2950f51bb3863f96de8bf82654eba71d22eb9c46b

libgcrypt-debuginfo-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: b53990b80dd690615d0d5d0dcb4546c8a60fb92abdcb20572b37e116a4904b3a

libgcrypt-debugsource-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: 3cf1c29f3529171e77c51dcdc50351bedb5ac02c5d68bc77b962afe76221938c

libgcrypt-devel-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: abd2677f21d7a4762bc786020090cc472cd8d515507c7275c579a49ed61e80f3

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.ppc64le.rpm

SHA-256: 65959fad327c75e8d2cf4fd9f25cdc8b1ff053bd01a8c550d188521ede7fb711

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6

SRPM

libgcrypt-1.8.5-7.el8_6.src.rpm

SHA-256: 99734fb837bc7026c65eb15c0525f68288e73672fc2a3d583c3279786e47a13d

x86_64

libgcrypt-1.8.5-7.el8_6.i686.rpm

SHA-256: 70477a828e837801c2905343ba3998140d21b2c6e76ec0d5da82bbafc9ece0dc

libgcrypt-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 8af1caa726c0b3b398eed421511ff26222f3ddfa131b90fedaa4fe464216338c

libgcrypt-debuginfo-1.8.5-7.el8_6.i686.rpm

SHA-256: b9dc8640b900796b39ce122a868ed7ce84aefbae50989423916c06d41e6c4295

libgcrypt-debuginfo-1.8.5-7.el8_6.x86_64.rpm

SHA-256: d07f3d0d3220d27414ea9338e4b05ffe8f6f79e4bbba5a5262e580d3e0095abf

libgcrypt-debugsource-1.8.5-7.el8_6.i686.rpm

SHA-256: 0c724ddf22172a3454c0259226cd31433082ccadfda0995268314a29b32b4e9d

libgcrypt-debugsource-1.8.5-7.el8_6.x86_64.rpm

SHA-256: b5f47d5bf9583d7b4416e7c99676c013d998e1b480cacd1b72cad723f5de0ff1

libgcrypt-devel-1.8.5-7.el8_6.i686.rpm

SHA-256: 4fcb065d6e13b7c1875167fe5449579822476cb8c72140bc39ef7186c510d5ba

libgcrypt-devel-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 94dfe4b3dfcdf0ec71e7c3ad41ef6c0a78912b3e9d9ae40636cd5188e9b874cb

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.i686.rpm

SHA-256: 7082c62cd12859f2ded03642696e7ae6c97d0ade625b33f766c0a681b5fb7805

libgcrypt-devel-debuginfo-1.8.5-7.el8_6.x86_64.rpm

SHA-256: 1ea2f3a4fc0146d4f5cca94d15480c14db818792d833180ed708d2e4714397fb

Related news

CVE-2023-22062: Oracle Critical Patch Update Advisory - July 2023

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).

CVE-2023-21954: Oracle Critical Patch Update Advisory - April 2023

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through...

CVE-2023-21850: Oracle Critical Patch Update Advisory - January 2023

Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demantra Demand Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Demantra Demand Management accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

CVE-2022-21587: Oracle Critical Patch Update Advisory - October 2022

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Red Hat Security Advisory 2022-6696-01

Red Hat Security Advisory 2022-6696-01 - Red Hat Advanced Cluster Management for Kubernetes 2.4.6 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. Issues addressed include crlf injection and denial of service vulnerabilities.

RHSA-2022:6696: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.6 security update and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.4.6 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-30629: golang: crypto/tls: session tickets lack random ticket_age_add * CVE-2022-31129: moment: inefficient parsing algorithm resulting in DoS * CVE-2022-31150: nodejs16: CRLF injection in node-undici * CVE-2022-31151: nodejs/undici: Cookie headers uncleared on cross-origin redirect * CV...

Red Hat Security Advisory 2022-6526-01

Red Hat Security Advisory 2022-6526-01 - OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains the following OpenShift Virtualization 4.11.0 images: RHEL-8-CNV-4.11. Issues addressed include denial of service, memory leak, and out of bounds read vulnerabilities.

