Red Hat Security Advisory 2022-8873-01 - An update for python-oslo-utils is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack Platform 16.1.9 (python-oslo-utils) security update  
Advisory ID:       RHSA-2022:8873-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8873  
Issue date:        2022-12-07  
CVE Names:         CVE-2022-0718  
====================================================================  
1. Summary:

An update for python-oslo-utils is now available for Red Hat OpenStack  
Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.1 - noarch

3. Description:

The OpenStack Oslo Utility library.

Security Fix(es):

* incorrect password masking in debug output (CVE-2022-0718)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2056850 - CVE-2022-0718 python-oslo-utils: incorrect password masking in debug output

6. Package List:

Red Hat OpenStack Platform 16.1:

Source:  
python-oslo-utils-3.41.6-1.20220426095230.f4deaad.el8ost.src.rpm

noarch:  
python-oslo-utils-lang-3.41.6-1.20220426095230.f4deaad.el8ost.noarch.rpm  
python3-oslo-utils-3.41.6-1.20220426095230.f4deaad.el8ost.noarch.rpm

Red Hat OpenStack Platform 16.1:

Source:  
python-oslo-utils-3.41.6-1.20220426095230.f4deaad.el8ost.src.rpm

noarch:  
python-oslo-utils-lang-3.41.6-1.20220426095230.f4deaad.el8ost.noarch.rpm  
python3-oslo-utils-3.41.6-1.20220426095230.f4deaad.el8ost.noarch.rpm

Red Hat OpenStack Platform 16.1:

Source:  
python-oslo-utils-3.41.6-1.20220426095230.f4deaad.el8ost.src.rpm

noarch:  
python-oslo-utils-lang-3.41.6-1.20220426095230.f4deaad.el8ost.noarch.rpm  
python3-oslo-utils-3.41.6-1.20220426095230.f4deaad.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-0718  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpmtzjgjWX9erEAQgS3Q//RqYOosziJEn6E8s0Vk7RSiHHbDGrdAYy  
CeJjTvb/4rGYW91Mr6zhuRkAgmjVOPHHcNAx18fBmig8W0yb4phF21I5IbaOezjv  
mp4r9MD7XKxtu1SPbwscIyne0HTzMKH1rtTQXRPgXxARefrANNIdsdBrH/u1c1Uo  
hL5G/ohmfu9hNWSV/2vAqKZMneIQOLWVeogmS2lVyynHwUZDluJSDbP52r7DcJ/Q  
vcyqhuzbRUBODv3s361v8TmZ1KAsypbxfs30jXRgthMx0Pz43IZ9XvoGFEhvyGSx  
lWllxT47flsDOuUulCqCvRe8TcTFRvzOQ6f6Y+YcxJZDuR3SfdjQbizySaNlglSq  
NNY8Y6AqEmZj9CGx4FkZ+OLp8IZ2D6dNRF04ILiMPoKkYS/hGe/qSU0krJ+uS9UF  
yF97rSZe7TduSVu5erE/sXVQiAHqUt/Nz/LCuRe+f8MclHaHx8KHTEs6x4fluIvD  
PlRseR2oN7ePWiTBgbQ3XMPh6wNhKsm0y1oaNK7E2dUo2qa8aQO2ziqNMZPrOJsv  
O6jc5OZes6R4XvoXCqmVPURMOdmeQJ16V7Fp1QDUWVNLvZupQFxy/RwmYPkLV4Fv  
0Ywg6QbxNHPnLBsBlW+0TeTsgLCYxICrSbUNp3duWplCWcBqKZOoXtMFfzJrD3PS  
5Jyxu/2yRRY=qIcJ  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8873-01

Red Hat Security Advisory 2022-8866-01 - An update for python-XStatic-Angular is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack Platform 16.1.9 (python-XStatic-Angular) security update  
Advisory ID:       RHSA-2022:8866-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8866  
Issue date:        2022-12-07  
CVE Names:         CVE-2019-10768  
====================================================================  
1. Summary:

An update for python-XStatic-Angular is now available for Red Hat OpenStack  
Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.1 - noarch

3. Description:

Angular JavaScript library packaged for setuptools (easy_install) / pip.

