AusCERT - Security Bulletins

Subscribe to AusCERT - Security Bulletins hírcsatorna
Latest published security bulletins. See https://www.auscert.org.au/rss/ for feed information.
Frissítve: 3 perc 59 másodperc
2022. május 16.

ESB-2022.2376 - [Appliance] F5 Products: CVSS (Max): 7.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2376 K67090077: Apache HTTP Server vulnerability CVE-2022-22720 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: BIG-IP (all modules) BIG-IQ Centralized Management F5OS-A F5OS-C Traffix SDC Publisher: F5 Networks Operating System: Network Appliance Resolution: Mitigation CVE Names: CVE-2022-22720 Original Bulletin: https://support.f5.com/csp/article/K67090077 Comment: CVSS (Max): 7.1 CVE-2022-22720 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) CVSS Source: F5 Networks Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - --------------------------BEGIN INCLUDED TEXT-------------------- K67090077: Apache HTTP Server vulnerability CVE-2022-22720 Original Publication Date: 14 May, 2022 Security Advisory Description Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling. (CVE-2022-22720) Impact Any authenticated user may exploit this vulnerability and cause a breach in data confidentiality, integrity, and availability. Note: Only authenticated users, with any privilege level, can exploit this vulnerability. Security Advisory Status F5 Product Development has assigned ID 1088445 (BIG-IP), ID 1088445-10 (BIG-IQ), ID 2064321 (Traffix) and ID 1093105 (F5OS) to this vulnerability. This issue has been classified as CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') To determine if your product and version have been evaluated for this vulnerability, refer to the Applies to (see versions) box. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases, point releases, or hotfixes that address the vulnerability, refer to the following table. For more information about security advisory versioning, refer to K51812227: Understanding security advisory versioning. Note: After a fix is introduced for a given minor branch, that fix applies to all subsequent maintenance and point releases for that branch, and no additional fixes for that branch will be listed in the table. For example, when a fix is introduced in 14.1.2.3, the fix also applies to 14.1.2.4, and all later 14.1.x releases (14.1.3.x., 14.1.4.x). For more information, refer to K51812227: Understanding security advisory versioning. Additionally, software versions preceding those listed in the Applies to (see versions) box of this article have reached the End of Technical Support (EoTS) phase of their lifecycle and are no longer evaluated for security issues. For more information, refer to the Security hotfixes section of K4602: Overview of the F5 security vulnerability response policy. +-------------+------+--------------+----------+--------+------+--------------+ | | |Versions known|Fixes | |CVSSv3|Vulnerable | |Product |Branch|to be |introduced|Severity|score^|component or | | | |vulnerable^1 |in | |2 |feature | +-------------+------+--------------+----------+--------+------+--------------+ | |17.x |17.0.0 |None | | | | | +------+--------------+----------+ | | | | |16.x |16.1.0 - |None | | | | | | |16.1.2 | | | | | | +------+--------------+----------+ | | | | |15.x |15.1.0 - |None | | | | | | |15.1.5 | | | | | | +------+--------------+----------+ | | | |BIG-IP (all |14.x |14.1.0 - |None | | | | |modules) | |14.1.4 | |Medium |6.3 |Apache httpd | | +------+--------------+----------+ | | | | |13.x |13.1.0 - |None | | | | | | |13.1.5 | | | | | | +------+--------------+----------+ | | | | |12.x |12.1.0 - |None | | | | | | |12.1.6 | | | | | | +------+--------------+----------+ | | | | |11.x |11.6.1 - |None | | | | | | |11.6.5 | | | | | +-------------+------+--------------+----------+--------+------+--------------+ |BIG-IQ |8.x |8.0.0 - 8.2.0 |None | | | | |Centralized +------+--------------+----------+Medium |6.3 |Apache httpd | |Management |7.x |7.0.0 - 7.1.0 |None | | | | +-------------+------+--------------+----------+--------+------+--------------+ |F5OS-A |1.x |1.0.0 - 1.0.1 |None |High |7.1 |Apache httpd | +-------------+------+--------------+----------+--------+------+--------------+ | | |1.3.0 - 1.3.1 | | | | | |F5OS-C |1.x |1.2.0 - 1.2.2 |None |High |7.1 |Apache httpd | | | |1.1.0 - 1.1.4 | | | | | +-------------+------+--------------+----------+--------+------+--------------+ |Traffix SDC |5.x |5.2.0 |None |High |7.1 |Apache httpd | | | |5.1.0 | | | | | +-------------+------+--------------+----------+--------+------+--------------+ ^1F5 evaluates only software versions that have not yet reached the End of Technical Support (EoTS) phase of their lifecycle. ^2The CVSSv3 score link takes you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge. Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by installing a version listed in the Fixes introduced in column. If the Fixes introduced in column does not list a version for your branch, then no update candidate currently exists for that branch and F5 recommends upgrading to a version with the fix (refer to the table). If the Fixes introduced in column lists a version prior to the one you are running, in the same branch, then your version should have the fix. Mitigation Until it is possible to install a fixed version, you can use the following sections as temporary mitigations. These mitigations restrict access to the Configuration utility to only trusted networks or devices, thereby limiting the attack surface. o Block Configuration utility access through self IP addresses o Block Configuration utility access through the management interface Block Configuration utility access through self IP addresses You can block all access to the Configuration utility of your BIG-IP system using self IP addresses. To do so, you can change the Port Lockdown setting to Allow None for each self IP address on the system. If you must open any ports, you should use the Allow Custom option, taking care to block access to the Configuration utility. By default, the Configuration utility listens on TCP port 443. If you modified the default port, ensure that you block access to the alternate port you configured. Note: Performing this action prevents all access to the Configuration utility and iControl REST using the self IP address. These changes may also impact other services, including breaking high availability (HA) configurations. Before you make changes to the configuration of your self IP addresses, F5 strongly recommends that you refer to the following articles: o K17333: Overview of port lockdown behavior (12.x - 16.x) o K13092: Overview of securing access to the BIG-IP system o K31003634: The Configuration utility of the Single-NIC BIG-IP Virtual Edition now defaults to TCP port 8443 o K51358480: The single-NIC BIG-IP VE may erroneously revert to the default management httpd port after a configuration reload If you must expose port 443 on your self IP addresses and want to restrict access to specific IP ranges, you may consider using the packet filtering functionality built into the BIG-IP system. For more information, refer to the following article: o K13383: Configuring CIDR Network Addresses for the BIG-IP packet filter Block Configuration utility access through the management interface To mitigate