RHSA-2022:6526: Red Hat Security Advisory: OpenShift Virtualization 4.11.0 Images security and bug fix update

Red Hat OpenShift Virtualization release 4.11.0 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-38561: golang: out-of-bounds read in golang.org/x/text/language leads to DoS * CVE-2021-44716: golang: net/http: limit growth of header canonicalization cache * CVE-2021-44717: golang: syscall: don't close fd 0 on ForkExec error * CVE-2022-1798: kubeVirt: Arbitrary file read on t...

Red Hat Security Advisory 2022-6430-01

Red Hat Security Advisory 2022-6430-01 - OpenShift API for Data Protection enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and snapshot-based backups for persistent volumes. Issues addressed include a denial of service vulnerability.

RHSA-2022:6430: Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.0.4 security and bug fix update

OpenShift API for Data Protection (OADP) 1.0.4 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1705: golang: net/http: improper sanitization of Transfer-Encoding header * CVE-2022-1962: golang: go/parser: stack exhaustion in all Parse* functions * CVE-2022-21698: prometheus/client_golang: Denial of service using InstrumentHandlerCounter * CVE-2022-24675: golang: encoding/pem: fix stack overflow in Decode * CVE-2022-30629: golang: crypto/tls: session ti...

Red Hat Security Advisory 2022-6348-01

Red Hat Security Advisory 2022-6348-01 - Gatekeeper is an open source project that applies the OPA Constraint Framework to enforce policies on your Kubernetes clusters. This advisory contains the container images for Gatekeeper that include bug fixes and container upgrades.

RHSA-2022:6348: Red Hat Security Advisory: Gatekeeper Operator v0.2 security and container updates

Gatekeeper Operator v0.2 security updates Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1705: golang: net/http: improper sanitization of Transfer-Encoding header * CVE-2022-1962: golang: go/parser: stack exhaustion in all Parse* functions * CVE-2022-28131: golang: encoding/xml: stack exhaustion in Decoder.Skip * CVE-2022-30629: golang: crypto/tls: session tickets lack random ticket_age_add * CVE-2022-30630: golang: io/fs: stack exhaustion in Glob * CVE-2022-30631: gol...

RHSA-2022:6346: Red Hat Security Advisory: RHSA: Submariner 0.13 - security and enhancement update

Submariner 0.13 packages that fix security issues and bugs, as well as adds various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-38561: golang: out-of-bounds read in golang.org/x/text/language leads to DoS * CVE-2022-1705: golang: net/http: improper sanitization of Transfer-Encoding header * CVE-2022-1962: golang: go/parser: stack exhaustion in all Parse* functions...

Red Hat Security Advisory 2022-6271-01

Red Hat Security Advisory 2022-6271-01 - This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which fix several bugs. Issues addressed include a denial of service vulnerability.

RHSA-2022:6156: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update

Updated images that include numerous enhancements, security, and bug fixes are now available for Red Hat OpenShift Data Foundation 4.11.0 on Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-23440: nodejs-set-value: type confusion allows bypass of CVE-2019-10747 * CVE-2021-23566: nanoid: Information disclosure via valueOf() function * CVE-2022-0235: node-fetch: exposure of sensitive information to an unauthorized actor * CVE-2022-0536: follow-...

Red Hat Security Advisory 2022-5069-01

Red Hat Security Advisory 2022-5069-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.0. Issues addressed include code execution, cross site scripting, denial of service, information leakage, and traversal vulnerabilities.

Red Hat Security Advisory 2022-5070-01

Red Hat Security Advisory 2022-5070-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.11.0. Issues addressed include denial of service, out of bounds read, and traversal vulnerabilities.

RHSA-2022:5069: Red Hat Security Advisory: OpenShift Container Platform 4.11.0 bug fix and security update

Red Hat OpenShift Container Platform release 4.11.0 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-23566: nanoid: Information disclosure via valueOf() function * CVE-2021-23648: sanitize-url: XSS * CVE-2021-41190: opencontainers: OCI manifest and index parsing confusion * CVE-2021-44906:...

