Red Hat Security Advisory 2024-9989-03 - An update for python-webob is now available for Red Hat OpenStack Platform 17.1.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9989.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: RHOSP 17.1.4 (python-webob) security updateAdvisory ID:        RHSA-2024:9989-03Product:            Red Hat OpenStack PlatformAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:9989Issue date:         2024-11-25Revision:           03CVE Names:          CVE-2024-42353====================================================================Summary: An update for python-webob is now available for Red Hat OpenStack Platform (RHOSP) 17.1 (Wallaby).Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.Description:WebOb provides wrappers around the WSGI request environment, and an objectto help create WSGI responses. The objects map much of the specifiedbehavior of HTTP, including header parsing and accessors for other standardparts of the environment.Security Fix(es):* WebOb's location header normalization during redirect leads to openredirect (CVE-2024-42353)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-42353References:https://access.redhat.com/security/updates/classification/#moderate

Red Hat Security Advisory 2024-9989-03

Red Hat Security Advisory 2024-9988-03 - An update for python-requests is now available for Red Hat OpenStack Platform 17.1.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9988.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: RHOSP 17.1.4 (python-requests) security updateAdvisory ID:        RHSA-2024:9988-03Product:            Red Hat OpenStack PlatformAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:9988Issue date:         2024-11-25Revision:           03CVE Names:          CVE-2024-35195====================================================================Summary: An update for python-requests is now available for Red Hat OpenStackPlatform (RHOSP) 17.1 (Wallaby).Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.Description:Most existing Python modules for sending HTTP requests are extremelyverbose and cumbersome. Python’s built-in urllib2 module provides most ofthe HTTP capabilities you should need, but the API is thoroughly broken.This library is designed to make HTTP requests easy for developers.Security Fix(es):* subsequent requests to the same host ignore cert verification(CVE-2024-35195)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-35195References:https://access.redhat.com/security/updates/classification/#moderatehttps://bugzilla.redhat.com/show_bug.cgi?id=2282114

Red Hat Security Advisory 2024-9988-03

Red Hat Security Advisory 2024-9986-03 - An update for python-sqlparse is now available for Red Hat OpenStack Platform 17.1. Issues addressed include a denial of service vulnerability.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9986.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: RHOSP 17.1.4 (python-sqlparse) security updateAdvisory ID:        RHSA-2024:9986-03Product:            Red Hat OpenStack PlatformAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:9986Issue date:         2024-11-25Revision:           03CVE Names:          CVE-2024-4340====================================================================Summary: An update for python-sqlparse is now available for Red Hat OpenStackPlatform (RHOSP) 17.1 (Wallaby).Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.Description:sqlparse is a tool for parsing SQL stringsSecurity Fix(es):* parsing heavily nested list leads to denial of service (CVE-2024-4340)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-4340References:https://access.redhat.com/security/updates/classification/#moderatehttps://bugzilla.redhat.com/show_bug.cgi?id=2278038

Red Hat Security Advisory 2024-9986-03

Red Hat Security Advisory 2024-9985-03 - An update for python-urllib3 is now available for Red Hat OpenStack Platform 17.1.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9985.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: RHOSP 17.1.4 (python-urllib3) security updateAdvisory ID:        RHSA-2024:9985-03Product:            Red Hat OpenStack PlatformAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:9985Issue date:         2024-11-25Revision:           03CVE Names:          CVE-2024-37891====================================================================Summary: An update for python-urllib3 is now available for Red Hat OpenStackPlatform (RHOSP) 17.1 (Wallaby).Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.Description:Python HTTP module with connection pooling and file POST abilities.Security Fix(es):* proxy-authorization request header is not stripped during cross-originredirects (CVE-2024-37891)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-37891References:https://access.redhat.com/security/updates/classification/#moderatehttps://bugzilla.redhat.com/show_bug.cgi?id=2292788

