HYCU 5.0.0-1491 security updates

This release contains fixes for the following vulnerabilities:

  • RHSA-2023:6943:

    • CVE-2023-1786: cloud-init: sensitive data could be exposed in logs
  • RHSA-2023:6980:

    • CVE-2021-3750: QEMU: hcd-ehci: DMA reentrancy issue leads to use-after-free
    • CVE-2023-3301: QEMU: net: triggerable assertion due to race condition in hot-unplug
  • RHSA-2023:7836:

    • CVE-2021-3468: avahi: Local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket
    • CVE-2023-38469: avahi: Reachable assertion in avahi_dns_packet_append_record
    • CVE-2023-38470: avahi: Reachable assertion in avahi_escape_label
    • CVE-2023-38471: avahi: Reachable assertion in dbus_set_host_name
    • CVE-2023-38472: avahi: Reachable assertion in avahi_rdata_parse
    • CVE-2023-38473: avahi: Reachable assertion in avahi_alternative_host_name
  • RHSA-2023:7877:

    • CVE-2023-3446: openssl: Excessive time spent checking DH keys and parameters
    • CVE-2023-3817: OpenSSL: Excessive time spent checking DH q parameter value
    • CVE-2023-5678: openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow
  • RHSA-2024:0105:

    • CVE-2023-5388: nss: timing attack against RSA decryption
  • RHSA-2024:0114:

    • CVE-2022-48560: python: use after free in heappushpop() of heapq module
    • CVE-2022-48564: python: DoS when processing malformed Apple Property List files in binary format
  • RHSA-2024:0116:

    • CVE-2023-43804: python-urllib3: Cookie request header isn't stripped during cross-origin redirects
    • CVE-2023-45803: urllib3: Request body not stripped after redirect from 303 status changes request method to GET
  • RHSA-2024:0119:

    • CVE-2023-39615: libxml2: crafted xml can cause global buffer overflow
  • RHSA-2024:0131:

    • CVE-2022-44638: pixman: Integer overflow in pixman_sample_floor_y leading to heap out-of-bounds write
  • RHSA-2024:0135:

    • CVE-2023-3019: QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest()
  • RHSA-2024:0155:

    • CVE-2023-5981: gnutls: timing side-channel in the RSA-PSK authentication
  • RHSA-2024:0253:

    • CVE-2023-7104: sqlite: heap-buffer-overflow at sessionfuzz
  • RHSA-2024:0256:

    • CVE-2023-27043: python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple
  • RHSA-2024:0265:

    • CVE-2024-20918: OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468)
    • CVE-2024-20919: OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295)
    • CVE-2024-20921: OpenJDK: range check loop optimization issue (8314307)
    • CVE-2024-20926: OpenJDK: arbitrary Java code execution in Nashorn (8314284)
    • CVE-2024-20945: OpenJDK: logging of digital signature private keys (8316976)
    • CVE-2024-20952: OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547)
  • RHSA-2024:0606:

    • CVE-2023-48795: ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
    • CVE-2023-51385: openssh: potential command injection via shell metacharacters
  • RHSA-2024:0627:

    • CVE-2024-0553: gnutls: incomplete fix for CVE-2023-5981
  • RHSA-2024:0628:

    • CVE-2023-48795: ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
  • RHSA-2024:0647:

    • CVE-2021-35937: rpm: TOCTOU race in checks for unsafe symlinks
    • CVE-2021-35938: rpm: races with chown/chmod/capabilities calls during installation
    • CVE-2021-35939: rpm: checks for unsafe symlinks are not performed for intermediary directories
  • RHSA-2024:0768:

    • CVE-2020-28241: libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c
  • RHSA-2024:0769:

    • CVE-2021-41043: tcpslice: use-after-free in extract_slice()
  • RHSA-2024:0786:

    • CVE-2023-6135: nss: vulnerable to Minerva side-channel information leak
  • RHSA-2024:0811:

    • CVE-2023-28486: sudo: Sudo does not escape control characters in log messages
    • CVE-2023-28487: sudo: Sudo does not escape control characters in sudoreplay output
    • CVE-2023-42465: sudo: Targeted Corruption of Register and Stack Variables
  • RHSA-2024:0889:

    • CVE-2019-13224: oniguruma: Use-after-free in onig_new_deluxe() in regext.c
    • CVE-2019-16163: oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c
    • CVE-2019-19012: oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read
    • CVE-2019-19203: oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c
    • CVE-2019-19204: oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c
  • RHSA-2024:0965:

    • CVE-2023-50387: bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator
    • CVE-2023-50868: bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources
  • RHSA-2024:1601:

    • CVE-2023-28322: curl: more POST-after-PUT confusion
    • CVE-2023-38546: curl: cookie injection with none file
    • CVE-2023-46218: curl: information disclosure by exploiting a mixed case flaw
  • RHSA-2024:1610:

    • CVE-2022-48624: less: missing quoting of shell metacharacters in LESSCLOSE handling
  • RHSA-2024:1615:

    • CVE-2023-52425: expat: parsing large tokens can trigger a denial of service
  • RHSA-2024:1751:

    • CVE-2024-1488: unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation
  • RHSA-2024:1782:

    • CVE-2023-4408: bind9: Parsing large DNS messages may cause excessive CPU load
    • CVE-2023-50387: bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator
    • CVE-2023-50868: bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources
  • RHSA-2024:1784:

    • CVE-2024-28834: gnutls: vulnerable to Minerva side-channel information leak
  • RHSA-2024:1786:

    • CVE-2024-27316: httpd: CONTINUATION frames DoS
  • RHSA-2024:1818:

    • CVE-2024-21011: OpenJDK: long Exception message leading to crash (8319851)
    • CVE-2024-21068: OpenJDK: integer overflow in C1 compiler address generation (8322122)
    • CVE-2024-21085: OpenJDK: Pack200 excessive memory allocation (8322114)
    • CVE-2024-21094: OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507)
  • RHSA-2024:2722:

    • CVE-2024-2961: glibc: Out of bounds write in iconv may lead to remote code execution
  • RHSA-2024:2962:

    • CVE-2023-3255: QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service
    • CVE-2023-5088: QEMU: improper IDE controller reset can lead to MBR overwrite
    • CVE-2023-6683: QEMU: VNC: NULL pointer dereference in qemu_clipboard_request()
    • CVE-2023-6693: QEMU: virtio-net: stack buffer overflow in virtio_net_flush_tx()
  • RHSA-2024:2973:

    • CVE-2023-43785: libX11: out-of-bounds memory access in _XkbReadKeySyms()
    • CVE-2023-43786: libX11: stack exhaustion from infinite recursion in PutSubImage()
    • CVE-2023-43787: libX11: integer overflow in XCreateImage() leading to a heap overflow
  • RHSA-2024:2980:

    • CVE-2023-25193: harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks
  • RHSA-2024:3030:

    • CVE-2022-33065: libsndfile: integer overflow in src/mat4.c and src/au.c leads to DoS
  • RHSA-2024:3059:

    • CVE-2022-4645: libtiff: out-of-bounds read in tiffcp in tools/tiffcp.c
  • RHSA-2024:3102:

    • CVE-2024-22195: jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
  • RHSA-2024:3121:

    • CVE-2023-31122: httpd: mod_macro: out-of-bounds read vulnerability
    • CVE-2023-45802: mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487)
  • RHSA-2024:3139:

    • CVE-2021-40153: squashfs-tools: unvalidated filepaths allow writing outside of destination
    • CVE-2021-41072: squashfs-tools: possible Directory Traversal via symbolic link
  • RHSA-2024:3163:

    • CVE-2024-22365: pam: allowing unprivileged user to block another user namespace
  • RHSA-2024:3166:

    • CVE-2020-15778: openssh: scp allows command injection when using backtick characters in the destination argument
  • RHSA-2024:3184:

    • CVE-2023-4692: grub2: Out-of-bounds write at fs/ntfs.c may lead to unsigned code execution
    • CVE-2023-4693: grub2: out-of-bounds read at fs/ntfs.c
    • CVE-2024-1048: grub2: grub2-set-bootflag can be abused by local (pseudo-)users
  • RHSA-2024:3203:

    • CVE-2023-7008: systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yes
  • RHSA-2024:3211:

    • CVE-2023-46316: traceroute: improper command line parsing
  • RHSA-2024:3214:

    • CVE-2021-43618: gmp: Integer overflow and resultant buffer overflow via crafted input
  • RHSA-2024:3233:

    • CVE-2023-6004: libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname
    • CVE-2023-6918: libssh: Missing checks for return values for digests
  • RHSA-2024:3253:

    • CVE-2024-2494: libvirt: negative g_new0 length can lead to unbounded memory allocation
  • RHSA-2024:3268:

    • CVE-2024-26458: krb5: Memory leak at /krb5/src/lib/rpc/pmap_rmt.c
    • CVE-2024-26461: krb5: Memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c
  • RHSA-2024:3269:

    • CVE-2024-2961: glibc: Out of bounds write in iconv may lead to remote code execution
  • RHSA-2024:3270:

    • CVE-2023-3758: sssd: Race condition during authorization leads to GPO policies functioning inconsistently
  • RHSA-2024:3271:

    • CVE-2023-4408: bind9: Parsing large DNS messages may cause excessive CPU load
    • CVE-2023-50387: bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator
    • CVE-2023-50868: bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources
  • RHSA-2024:3341:

    • CVE-2022-48622: gnome: heap memory corruption on gdk-pixbuf
  • RHSA-2024:3344:

    • CVE-2024-33599: glibc: stack-based buffer overflow in netgroup cache
    • CVE-2024-33600: glibc: null pointer dereferences after failed netgroup cache insertion
    • CVE-2024-33601: glibc: netgroup cache may terminate daemon on memory allocation failure
    • CVE-2024-33602: glibc: netgroup cache assumes NSS callback uses in-buffer strings
  • RHSA-2024:3347:

    • CVE-2023-6597: python: Path traversal on tempfile.TemporaryDirectory
    • CVE-2024-0450: python: The zipfile module is vulnerable to zip-bombs leading to denial of service
Was this article helpful?
0 out of 0 found this helpful

Comments

0 comments

Please sign in to leave a comment.