Security Fix(es):

* Prototype pollution in merge function could result in code injection  
(CVE-2019-10768)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1813309 - CVE-2019-10768 AngularJS: Prototype pollution in merge function could result in code injection

6. Package List:

Red Hat OpenStack Platform 16.1:

Source:  
python-XStatic-Angular-1.5.8.0-13.el8ost.src.rpm

noarch:  
XStatic-Angular-common-1.5.8.0-13.el8ost.noarch.rpm  
python3-XStatic-Angular-1.5.8.0-13.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-10768  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpatzjgjWX9erEAQhl+w/5AfKkbI34bXXE7yfPixf+GvcfYai7s7Ku  
3PBTymbKFdIla+c5zJfv5xux0YRYcqRt7tSlHHbybEEWxtrFXS9H8QSMW9q8h7QH  
B32AsI3ooAKyrTTZqWDXyri77Z2WeNGXbyTc/2OTbNJANNZjAE5OmP2YtrInh0I9  
y0Dds9U1gWJMFqO6mKamISJz6V+k7bmaaFeSHwZ59LfwIW5HD8OXM7yLsxgWyb4d  
AxUSHugrRHgmjjoAwfylYlT+VPRgL9TvAa9/kuQgrGzq4Iy3bgtO3tkoJihweM/Y  
BjxthGzwXBBA6MKHiwCqujm0GwtkfaBKMGNNJOVeY5BkqEYJOOyjN6y9kE/cYZ1K  
zxvqotXYrhvx8RzQUNhaqpjreTa4AadLvGMdBEqMunAlXdUF9n3841lcfs0/daD3  
I+N2YhPQHQ1ltusqp+50QIMf8EIAzptCQ4btMYhIRLdYYd7LwujcalqX5q4gC6is  
lngsTlZ/HwQai5UJ//BozTTWegW5zeBEcqFdqsS7D4WQM/bn5o1eR6shBIzxsAhA  
X3cpMk4vJ7E+nS+1wYVUEkmJZ26oZ4evCNYYpNu9FHtsUpN25IiM3qC5iw4GFIcZ  
/zLmVLXAt/YN/4zDuu5I9fQD/MkaMoGnYppPkMXxja2ducJNuPnZiO0n2Qi2XbwB  
qu4qTT4UppI=vX3U  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8866-01

Red Hat Security Advisory 2022-8848-01 - An update for python-XStatic-Bootstrap-SCSS is now available for Red Hat OpenStack Platform 16.2.4 (Train). Issues addressed include a cross site scripting vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack 16.2.4 (python-XStatic-Bootstrap-SCSS) security update  
Advisory ID:       RHSA-2022:8848-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8848  
Issue date:        2022-12-07  
CVE Names:         CVE-2019-8331  
====================================================================  
1. Summary:

An update for python-XStatic-Bootstrap-SCSS is now available for Red Hat  
OpenStack Platform 16.2.4 (Train).

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.2 - noarch

3. Description:

Bootstrap style library packaged for setuptools (easy_install) / pip.

Security Fix(es):

* XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1686454 - CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute

6. Package List:

Red Hat OpenStack Platform 16.2:

Source:  
python-XStatic-Bootstrap-SCSS-3.4.1.0-2.el8ost.src.rpm

noarch:  
python3-XStatic-Bootstrap-SCSS-3.4.1.0-2.el8ost.noarch.rpm  
xstatic-bootstrap-scss-common-3.4.1.0-2.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-8331  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpUNzjgjWX9erEAQjGjBAAh2Z0nCYvKVcbCGmS13MXfqy6aSSdN8aJ  
KvOl8B4XW9+vSzuhqSa4IAzerJw4Uomtd8qWhdgSB5oUrWsRZ6QIR3dsou4w9zIt  
7Hq5RUNOPLDZInW4PbVPtd5yiwjYFeq4/tsX7j9RmGQsUlPox8t/a2rPzN7zzM+Y  
6Sq3kOAlhRRsnM8yUSRm1PC+vfW437kfAVIxSdIWPhgCbPy7wVc1irJrpohXOf/3  
lbn0D48UDpcuOIbY77W8AkVpmUz279m1HhCaGiYSzGq9z2L1rEcTDG2ry5qx883r  
nFMyIwrI7pdVN/EZiWxhh9LC89xjppFEVIWj8PHA2kS8Rt0GmPECY28Q7xLdoo7U  
7rJFrKe+GySbfST9Nw4HF7pUcPSr9tnKkES4RExI55mLCrISCh7F2C+NRy/sq+zf  
jDTuP1CtJnQCuSoyIBggyo4NOWpia0WGvoTi6lDnGUN2mX4hdgFIRSDVD7xUrDl1  
Q8Tk+S6wFMxg9CfUMPPd+ZftO9srq5Zgml3q7psLhZpCqMzP/UgRDfIbVLDdP+uR  
BATUT7W058hcUlFvl77Xb/lHCHRn9gDsTVuYSnLXhSnH+sqLrTk6i0LmzYsFWzeQ  
4cU98WzhIk4YQFq++6eFhEOnl7bCgqrhjiZTIsV1XzMo0kycJbhMR5g1ndbUcGDi  
Rm9yG/DRBsI=XwU6  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8848-01

Red Hat Security Advisory 2022-8865-01 - An update for python-XStatic-Bootstrap-SCSS is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2. Issues addressed include a cross site scripting vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack 16.1.9 (python-XStatic-Bootstrap-SCSS) security update  
Advisory ID:       RHSA-2022:8865-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8865  
Issue date:        2022-12-07  
CVE Names:         CVE-2019-8331  
====================================================================  
1. Summary:

An update for python-XStatic-Bootstrap-SCSS is now available for Red Hat  
OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.1 - noarch

3. Description:

Bootstrap style library packaged for setuptools (easy_install) / pip.

Security Fix(es):

* XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1686454 - CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute

6. Package List:

Red Hat OpenStack Platform 16.1:

Source:  
python-XStatic-Bootstrap-SCSS-3.4.1.0-2.el8ost.src.rpm

noarch:  
python3-XStatic-Bootstrap-SCSS-3.4.1.0-2.el8ost.noarch.rpm  
xstatic-bootstrap-scss-common-3.4.1.0-2.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-8331  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpdtzjgjWX9erEAQi+PQ//WgtiRPFZgWZEJYXEuv1aa6qZ1aeDOuHp  
5r8DVEov/APq+k0y1Hu9KQts7ruvUSwWtXwiCmldhEGcTdrs53PnuuykZqG2hKcT  
IzRj7Cat55yIs6hWFNUT6Whj+6LUEZd3kLfz9xqaYhNTJrIEtUAKxXoPjjd97DAQ  
j1OpfOGJKvdQyJ469RBOWbVeWaKCnFbJSkotlbW3OkhA4Qm8hbxvf8DCC1ysqXr3  
eN9lLabMpO69iHX9EUzGaSe73s+Yh/bT+Z/kN9fksAPC5uFRbEKwLS3Z0uONQbXm  
dtWbSiZRTLNZj3oSZg4FYIz8GJEFIZhPG7nP/pIoN0Pm2z0cwxbk+KxCdphsI05N  
k0vJst5aMX4AxvR1tocBDK5uwAQtfGgaitw/xIVw+63NtRMpmwqpva645i9pOpzC  
Fr9aCGJRZfpDt2AtMaKweCnuUBsPu3RaJWy786qGOAZ8W7WOqJL51nzJrUqCpvSB  
JVTEUYrwoCImeodmtl9OtpmTDUp7GKhrpdf0Jvugmau7H+J++SwA5CQE8BWw/JTm  
gs04sOX7ObmjqSBew6b1UbBMqqqMLSpBlAP6UoPYeQWjcK8ZMtiNVf2XhDb+KLc2  
0T4WGH0a6iT3v9NVromgDjFEXcKrw3mZ9QdUkzCSzAQDpO48Unw+Lf9IXPQCHRRA  
zJike7DwksY=ICYc  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8865-01