Red Hat Security Advisory 2024-9985-03

Red Hat Security Advisory 2024-9984-03 - An update for python-sqlparse is now available for Red Hat OpenStack Platform 17.1. Issues addressed include a denial of service vulnerability.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9984.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: RHOSP 17.1.4 (python-sqlparse) security updateAdvisory ID:        RHSA-2024:9984-03Product:            Red Hat OpenStack PlatformAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:9984Issue date:         2024-11-25Revision:           03CVE Names:          CVE-2024-4340====================================================================Summary: An update for python-sqlparse is now available for Red Hat OpenStackPlatform (RHOSP) 17.1 (Wallaby).Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.Description:sqlparse is a tool for parsing SQL stringsSecurity Fix(es):* parsing heavily nested list leads to denial of service (CVE-2024-4340)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-4340References:https://access.redhat.com/security/updates/classification/#moderatehttps://bugzilla.redhat.com/show_bug.cgi?id=2278038

Red Hat Security Advisory 2024-9984-03

Red Hat Security Advisory 2024-9983-03 - An update for python-webob is now available for Red Hat OpenStack Platform 17.1.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9983.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: RHOSP 17.1.4 (python-webob) security updateAdvisory ID:        RHSA-2024:9983-03Product:            Red Hat OpenStack PlatformAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:9983Issue date:         2024-11-25Revision:           03CVE Names:          CVE-2024-42353====================================================================Summary: An update for python-webob is now available for Red Hat OpenStack Platform (RHOSP) 17.1 (Wallaby).Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.Description:WebOb provides wrappers around the WSGI request environment, and an objectto help create WSGI responses. The objects map much of the specifiedbehavior of HTTP, including header parsing and accessors for other standardparts of the environment.Security Fix(es):* WebOb's location header normalization during redirect leads to openredirect (CVE-2024-42353)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-42353References:https://access.redhat.com/security/updates/classification/#moderate

Red Hat Security Advisory 2024-9983-03

Red Hat Security Advisory 2024-9982-03 - An update for openstack-ironic is now available for Red Hat OpenStack Platform 17.1.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9982.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: RHOSP 17.1.4 (openstack-ironic) security updateAdvisory ID:        RHSA-2024:9982-03Product:            Red Hat OpenStack PlatformAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:9982Issue date:         2024-11-25Revision:           03CVE Names:          CVE-2024-44082====================================================================Summary: An update for openstack-ironic is now available for Red HatOpenStack Platform (RHOSP) 17.1 (Wallaby).Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.Description:IronicSecurity Fix(es):* Specially crafted image may allow authenticated users to gain access to potentially sensitive data (CVE-2024-44082)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-44082References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2309331