this vulnerability for affected F5 products, you should restrict management access to F5 products to only trusted users and devices over a secure network. For more information about securing access to BIG-IP systems, refer to the following articles: o K13309: Restricting access to the Configuration utility by source IP address (11.x - 16.x) o K13092: Overview of securing access to the BIG-IP system o K46122561: Restricting access to the management interface using network firewall rules Supplemental Information o K41942608: Overview of security advisory articles o K4602: Overview of the F5 security vulnerability response policy o K4918: Overview of the F5 critical issue hotfix policy o K8986: F5 software lifecycle policy o K9502: BIG-IP hotfix and point release matrix o K13123: Managing BIG-IP product hotfixes (11.x - 17.x) o K15106: Managing BIG-IQ product hotfixes o K15113: BIG-IQ hotfix and point release matrix o K167: Downloading software and firmware from F5 o K9970: Subscribing to email notifications regarding F5 products o K9957: Creating a custom RSS feed to view new and updated documents - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIUAwUBYoHKTskNZI30y1K9AQiBpA/4lfdZZJy7dP7K9BOAp06uOpFeZrFZVFkW +lt6kxQXe1o+sNYjp0/8Ed5iyvCmdhUEN48+z/1Qfr4i/IzjjAQYjLg+GBiV5npT GRTQEUZ976vROxwU+4TIOE45YvglaByVOPnXueTO39IXvQf92Mt+G8ortIA5Dmk7 /tRn1elReK5nnU8EN4wTSLrnvip7zj+vc4ttDreSOB5de0EYsYjHNWujCh1ax0il HrpKsEM59dTRT8UAkUWyvHMa09eeRQwwci/rKGihfNZsismNVQ9rC6bAbz2ksXPC ONIZ7fZoY/pARwaUnhp0u2KWxzZA9hYmb8q6QtFcQ4sh9WZ2eSD9Bs3wLaCMvOwN gisl+EJ3W6GXKYWvpxIeVT6dTE9MA4Zqblsynupc05VviJThNHA1hNn3T/F4zhoj lDBmd++lbYAI6lGNj41gCiCEOGHxEhe9/yT44By/pdy/l0fi9zbb6nvgcAERRnlx x6a5Ovwex4MF1dY8l9qb43zSYLJYoprLWWoSpD/9Un55Cfh92CBNNP0IY+YZuV1o gTuMF1D0kdcOaxaao7pNcrHv9Ll0xU9TsNhYbawn9YsYbkfVwUvctRXjWRWRCXmt OLtywNxmSrSnOKcqKAz2RPJJkefHfUEI6gFSGHQoCd72AlYbpU4NPuoEpYT3kBub mRLa/I7nbQ== =mtGG -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2375 - [Debian] imagemagick: CVSS (Max): 6.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2375 imagemagick security update 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: imagemagick Publisher: Debian Operating System: Debian GNU/Linux Resolution: Patch/Upgrade CVE Names: CVE-2022-28463 CVE-2021-3596 Original Bulletin: http://www.debian.org/lts/security/2022/dla-3007 Comment: CVSS (Max): 6.5 CVE-2021-3596 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) CVSS Source: [NVD], Red Hat Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3007-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Andreas R=C3=B6nnqui= st May 14, 2022 https://wiki.debian.org/LTS - - ------------------------------------------------------------------------- Package : imagemagick Version : 8:6.9.7.4+dfsg-11+deb9u14 CVE ID : CVE-2021-3596 CVE-2022-28463 CVE-2021-3596 A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due to not checking the return value from libxml2's xmlCreatePushParserCtxt() and uses the value directly, which leads to a crash and segmentation fault. CVE-2022-28463 ImageMagick is vulnerable to Buffer Overflow. For Debian 9 stretch, these problems have been fixed in version 8:6.9.7.4+dfsg-11+deb9u14. We recommend that you upgrade your imagemagick packages. For the detailed security status of imagemagick please refer to its security tracker page at: https://security-tracker.debian.org/tracker/imagemagick Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE2zBuSxD/2Y7021XXGUtjGrLaKIgFAmJ/raQACgkQGUtjGrLa KIhHpg//bvH2YFm1IRk/kJTMNYU60DvqgJ++UJjdIXPR7HUr6v78vN1g0xedhHqK MQi2Xy4yU1uo4RRBDpqzX8LWIA2//zgsToT/aowxVbmNIA31NUJ7MFI3Y0vksD38 wkFmLrF9C863TNoHTYUbAny0FxpN5fdw9Fjh8ePzFX/xvyjqQW0l8EwzuxVEJeJi 