Red Hat Security Advisory 2022-8864-01 - UltraJSON is an ultra fast JSON encoder and decoder. Issues addressed include a double free vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack Platform 16.1.9 (python-ujson) security update  
Advisory ID:       RHSA-2022:8864-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8864  
Issue date:        2022-12-07  
CVE Names:         CVE-2022-31116 CVE-2022-31117  
====================================================================  
1. Summary:

An update for python-ujson is now available for Red Hat OpenStack Platform  
16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.1 - ppc64le, x86_64

3. Description:

UltraJSON is an ultra fast JSON encoder and decoder

Security Fix(es):

* improper decoding of escaped surrogate characters may lead to string  
corruption key confusion or value overwriting (CVE-2022-31116)

* Potential double free of buffer during string decoding (CVE-2022-31117)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2104739 - CVE-2022-31117 python-ujson: Potential double free of buffer during string decoding  
2104740 - CVE-2022-31116 python-ujson: improper decoding of escaped surrogate characters may lead to string corruption, key confusion or value overwriting

6. Package List:

Red Hat OpenStack Platform 16.1:

Source:  
python-ujson-2.0.3-3.el8ost.src.rpm

ppc64le:  
python-ujson-debugsource-2.0.3-3.el8ost.ppc64le.rpm  
python3-ujson-2.0.3-3.el8ost.ppc64le.rpm  
python3-ujson-debuginfo-2.0.3-3.el8ost.ppc64le.rpm

x86_64:  
python-ujson-debugsource-2.0.3-3.el8ost.x86_64.rpm  
python3-ujson-2.0.3-3.el8ost.x86_64.rpm  
python3-ujson-debuginfo-2.0.3-3.el8ost.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-31116  
https://access.redhat.com/security/cve/CVE-2022-31117  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpmNzjgjWX9erEAQhZfQ/+IhYH6eqe+ywktC+Y63UbIW62u+lB3vlZ  
XUHQnxrfTfdrFs5NzaAWRpEq09NAa+BTqaveN4s9UwL7GHkBCjVcUaefV6jW1ZNf  
kee52203dPdPfQhkC048p+g9tfb4rIZmGkh/bK13z/T7cD5GhEDbI1600hYGP2YB  
YhmyzU3J+dGhm7RzgSCmpvXTE7A0Aw0glXq3gGHTG9za2970TeS64QFo/x7IrI54  
ZjuL8O6zZS/nQbx7PpE60i/unjlMHqlAs1VjF5a4JsMrvE+cGr2DW2OL6Bs8a7yH  
hVSLDIsG/hqUrmIlk0uvhzf1YX+sRRBvfI1883Pv26/NMXBAcie/yTn/VFRnnCzq  
dsEzWG1BPc14x+ZTvDNd/UtJvEJQ01p8du9x6iOLXtdZI5GvvmSAqRime9TsObFc  
GYVmPfhMIaA+Gqw9GUDk1eunRMPwtSxO5fnwaXZQ8Mpmdst/bYMFqe5KQvWINbqW  
uTC7pvv18H0PI2kNfJMYbImSCGCOaT3SW6mC+RNtKdIVJN4xzlwNkH9Q/P37/CdU  
lQDPal/FJgIDT7JDOuYJPF9Ln4DpGc+EjL9DekKpDQytQxVH7DONgAeZMmi99r4l  
unWj9QI6H/Nar0UHEyv4UExvJrInVl17McZ+V6gAvzM86ePqkf6xiESzoXGwAQBa  
ZQt1OY6ucVg¦iB  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8864-01

Red Hat Security Advisory 2022-8851-01 - An update for rabbitmq-server is now available for Red Hat OpenStack Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4. Issues addressed include cross site scripting and improper neutralization vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Low: Red Hat OpenStack Platform 16.2.4 (rabbitmq-server) security update  
Advisory ID:       RHSA-2022:8851-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8851  
Issue date:        2022-12-07  
CVE Names:         CVE-2021-32718 CVE-2021-32719  
====================================================================  
1. Summary:

An update for rabbitmq-server is now available for Red Hat OpenStack  
Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4.