RHSA-2022:6024: Red Hat Security Advisory: New container image for Red Hat Ceph Storage 5.2 Security update

A new container image for Red Hat Ceph Storage 5.2 is now available in the Red Hat Ecosystem Catalog. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-43813: grafana: directory traversal vulnerability * CVE-2022-21673: grafana: Forward OAuth Identity Token can allow users to access some data sources

Red Hat Security Advisory 2022-5909-01

Red Hat Security Advisory 2022-5909-01 - Openshift Logging Bug Fix Release. Issues addressed include denial of service and out of bounds read vulnerabilities.

Red Hat Security Advisory 2022-5908-01

Red Hat Security Advisory 2022-5908-01 - Openshift Logging Bug Fix Release. Issues addressed include denial of service and out of bounds read vulnerabilities.

RHSA-2022:5909: Red Hat Security Advisory: Openshift Logging Bug Fix and security update Release (5.2.13)

Openshift Logging Bug Fix Release (5.2.13) Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-38561: golang: out-of-bounds read in golang.org/x/text/language leads to DoS

RHSA-2022:5908: Red Hat Security Advisory: Openshift Logging Bug Fix and security update Release (5.3.10)

Openshift Logging Bug Fix Release (5.3.10) Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-38561: golang: out-of-bounds read in golang.org/x/text/language leads to DoS

Red Hat Security Advisory 2022-5840-01

Red Hat Security Advisory 2022-5840-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API.

RHSA-2022:5840: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.3 security and bug fix update

The Migration Toolkit for Containers (MTC) 1.7.3 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1365: cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor * CVE-2022-24675: golang: encoding/pem: fix stack overflow in Decode * CVE-2022-28327: golang: crypto/elliptic: panic caused by oversized scalar * CVE-2022-29526: golang: syscall: faccessat checks wrong group

RHSA-2022:5699: Red Hat Security Advisory: Secondary Scheduler Operator for Red Hat OpenShift 1.0.1 security update

Secondary Scheduler Operator for Red Hat OpenShift 1.0.1 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29526: golang: syscall: faccessat checks wrong group

Red Hat Security Advisory 2022-5531-01

Red Hat Security Advisory 2022-5531-01 - Red Hat Advanced Cluster Management for Kubernetes 2.5.1 General Availability release images, which fix security issues and bugs.

Red Hat Security Advisory 2022-5556-01

Red Hat Security Advisory 2022-5556-01 - Logging Subsystem 5.4.3 has security updates. Issues addressed include denial of service and out of bounds read vulnerabilities.

Red Hat Security Advisory 2022-5704-01

Red Hat Security Advisory 2022-5704-01 - Updated images are now available for Red Hat Advanced Cluster Security. Issues addressed include a privilege escalation vulnerability.

RHSA-2022:5704: Red Hat Security Advisory: ACS 3.71 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes bug fixes and feature improvements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-29173: go-tuf: No protection against rollback attacks for roles other than root

Red Hat Security Advisory 2022-5673-01

Red Hat Security Advisory 2022-5673-01 - Red Hat OpenStack Platform 16.2 (Train) director operator containers, with several Important security fixes, are available for technology preview. Issues addressed include a code execution vulnerability.

RHSA-2022:5673: Red Hat Security Advisory: Release of containers for OSP 16.2.z director operator tech preview

Red Hat OpenStack Platform 16.2 (Train) director operator containers, with several Important security fixes, are available for technology preview.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-41103: containerd: insufficiently restricted permissions on container root and plugin directories * CVE-2021-43565: golang.org/x/crypto: empty plaintext packet causes panic * CVE-2022-26945: go-getter: command injection vulnerability * CVE-2022-30321: go-getter: unsafe download (issue 1 of 3) * CVE-2022-30322: go-getter: unsafe download (issue 2 of 3) * CVE-2022-30323: go-getter: unsafe download (issue 3 of 3)

RHSA-2022:5556: Red Hat Security Advisory: Logging Subsystem 5.4.3 - Red Hat OpenShift security update

Logging Subsystem 5.4.3 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-38561: golang: out-of-bounds read in golang.org/x/text/language leads to DoS

RHSA-2022:5531: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.5.1 security updates and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.5.1 General Availability release images, which fix security issues and bugs. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-24450: nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account

CVE-2021-40528: On the (in)security of ElGamal in OpenPGP - Part I

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.