6Vd/SzzaudGiYf1zpIhyW8rnKkla08emwD/FTbC3lUGf2kvdmk+OzDWdH9iRQzk3 pol2olLhJhTdmmIF4MvcRJn0xCSQIZ8lDbUJcN1ycsD1i/5jWx+JYPuHsBqU+qMI /RaDGk2ck6XAZhVlxtwZovtngeahv74bwkvJgDTmf68ksJQDXdkShzlBTFAsT9UK uu2bWyrsIEjlYYktzMh/OZnxmnpSpxZA4YD6G5IzLd/wQvNfFHhKu/Vq30WZ8GtC oxr5/8yzXoPPRIakseRlTKWXTPKwFa4JdObAL3XwHvxuStd4NNBTM7QXt/eT8DiB uO0sGsxNCxhFxrZhPBq6NacgQx4GJAyT/tHoQTUCvGXytoVN1GhKN/C9KMk7lop3 9wTTMajifwPT6gDB6q1gQR+QNqL/hH0ike/hC6hPPEMy9D1XaMGR9h/HX3P4S3zQ QhSfYN2ugS1hhlHjba/oELmMe8QCSA2lRGjb4hBn8pLEhfzoFkw=3D =3D/Lkp - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG92ckNZI30y1K9AQggeRAAq7oDm1fL+oc/Jp0yNgxAFduDK+fEY2oh YjQhJcxQ/jBJuu2BR9jro1KoBo9Qiw5RuBihDfBLJsgpA/20zqp9mxBJvtw0LXIH mXDgIZaIELk9VKOfj4uJZxnRQnhrEFwTFk1lXBTxfJmf+2ts8AeG6q/BPgBxUMsS TqZUcZx/oiaAmT7VfsBz+UUHaa3uik0why4WlXtio08Z6hOJo0qwje1j8anNBkGj LSKzJK5GtnFB3h6ehOgF5sX8JvGv34y1PZd/BcyqHRh7xaBgGbTdxK6qurNY9bGG Zh33z+QV/uSbdfEaNLmtHg3rZsOzXIHPwW/1yFLSXZdI+dztaeFU9EDgIxhrDAkd hdElRB5BaCBtHQaWMmZINSuuw81Mb4++FtV7lvxKmtiqRuzjov7/FC/FfVdmzYC6 AfIz0/vUUyGuJtm20JPeZQLl1VONfpqYl9FnO4TTU/TmVsql9QXsvtXSBNmo0IXU 3nh/9A9RXK6oltB3INAyde7GTHAJreeMhCoXu1JfqhnA0QYOfTLZKLVctmKbmnHM MutwojO7FYOfV2i/7O6AbbtpGqdXx8EYE85TjlYoVVh87p0M7dqbUdyTT4fReJnN lbA34ydkWm3BHTpeSB3H6kdAHCJro6qBwgziliQHEQs44cOoqpn051/UZf8SmcP2 4h+gQgdz0Xc= =l4T5 -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2374 - [Debian] openssl: CVSS (Max): 9.8

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2374 openssl security update 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: openssl Publisher: Debian Operating System: Debian GNU/Linux Resolution: Patch/Upgrade CVE Names: CVE-2022-1292 Original Bulletin: http://www.debian.org/lts/security/2022/dla-3008 Comment: CVSS (Max): 9.8 CVE-2022-1292 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVSS Source: NVD Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3008-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Stefano Rivera May 14, 2022 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : openssl Version : 1.1.0l-1~deb9u6 CVE ID : CVE-2022-1292 The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is executed by update-ca-certificates, from ca-certificates, to re-hash certificates in /etc/ssl/certs/. An attacker able to place files in this directory could execute arbitrary commands with the privileges of the script. For Debian 9 stretch, this problem has been fixed in version 1.1.0l-1~deb9u6. We recommend that you upgrade your openssl packages. For the detailed security status of openssl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssl Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG9yskNZI30y1K9AQiP2g//cGO/tZlgB9ddmUMhhoYbpzxVkB2T+wIG FelC9tIiwBzZPgJzkEwGBKVV05GQ0eAx979MCuAOIi1azsQVHltejGBGVGSPZdHN DDpoxV+iyFZsXRgJC61uGDef7fyu4YbkNDuf3PlTu9RhBUSezxflDDstxUrzPbZN kwRLdSWF/nUeXYU3IKkyEk0FfMdRat7zOjyF0tsrcM/F3+Y3H9fXzubQIgiKa6XG LuxrEPamcmBp+UmnRJQ9p40UQh+A4tJB5x0Bf9S+X3IQFwRENj8UXzZbeCXUjN7Q FaarWhYc2MmkMDrCTYgjZ43pzK3fkuSyxSKoCXGUWEfMO4X6i/oIgN3qgug1A8RY hdMR5HE1G14zkkXtj4hFl9qpS35e+obLgBugVO0x/9D1/TqOBauVjJ756+MPKqCJ bKvbCHWXXpfDomXEWgbGB+mR1ion4kWe8mmPJVjJQ+UV0KLp+yP8BsG1Qjea362h 9xX1U1L7341BrrBkLywOLxvCe+5ng4j0OHnkA9ljmjJDqv1q1SqUY4D9ZwGIqrsC YYUDH6LldEZCaTTwR3c+HKrI08zRTTR5kM2gXIXxFYxrCXcLbNs61+7PYzLK0M6J l0Whsr4S5giFEDu+4+jhtqgJlMsV2RMghn7ZuldRGevOyViAz5xxf0DDUTUXZcNW wTen+Yywskg= =XrL4 -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2373 - [Debian] openjdk-8: CVSS (Max): 7.