Red Hat Product Security has rated this update as having a security impact  
of Low. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.2 - ppc64le, x86_64

3. Description:

RabbitMQ is an implementation of AMQP, the emerging standard for high  
performance enterprise messaging. The RabbitMQ server is a robust and  
scalable implementation of an AMQP broker. # We want to install into  
/usr/lib, even on 64-bit platforms

Security Fix(es):

* improper neutralization of script-related HTML tags in a web page (basic  
XSS) in management UI (CVE-2021-32718)

* improper neutralization of script-related HTML tags in a web page (basic  
XSS) in federation management plugin (CVE-2021-32719)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1977002 - CVE-2021-32718 rabbitmq-server: improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI  
1977008 - CVE-2021-32719 rabbitmq-server: improper neutralization of script-related HTML tags in a web page (basic XSS) in federation management plugin

6. Package List:

Red Hat OpenStack Platform 16.2:

Source:  
rabbitmq-server-3.8.16-3.el8ost.src.rpm

ppc64le:  
rabbitmq-server-3.8.16-3.el8ost.ppc64le.rpm

x86_64:  
rabbitmq-server-3.8.16-3.el8ost.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-32718  
https://access.redhat.com/security/cve/CVE-2021-32719  
https://access.redhat.com/security/updates/classification/#low

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5Fpc9zjgjWX9erEAQh6TA//SBk6DFowl0p6bJNt+PFGZPB8ZIrl0HPI  
azUxSF3o/b29uqTe1XNVS83lN+2dsTUp0rERs34Kd7kbkOvqHyGj9TDjnvyVt1QH  
HD6yXG9iCit7cYNCYNDwea+Wt6yczY0BrmednQfukXfnV8DjNZ2btwQqsASdNrD6  
fcuYlQB3eQVVD/L1GCjmCP+nHbwD7A5egqlxXNJlw0WhtSvIa7YdQ4T+MUN5w30I  
kuJWc3wPEKj7+NbKlyZ2ErCz6DrMm5BDjAHhOviXnY2S0Ya9pwzIDrCUk3KDxNtU  
SKO44qVkZOQkevGHtyUfHbXM1Zm41BWHg/caQuQMO4gIw9Aw02MMOoOpJwXLRURn  
cMb0pOtuvTgIyfpjGT8xJb51cWb71Xw9Za+VUQNMRS+Xp00yTR2lH74ILKhv1/fj  
8SdiGYmwJ3bYBBHvM+mCnhDiH6w7s9E9JjTsTLqZYdtx/4AGUULowC1q64h+TfEs  
cEdnv0kV8sNVMf71Iz0d2yzDj5DE7ZHhXEUy0CWop/ja/i/vr+B0zGb1T8nEZml4  
xYofh90zY4tHdH3vquUBTQg1BgEiJXXLo0vVKC6IzfS84kOpogJrVdsIsWURB2Xq  
bd4AwKt9lCdQVrAWfnynQEyRJ/MIaEieFK7xzCEzORb8DtTjYTONn8UsuHx9PeYB  
6ofOgrgazRA=/s43  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8851-01

Red Hat Security Advisory 2022-8862-01 - An update for puppet is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack Platform 16.1.9 (puppet) security update  
Advisory ID:       RHSA-2022:8862-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8862  
Issue date:        2022-12-07  
CVE Names:         CVE-2021-27025  
====================================================================  
1. Summary:

An update for puppet is now available for Red Hat OpenStack Platform 16.1.9  
(Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.1 - noarch

3. Description:

A network tool for managing many disparate systems

Security Fix(es):

* silent configuration failure in agent (CVE-2021-27025)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2023853 - CVE-2021-27025 puppet: silent configuration failure in agent

6. Package List:

Red Hat OpenStack Platform 16.1:

Source:  
puppet-5.5.10-14.el8ost.src.rpm

noarch:  
puppet-5.5.10-14.el8ost.noarch.rpm  
puppet-headless-5.5.10-14.el8ost.noarch.rpm  
puppet-server-5.5.10-14.el8ost.noarch.rpm