Red Hat Security Advisory 2024-9982-03

Red Hat Security Advisory 2024-9978-03 - An update for openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 17.1.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9978.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: RHOSP 17.1.4 (openstack-tripleo-heat-templates) security updateAdvisory ID:        RHSA-2024:9978-03Product:            Red Hat OpenStack PlatformAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:9978Issue date:         2024-11-25Revision:           03CVE Names:          CVE-2024-4840====================================================================Summary: An update for openstack-tripleo-heat-templates is now available for Red HatOpenStack Platform (RHOSP) 17.1 (Wallaby).Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.Description:Heat templates for TripleOSecurity Fix(es):* cleartext passwords exposed in logs (CVE-2024-4840)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-4840References:https://access.redhat.com/security/updates/classification/#moderatehttps://bugzilla.redhat.com/show_bug.cgi?id=2235206https://bugzilla.redhat.com/show_bug.cgi?id=2242069https://bugzilla.redhat.com/show_bug.cgi?id=2243267https://bugzilla.redhat.com/show_bug.cgi?id=2247302https://bugzilla.redhat.com/show_bug.cgi?id=2249881https://bugzilla.redhat.com/show_bug.cgi?id=2252442https://bugzilla.redhat.com/show_bug.cgi?id=2255302https://bugzilla.redhat.com/show_bug.cgi?id=2264238https://bugzilla.redhat.com/show_bug.cgi?id=2269219https://bugzilla.redhat.com/show_bug.cgi?id=2274355https://bugzilla.redhat.com/show_bug.cgi?id=2275307https://bugzilla.redhat.com/show_bug.cgi?id=2276136https://bugzilla.redhat.com/show_bug.cgi?id=2276592https://bugzilla.redhat.com/show_bug.cgi?id=2276865https://bugzilla.redhat.com/show_bug.cgi?id=2278019https://bugzilla.redhat.com/show_bug.cgi?id=2279464https://bugzilla.redhat.com/show_bug.cgi?id=2279998https://bugzilla.redhat.com/show_bug.cgi?id=2280249https://bugzilla.redhat.com/show_bug.cgi?id=2284645https://bugzilla.redhat.com/show_bug.cgi?id=2290685https://bugzilla.redhat.com/show_bug.cgi?id=2293048https://bugzilla.redhat.com/show_bug.cgi?id=2293735https://bugzilla.redhat.com/show_bug.cgi?id=2295402https://bugzilla.redhat.com/show_bug.cgi?id=2295757https://bugzilla.redhat.com/show_bug.cgi?id=2295948https://bugzilla.redhat.com/show_bug.cgi?id=2302191https://bugzilla.redhat.com/show_bug.cgi?id=2303551https://bugzilla.redhat.com/show_bug.cgi?id=2304312https://bugzilla.redhat.com/show_bug.cgi?id=2305981https://bugzilla.redhat.com/show_bug.cgi?id=2306489https://bugzilla.redhat.com/show_bug.cgi?id=2307256https://bugzilla.redhat.com/show_bug.cgi?id=2307307https://bugzilla.redhat.com/show_bug.cgi?id=2310427https://bugzilla.redhat.com/show_bug.cgi?id=2311465https://bugzilla.redhat.com/show_bug.cgi?id=2313372https://bugzilla.redhat.com/show_bug.cgi?id=2313502https://bugzilla.redhat.com/show_bug.cgi?id=2314658https://bugzilla.redhat.com/show_bug.cgi?id=2316083https://bugzilla.redhat.com/show_bug.cgi?id=2320400

Red Hat Security Advisory 2024-9978-03

Red Hat Security Advisory 2024-9977-03 - An update for python-zipp is now available for Red Hat OpenStack Platform 17.1. Issues addressed include a denial of service vulnerability.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9977.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: RHOSP 17.1.4 (python-zipp) security updateAdvisory ID:        RHSA-2024:9977-03Product:            Red Hat OpenStack PlatformAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:9977Issue date:         2024-11-25Revision:           03CVE Names:          CVE-2024-5569====================================================================Summary: An update for python-zipp is now available for Red Hat OpenStack Platform (RHOSP) 17.1 (Wallaby).Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.Description:A pathlib-compatible Zipfile object wrapper. A backport of the Path object.Security Fix(es):* Denial of Service (infinite loop) via crafted zip file in jaraco/zipp(CVE-2024-5569)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-5569References:https://access.redhat.com/security/updates/classification/#moderatehttps://bugzilla.redhat.com/show_bug.cgi?id=2296413

Red Hat Security Advisory 2024-9977-03

Red Hat Security Advisory 2024-9976-03 - An update for python-werkzeug is now available for Red Hat OpenStack Platform 17.1. Issues addressed include a remote shell upload vulnerability.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9976.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: RHOSP 17.1.4 (python-werkzeug) security updateAdvisory ID:        RHSA-2024:9976-03Product:            Red Hat OpenStack PlatformAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:9976Issue date:         2024-11-25Revision:           03CVE Names:          CVE-2024-34069====================================================================Summary: An update for python-werkzeug is now available for Red Hat OpenStackPlatform (RHOSP) 17.1 (Wallaby).Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.Description:Werkzeug is a WSGI utility module. It includes a debugger, request andresponse objects, HTTP utilities to handle entity tags, cache controlheaders, HTTP dates, cookie handling, file uploads, a URL routing systemand a numerous community contributed add-on modules. Werkzeug is unicodeaware and does not enforce a specific template engine, database adapter ora specific way of handling requests. It is useful for end userapplications, such as blogs, wikis, and bulletin boards, that need tooperate in a wide variety of server environments.Security Fix(es):* user may execute code on a developer's machine (CVE-2024-34069)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-34069References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2279451

Tag

#js