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2373 openjdk-8 security update 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: openjdk-8 Publisher: Debian Operating System: Debian GNU/Linux Resolution: Patch/Upgrade CVE Names: CVE-2022-21496 CVE-2022-21476 CVE-2022-21443 CVE-2022-21434 CVE-2022-21426 Original Bulletin: http://www.debian.org/lts/security/2022/dla-3006 Comment: CVSS (Max): 7.5 CVE-2022-21476 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) CVSS Source: NVD Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3006-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Emilio Pozuelo Monfort May 14, 2022 https://wiki.debian.org/LTS - - ------------------------------------------------------------------------- Package : openjdk-8 Version : 8u332-ga-1~deb9u1 CVE ID : CVE-2022-21426 CVE-2022-21434 CVE-2022-21443 CVE-2022-21476 CVE-2022-21496 Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in information disclosure or denial of service. For Debian 9 stretch, these problems have been fixed in version 8u332-ga-1~deb9u1. We recommend that you upgrade your openjdk-8 packages. For the detailed security status of openjdk-8 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openjdk-8 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAmJ/dG4ACgkQnUbEiOQ2 gwLJGxAAsh2Q6zIedFNDK5QsFUKRfFzNaQw8nqhKcWAqnexAoq5A+dERjgD0xD+y 7yb+q6wdv2maL/v9xusAEmfr9SeVhXyMevOqJhihhmjhFCxk0fZmtOaY4d4WsSW8 ybgVaJVt13i3L+r9nWI4kEwN65B6aXnypk5e35XxlHlC9OIqJg88Ksb/cCLHN80t Bkp4SJVssKeGTgrbc6cGAp7FqjmG+SYUviRDLMc8EfTS+oCX6fOLml9nGro0919b ywACc06wz4jV6gl2jee3a7TyslIJBuIWla9PdqdbqTYZ1svbJDtWGFrlJrxQLEXM JPnzpWZkLco/VJj2Wd1aOYl5Ac53NVfAtIr+T8ZKTAOJu9O0WWoN2Mb30E3dTIUu accvhpKpbZXAp9oJt5uqtHSJGYOFrEZu9meFBKvP3uen38IAGYcki0RQ46wLTTTX sEitseo2EXdYOJWu/mfEcCZ5TjMdpUlyn9HZZ7z+elRfl8r8wPqYQMElwFgfeHAp 8cfGemv4qwnsZavp6fHX+bmvgydb+Sgh6pSv37OUIEPenSFC9sDk/Vgta4hiDdoF ZI9V3pciaT4V5mrs+fqaEETVV2pnvJK2XZoSHPGRkrG1DeYDfk9W3mWZt8sYvvFi 3HUsB/kb4YUZWHWnVz09JlZlpuGELH7IhZ0myBuHvS+559FUMC4= =x8Ur - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG9uckNZI30y1K9AQg/RBAAkJadI6DtOoBbq8OlmpKPSxr//qi332SK bnEAaoa+SUayCv+0d4vPbQuqWcqOZVhn/I3cZPVInXEr+XaiwXxkzDrTpgWkLv/f D8Hs3aa+qmBHd3PZtTY5hA50I3w9joPdUIN3syIjjlZwk3XgHYlU30zRL8fAO+cm O5LtdDTWjoMMT2TokfDEqPvSRrXaETWM7pxRywzkLXplPNp3IUGhVAr/YG9BPrAo FlC3KVMBiQaTgRm8pm01JDOy0twplM4bVaQAAVjgLl/z96qa5TIy15Yp3xo03HkR HUA5yx6NX2Q6zB9J4ENZ8vjVgYMxe7WEzZgB6p/32fd5TIv4fKiegztURL/p4bap EJZLTTtRpRLF7Ml4RiPymg+yB79Sej0TJ09mwVwPN65YGwoRv9QZ7EuepZijzdSk lkMh/LLo9BbEs+Ri2uj0/FQ2QeEfDYFb5YDCU1e3XiEWmtUpFZWpl5QbhdaYIx30 KyO5kIA2Jre2ZX+k/ulOAYEFG0J9LjtZDEXiBKGAWu20LhJH8qhFmyC6Wh2At0Z+ ++jQW+SaqkohsHxXg8Gh7t8qIlSxctQhiMdJdLnW4NGq6Na0c+EnZDhlu4hbyTnQ TrMtS/v1pA/jSZm7AfJvFkRiwMAsF0E/hmz0eM7oeqisUvFKcpVxiPnpSpUtlcKu KVngVWDzd+8= =xoOL -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2372 - [Debian] lrzip: CVSS (Max): 9.8

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2372 lrzip security update 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: lrzip Publisher: Debian Operating System: Debian GNU/Linux Resolution: Patch/Upgrade CVE Names: CVE-2022-28044 Original Bulletin: http://www.debian.org/lts/security/2022/dla-3005 Comment: CVSS (Max): 9.8 CVE-2022-28044 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVSS Source: NVD Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3005-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Stefano Rivera May 13, 2022 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : lrzip Version : 0.631-1+deb9u3 CVE ID : CVE-2022-28044 lrzip, a compression program, was found to have a heap memory corruption bug. For Debian 9 stretch, this problem has been fixed in version 0.631-1+deb9u3. We recommend that you upgrade your lrzip packages. For the detailed security status of lrzip please refer to its security tracker page at: https://security-tracker.debian.org/tracker/lrzip Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG9qMkNZI30y1K9AQgGMg//RkvHVtZn03bfSwF+H12Gehw2IUIeH95a QSM7P3wJb13Rtp25Xrq4OgMZs2oLx1RMIcX17BH9M0K7rtV6BYU5GEO9LzOiFSL0 pnEKih6ddYfluFzOV/hbDMMxdEWeXSrKfLtTbvf40zmyP+c1fy2f2c+Sr8koZOX5 apiUFy5+ahTmOKzQcm0//0sZLU7zxmu7mSZBGthWU0sRUs0c/FiNIAmC8ha2ECTR HzB0OO7nWCRJ7KHTAqR97Z5ZacWB14qEOY/CIMQqXcwoS7f9QqQXxtncJW6YfM7Y ERoYy5EZZ2ccY1Uip0VTRMH/anEshIAcTWriuMxXwYmPY4YKh3fzjGEUxhYujWKx hvnggIGd2DX6T1xvuWavLIbskb0PaC68OSDNlEX5zNTqEV7KZgyPFrfJ2DCc8XHJ xanDw3U53a3o+LMXAl5ct+C7kW5u2AnbYrPPjbsAizcfjuVknEuAeNN8G/ZxMhcj AIuC6qlH6A2l/0jcIOOW0bMOYuAaWEMOXGdLIXKC861brS3aZ08wBNDq4S0cCYXm 19dnSwtav7j2kCzsQq2IRWgYpQ9DpZAwTD+d6FrCFkSvMC/EpFLPAmBgknwNcSw0 3iapJvW9BrWM+KDsq0LmMkismWgAfW7CJGLcCTXEnySkACbtmHdrHN5B4Yfg1C8Z t55fcf+WRFA= =EvLk -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2371 - [Debian] htmldoc: CVSS (Max): None

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2371 htmldoc security update 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: htmldoc Publisher: Debian Operating System: Debian GNU/Linux Resolution: Patch/Upgrade CVE Names: CVE-2022-27114 Original Bulletin: http://www.debian.org/lts/security/2022/dla-3004 Comment: CVSS (Max): None available when published - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3004-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Chris Lamb May 13, 2022 https://wiki.debian.org/LTS - - ------------------------------------------------------------------------- Package : htmldoc Version : 1.8.27-8+deb9u3 CVE ID : CVE-2022-27114 It was discovered that there was an integer overflow vulnerabiliity in htmldoc, a HTML processor that generates indexed HTML, PS and PDF files. This was caused by a programming error in image_load_jpeg function due to a conflation or confusion of declared/expected/observed image dimensions. For Debian 9 "Stretch", this problem has been fixed in version 1.8.27-8+deb9u3. We recommend that you upgrade your htmldoc packages. For the detailed security status of htmldoc please refer to its security tracker page at: https://security-tracker.debian.org/tracker/htmldoc Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmJ+n2UACgkQHpU+J9Qx HlhtuRAAuS2HuhtGbtBPUifJGqDTyb/6wcKidIAKDG07FzGzAOnzJEgCmFh77/Ni WKBMCHAV+1LUXTFqSv9gp4+Sqa+EnMq6iBJ0QDxA0SNhQRhIP+NDE1Grmb+q2D01 I9VuiNNCenfjTUDy2Vp7PGoEydcraEJULZX8qVCkIs12OshdeXQMI3sVARURzswb w6reQaQwgIBaf2LkOjtfHQZLLIOPgudpWMw48fVCi0jAYShZF0EQKzSAvUGPmfI4 yH9BBJqCC8mWbHym2R0dGYoVqesPZzso8fvi2py33EkkuPgY7FiJI7iJoPYhjfym IKX4rvVJepwrd+YApRTnzilhHCZaxFQZzbFs7ddhJ8xeKqbv4bFDN1Rgd/BuF8QR BOZMCqgG/8dQR0oLK4ca0btexz1fdGDVr/TiNX90Vme11bsnUWR0cu8PxAGmopU9 ma68BXoRM3oClIflAwEK220iqu6SLB6kE6/1xMHhNqhB+3vxLeRGaLVEyvxIIs+T nW35yFia1c6bIhC7cAmj2bF7P3mxTMAkpYBfzuMc44b7QNf2rTwQvy3jrwDo2e98 Pywu/ty8vncJRKstxV1XbFjZ5WzJttT2mv+RHWTbSmJIscTHQTyHqAcVbjJefTfw hJHB4I8sGh7op36y2tRr5Q+f5G/9U1r5jgLSzWscu86GTCYIHjA= =9C82 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG9l8kNZI30y1K9AQiqsA//SgHOg6gSvcrUwEXjf4B5pkOyNMzWNShJ rPZ8OPWnOJg4kwlJY3MK5z5ky903ftbrWyRrLfWeav5/Evy0APSrzs40OcKgG0MV wWNJGMDedXa6QAK4IGhM9jL6ZcMYV8hKZlxleq2jHePy0O1P965bB0oyRK3Ud6v4 li9PRzAopTcH4Xt40nm4tGcFsXGOK+Ny25BIN5QUaO7nRU42/rSp+s7jqJo2QNzu Rg4CikupA01zWUE4qwy6m/O2F3il4Y2xqL4AzpVdLs8yN0JBtaLfv57qcDyovb+O D+R6VBagahFf9sXh4gUe+jJsCKQF+EDvQkfI3y2px/nqESp1hnkc8Q9M+idYvpRx OkB038T4HznCQwR5FYTide5QC2Hg8+XlCQyzFX5Wh7HsH7DuoR9IP02qpsorDfNp 2676xnQHXILuRWgIZS4COD91WtoHR6M59cUR58ZLaKoWb3Zpu8Gb4+OVokvdmGIR 4OxImTzZqraNYIVEpq5S59vmnQOR2SBKs8CinA7FagynRXEnkKsTVWCGnf7+6UMN yl549C6CgiJJ47eQQC7T+cMOKPr2SVfrc4AuERHEpGjMCndnx1954BIuyJc6r8Hk M3uIQBwg/wgbUM6EqL+WHsQckfXyyJ3QjQd77DeZpgdgSXoB5Y7eX12hWrsy86VY /pNYXdUyLNQ= =ltYp -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2370 - [Debian] ruby-nokogiri: CVSS (Max): 7.