Red Hat OpenStack Platform 16.1:

Source:  
puppet-5.5.10-14.el8ost.src.rpm

noarch:  
puppet-5.5.10-14.el8ost.noarch.rpm  
puppet-headless-5.5.10-14.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-27025  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpW9zjgjWX9erEAQhZgw/+LWeBglQQMIA8d7qyG9qsGkadGedCSD29  
e0vpGbNqQ6P5fzrrVJWJJi8OXTx1BXaxv1iC5ebW9yAKF8xMcqoPT3bOG/P/iCrQ  
Hf+L6LHfIkaEZNiwi3q9ruqJrplIhx4FUkBSKWjrLdfCVCnnhKZ/8jYhpXcGoSuo  
TMaBdkfQmC6EPtGWJfzg+RIHmRfGxoA45oXwpzVOdv/nmQWOBt82vmFoPIshNbb7  
LnewdD6O1/zrWcuYodVpFZjBq4eek5wEDp9f9UmrOe82SiZd/llENzFCjdAwJZn0  
Z9BYWPGS9GaEw/yy5gYGZvA0LSN/CMi2K78nXL6ILDfJmkDIBxy2QEg4ffImrh0w  
oZX5EHNARwYCIboJ12aKEPm9aUIOUImuz/lIR8Sihfcpwh+8bE3YbVBjxxYTABow  
8ff4w8rkGnX4iLDqLHZ3AjYAmUaS2dFN7fwwJIVn5YvgiJY41GOKuV+pAvAOIfsH  
/ZsC8bJvX5P5SgAW+sJOmmHTqKjTZLp/lEDGiOvyO86oDW5FUhkAkPumyMb3oqmj  
3jdFIC/2nsipmhO9ipm+SowKpfxhzgQQQoiGfrpzhunx8dbt3lubYIkvCjRXAYGN  
fiOXemZM//Okz1Yz6BWYjYEW604bUnKl1eefytpADLyNmoPGIosQXLE4SZOqDjQi  
r4H4E0kaqxU=Y5qh  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8862-01

Red Hat Security Advisory 2022-8853-01 - An update for python-django20 is now available for Red Hat OpenStack Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4. Issues addressed include cross site scripting and denial of service vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack Platform 16.2.4 (python-django20) security update  
Advisory ID:       RHSA-2022:8853-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8853  
Issue date:        2022-12-07  
CVE Names:         CVE-2022-22818 CVE-2022-23833  
====================================================================  
1. Summary:

An update for python-django20 is now available for Red Hat OpenStack  
Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.2 - noarch

3. Description:

Security Fix(es):

* Possible XSS via '{% debug %}' template tag (CVE-2022-22818)

* Denial of service possibility in file uploads (CVE-2022-23833)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2048775 - CVE-2022-22818 django: Possible XSS via '{% debug %}' template tag  
2048778 - CVE-2022-23833 django: Denial-of-service possibility in file uploads

6. Package List:

Red Hat OpenStack Platform 16.2:

Source:  
python-django20-2.0.13-18.el8ost.src.rpm

noarch:  
python3-django20-2.0.13-18.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-22818  
https://access.redhat.com/security/cve/CVE-2022-23833  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpY9zjgjWX9erEAQj1thAApODPOfrstOl0YkXLW8QcfS6do+Yx3SzB  
e0FtoGW3L1rRLjSXj4vNNK6Xa81zgx+BMns7uMpntqvScBGOpB8bbRdJOwizQcVc  
bJDpIZTccCg2L6J1G2XaFyMsHR82OmPc3AZtXpmx9hg81AQJ6R2nhpTYWUJA4Lkm  
OUZRlkOP1CP9CaJawGct4lNWo3ZJZ69XgJ78+ltkLBn1IXWtfrn8bDFtiGnZ7N7Y  
Qa50Ggqq+cYL2mHW0fDUsdgbgNYpmrfF1qlF/0B9HASQC1xx0fxc0S125vmU8yja  
ILOC+bwpDOBSnDKv/IKnAKt5Zb80ojUC519s8SPVHrZF/71DlZid0ly+pL9YWNAL  
hpziugB224Fp3GYEWlvzzoBz/C0XDFV/A3nSUnJ8CuP7QisxI1Jt068jvTlDdPjI  
Sv4uJE7u/eG/ME9SY74rfevznkrh0iLDOdAvPgS/4ScD4RoTZPFnH7/sn3d92mGC  
77yF0ZCxJe1iNCaCvHPRGuQ1aCfxEUhLRSAPO4wdd5TTMPGc2fFcYIYlgyoqQ2Z0  
KjKfL5cX4lUCDWKZ1fSbr2BxeNBpOt/udM3bRLRjEJsEVGh15CC7b/J+fyXuL1tq  
nBxhqzqTo3+ZtZTsGSchsZa/0kUNNJ9okGT2sm++YVKyuKRIU9KbVUiMLh6sRdMF  
wLUsVkAfhUQ=aJ8/  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8853-01

Red Hat Security Advisory 2022-8867-01 - An update for rabbitmq-server is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2. Issues addressed include cross site scripting and improper neutralization vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Low: Red Hat OpenStack Platform 16.1.9 (rabbitmq-server) security update  
Advisory ID:       RHSA-2022:8867-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8867  
Issue date:        2022-12-07  
CVE Names:         CVE-2021-32718  
====================================================================  
1. Summary:

An update for rabbitmq-server is now available for Red Hat OpenStack  
Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact  
of Low. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.1 - ppc64le, x86_64

3. Description:

RabbitMQ is an implementation of AMQP, the emerging standard for high  
performance enterprise messaging. The RabbitMQ server is a robust and  
scalable implementation of an AMQP broker. # We want to install into  
/usr/lib, even on 64-bit platforms

Security Fix(es):

* improper neutralization of script-related HTML tags in a web page (basic  
XSS) in management UI (CVE-2021-32718)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1977002 - CVE-2021-32718 rabbitmq-server: improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI

6. Package List:

Red Hat OpenStack Platform 16.1:

Source:  
rabbitmq-server-3.7.23-9.el8ost.src.rpm

ppc64le:  
rabbitmq-server-3.7.23-9.el8ost.ppc64le.rpm

x86_64:  
rabbitmq-server-3.7.23-9.el8ost.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-32718  
https://access.redhat.com/security/updates/classification/#low

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpaNzjgjWX9erEAQhFhw//cMHoe2JOTRgroiI4kKMBHO4nbWv0jxkR  
I2IM6gBNHg3/hxsu3LQsaGVM70lqjrbS+H55ukDmGfhXz2xHU+2qpfCIDcm0gxhW  
KOFaYvSlps8CjpjciIXVhy0LDcOnk9ipqx2ogLLv3DQjQAF5MdtuqtOf/wQuMRnh  
mUlY0u9XYiaXv7HHc1CRx1LkbLSHROTwe8Kl/om3p6velOF0tSr5cpjBjuUIuznh  
p5KOAZBsswQQZuwTrqYfyjCX8STX9mPrOQsddY+nxdd6L0XZ0vSmWcm94mMEA0PO  
xBl+2vNKEt2AB4UB2PEi0o7aVZrImix9JKEEhQREHX3qkP2RDsDlOkl8cZpAW9/K  
Gr3MXO8zSKJhC6E+5lnx0uIQHWyLTbnK4hixespaXCcclIRarsshv7+KbeFTYjTd  
Lw5ZdQdAeW3Pudr7a40HeMHlfRUcgwZKuvFur5wFVIeahxCVL/gL1ddirUiXDjZW  
+D5EsorMY+9fhn3iHlPUHpxl+JY3QM94qBm30KSB4qaBdhg1EcFB3Yv1Ojp/l1+k  
268RSc71eErmWl4dNo3tEgPLX6fZ8hJlKkefu8gg+mmauXgns2tM9/gQT2UFfLv0  
JFpLLwmOnSCbTDv2ZposZyROTK9cEs8jpHGFaoK+4M8aN2VmUxC2UCzEGb7UQyyl  
7pym91Xe0jQ=ueW9  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8867-01

Red Hat Security Advisory 2022-8847-01 - An update for protobuf is now available for Red Hat OpenStack Platform 16.2.4 (Train).

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack Platform 16.2.4 (protobuf) security update  
Advisory ID:       RHSA-2022:8847-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8847  
Issue date:        2022-12-07  
CVE Names:         CVE-2021-22570   
=====================================================================

1. Summary:

An update for protobuf is now available for Red Hat OpenStack Platform  
16.2.4 (Train).  
Red Hat Product Security has rated this update as having a security impact  
of Moderate.  
A Common Vulnerability Scoring System (CVSS) base score, which gives a  
detailed severity rating,  
is available for each vulnerability from the CVE link(s) in the References  
section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.2 - noarch

3. Description:

Protocol Buffers are a way of encoding structured data in an efficient  
yet extensible format. Google uses Protocol Buffers for almost all of  
its internal RPC protocols and file formats.

Protocol buffers are a flexible, efficient, automated mechanism for  
serializing structured data – think XML, but smaller, faster, and  
simpler. You define how you want your data to be structured once, then  
you can use special generated source code to easily write and read  
your structured data to and from a variety of data streams and using a  
variety of languages. You can even update your data structure without  
breaking deployed programs that are compiled against the old format. This  
package contains Protocol Buffers compiler for all programming  
languages and C++ headers and Static libraries for Protocol Buffers built  
with optimize_for = LITE_RUNTIME.

Security Fix(es):

* Incorrect parsing of nullchar in the proto symbol leads to Nullptr  
dereference (CVE-2021-22570)

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:  
https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2049429 - CVE-2021-22570 protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference

6. Package List:

Red Hat OpenStack Platform 16.2:

Source:  
protobuf-3.6.1-6.el8ost.src.rpm

noarch:  
python3-protobuf-3.6.1-6.el8ost.noarch.rpm

Red Hat OpenStack Platform 16.2:

Source:  
protobuf-3.6.1-6.el8ost.src.rpm

noarch:  
python3-protobuf-3.6.1-6.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-22570  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpWNzjgjWX9erEAQj74hAAn8C33fY+jEtfS5EsOVSEbyw1OPxyfEfz  
kvBFwTG+R+9rd/pvLUr6+pKsPyASiBiO3ddm9GY++IePXxjwMn7bvOe4H9QqgP23  
5DhDrdWW8Oqv+wrOV7BAs13nCIGZTSof3NJ17SjUk6Wxex/Ne71Y0GEDhzqv3hXR  
WuGJ8tMWBftny9EdnQgLh4O0TC5Y1FBcIXL+ftwaKPCrs3QF+GwXmKYsiq4h0KGi  
98jDfKpP7EMF1ZojBzhIjc60wQUIbLiJKLx8bcsG13bPvxGiRyxRYHueHCJoWhcN  
amNRVdj+xUWYPPolRw5i1pZmPjIlbjwaL299MGeK1SfJ51eQYYzlKHBLKk2OfnE6  
AsONiGJKWICU6tx7ZcrW3p4skgNvGVd6WKAANWv7KWOdQy3OQ3m9ivG0qCxp3EyA  
nTjiWoX1+crMAcvtnqZ/Z9op9TLqL0eyhcgCpOIMZKFVy9NoKMmR7qpsx5lBBVTr  
82paMUhkzqNrHREeswMhxq3Q0zD3fZrjCR1Pl/+rYKVfjkX0ht2KFBjDEGUqH+uG  
N+z5H9kL3lP9W/lCwiIMbgUnvoqmrLFBqq5uXJSle6vmPF5ZthoQaUEsQUtqxKVM  
i7jmBmPOoOGYu1iLlu47fYUSgRMI+JjeXDz8bOOg42FJSYMcvfuzNGkEcTX0A9Me  
+GEDO6GfPBQ=  
=DSkQ  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Tag

#red_hat