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2370 ruby-nokogiri security update 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: ruby-nokogiri Publisher: Debian Operating System: Debian GNU/Linux Resolution: Patch/Upgrade CVE Names: CVE-2022-24836 Original Bulletin: http://www.debian.org/lts/security/2022/dla-3003 Comment: CVSS (Max): 7.5 CVE-2022-24836 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVSS Source: NVD Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3003-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Chris Lamb May 13, 2022 https://wiki.debian.org/LTS - - ------------------------------------------------------------------------- Package : ruby-nokogiri Version : 1.6.8.1-1+deb9u2 CVE ID : CVE-2022-24836 Debian Bug : #1009787 It was discovered that there was a potential denial of service attack in ruby-nokogiri, a HTML, XML, SAX etc. parser written in/for the Ruby programming language. This was caused by the use of inefficient regular expressions that were susceptible to excessive backtracking. For Debian 9 "Stretch", this problem has been fixed in version 1.6.8.1-1+deb9u2. We recommend that you upgrade your ruby-nokogiri packages. For the detailed security status of ruby-nokogiri please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ruby-nokogiri Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmJ+lVEACgkQHpU+J9Qx HliDmg/9F9ctpo33nuRd9DRqdaHCtolFKJSPBG4b7c67mSSZB8oSEdC3KFkMGT6u PLPRc9NC8FdeTJvDbwCMuJzkcZu8pzEYaHFgdtuanBUUHLissch38nncdv+ZjRUj hMynD1OUiT/aZQvOo09fvwatFFOcRDZ8zpGzj/NGs/QLJT9BB6tlCPmKY4itsXw+ 3zPEqnpVhbFcJvl66T3T6rhnrD1qMjEh/u3z2gsfeBwHXSJud164utPjYN0PvEUt GVd0Noee28JBtvZQKL29cpN5MOUOmsqCGoDDSUppsSnwonkx/ow+L8ztK2Y74XNK jio2VCRt/7AY+WtzfD96uHAXv6tqzqsoVknQYdQTsovRbNDIA7cbUimhEqGo7NjI RCrEhQ2WOwFTxE+hhYS0FOpPr/0vqsL7z/6iqFUp9oyHkt7HEk7K8GZDPr2+R2WO OI4mfhjghc/HVnLs0B++5WzJkkGN0QGdxx74dL+xzoGsGDd+02FTfwmECn7mOmbL J/7W0SVuIn7KbPieInCwcCRghylAnyPO1Y2zJHfQHFE+KDrwhn3ew6R64BRx1iej seMpYbOi2pvJm8scgF90wdzqj1xAnOFdv+JHkiYvKdj8sZ4tv3Wy3Ww0yxRcB0GT ZrTtLAtNGL12CmNvIQQ2jQaj62Gvgnax90xkIqeYZ8ibqo6ODnw= =8v6/ - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG9hMkNZI30y1K9AQiSdxAApnDcKlr5uUvXbGoHzI062QL/jhGNqjnF HEIvilQLn8YRJfoKkU/b4sFYzAj+ODVVE1f01vJwZFNpBaxrVWxzBaTRDzoINJEt BQPHOW6UmOOzUqBS1p5NRvAdZqCl/PAnjNA5UYZswzu65D/bK4LsV2UT1vj+6ihW QH7SxV7HatKksBBfJP5pLVp0fMIfFrfzzNXF1M8OW8KRruhIfN0zcomV/vFiB0m0 Sblk1/KNBVdS6URFDaDyljnPPLpeFSBDb3Z/9ok8GsGP78ZGGIUFFvyOtfW1fWsu pmPz1ApGvofwA/5Et8TtLVEFqKnt4POCENLV4OeNt4FLIlmIz1sxlB19/fsm+ytq yvC5RHpvJINTXonzkCkiQrfVXJw6IP5a+JTyWKOomSfuA2zZhpYUQbthWMq92lp3 oqr/duddPhsETCo24puaTr0l//9EvTv91kKsw1dM3ySlqsB5Z9AZ9mHItXKqivvn EVhxLU4xH6JrHshet80RQd50a9aNeHp3gtOSJu22CvO/1PvHa2vI8AtC9Yj87Y2k Kyk/TbPpAD+X+5BdYZ1bE6PvAPisHTi2zQDi48T5FEk3kFysvaDKyrmHgO+HPLWO 2tYOaLn6/1gszZUjM/mhv0USnds7/x4U2MNBfdn37w6YYTmKFpCHGAOUdFZNGKDl U6rQEBSPVvo= =YXgo -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2369 - [Debian] adminer: CVSS (Max): 7.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2369 adminer security update 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: adminer Publisher: Debian Operating System: Debian GNU/Linux Resolution: Patch/Upgrade CVE Names: CVE-2021-43008 Original Bulletin: http://www.debian.org/lts/security/2022/dla-3002 Comment: CVSS (Max): 7.5 CVE-2021-43008 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) CVSS Source: NVD Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3002-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Chris Lamb May 13, 2022 https://wiki.debian.org/LTS - - ------------------------------------------------------------------------- Package : adminer Version : 4.2.5-3+deb9u3 CVE ID : CVE-2021-43008 It was discovered that there was an issue in the web-based database tool Adminer whereby an attacker could have performed an Arbitrary File Read on the remote server by requesting Adminer connect to a crafted remote MySQL database. For Debian 9 "Stretch", this problem has been fixed in version 4.2.5-3+deb9u3. We recommend that you upgrade your adminer packages. For the detailed security status of adminer please refer to its security tracker page at: https://security-tracker.debian.org/tracker/adminer Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmJ+j5YACgkQHpU+J9Qx Hlh6og//YlkuWzF4vnjl98j+9EyKaDxNYK2ASgpUSM4IrV1TW4LQqv9R+WNiZUIg x9FRhXTgEBh3ANZeGQqLDKlszNRZhS5sBwVxjuI2lU1b4j6guI/mRti5sAXf5Bbb I7YnlOdtfVu3Ap9ZzNvagQiRJNPgbNjOz3xAGsbSl6kvHCI2mqDb1hZzHbrOpEtf Cn0LSah7St6V4LTqbaOiHw+WR6C5gf7Hu3hntxLozaXBYshLWgmUgLWblfNonNst a39AbWgCtoK+aPJQd4VbRo2rwpNllEiR+6zR8IFnIpFN0mpOmnpdf2gq5fyhxmW0 rksWoH9on2+Mx6wRfKpAI1kOG17t7z2iTrBhjEjEnTiI3TIeb7fdnFoHTcKH5FYU JavRjp7DNRPfk44zwUA99J0ysyLuAIrH6VMQI7IbSVnC24YBKBxaDCKr5Xl1txGL B50EcAt3dKIUVNRfmfZiPQCoNTIYXCB5ionkGc9AReebKc/pFJJpDC3/Kw9usGin JYV4pXIY9CFzKMrVEH13dDTcKcSPo1ZS+DSTP/0Z/xVgMEtbd0MJWFzdHY6Y3OdN NVrbRRQ1j3QjoyoBQW1cSuIF84QWkMC5eRETNuJCHYXkFlaQIZbjXU4avS2MB5Qh NRJ4A01zIo3PsLQK3dAWTFSpNiIf8BZ2pGYz4A20MC70RoqskUQ= =I96e - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG9cckNZI30y1K9AQgLhg/+OJi5sKieVhpT67R+ZOikK4mqpQQij63D Z+9pp2ymt+N1SpN2XMzTz4aygGXn0NMO/rOQMttRhB5nAdNMTNzRS/NBWcnjPvgK Iu06pzZdKr4KoMGUwO8m/3UUNTA3zjh3EubUIVcWciLp0vXKYs3ThZoKUmgARyvL g50PSxVAMENgN8CBFsMKz4GpGAnsfbMa/QIpSLOZQGOzIjdbFh/yJJM1AW2/ah++ XLRbEUNWqFXFtuqJN4foj3B7SDjylazaWZATHN7JTWpIDHl3UJITUxicWDNA6ln+ Dfv+5r8kg7cq1RJqQzNKw2X+1c5hbTdNsMJWCUMm8pzg2rUCcuA20oubRE/ZdWjR pqeaz0Sjy/7chYsBsKDzih93ho6V5DudtK76s2iSdG86zpaPr5tx6BFGOb4AeQXb 9apEUZc/EcAwYwnOYPAktMaJntPG01jrQ7SinYAyQaUCiur5mX0pORJ5NxA+9yn+ tnM4k4sRH+u/dTpGcwwSBg/CtKnDNgdUiidw+JYHLbjrB8X9TQiw1JkO2/F+0w+S LKG/SYSL/H0ra1XxY3c+vrKfVBNWyjwvEleDiOhfNE8Y9TZc/Q/Cimz0ufDMwnAs iE3a3v655vRy0Jtp2ARmIBFZAotQSvMWEXAOcFJxZlTGU4z1LDMiHaTPnYLhwXH0 MENHXX5HHO0= =jNzv -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2368 - [Debian] libgoogle-gson-java: CVSS (Max): 7.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2368 libgoogle-gson-java security update 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: libgoogle-gson-java Publisher: Debian Operating System: Debian GNU/Linux Resolution: Patch/Upgrade CVE Names: CVE-2022-25647 Original Bulletin: https://www.debian.org/lts/security/2022/dla-3001 Comment: CVSS (Max): 7.5 CVE-2022-25647 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVSS Source: NVD Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3001-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Dominik George May 13, 2022 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : libgoogle-gson-java Version : 2.4-1+deb9u1 CVE ID : CVE-2022-25647 Debian Bug : 1010670 It was discovered that the package com.google.code.gson:gson before 2.8.9 is vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks. For Debian 9 stretch, this problem has been fixed in version 2.4-1+deb9u1. We recommend that you upgrade your libgoogle-gson-java packages. For the detailed security status of libgoogle-gson-java please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libgoogle-gson-java Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG9XckNZI30y1K9AQhC0RAAnXuki1w1fjEWZNeWOSFzhCyVLSAmK+PI ecJSoA0SJV5L50BqyjLw73Mh59i7y2ut4TMvlofwpwTlGxeCVcsTHc92VRjfMbU3 Fapfn1P7tUpACNJLRCu+lYPHupwK3XWNOh/wSyFsQ61iGUVeTA6eYgDiDD+3JqqN dz0DHDcvgkpSA5J3ZTooBNagmjXR8jPxOECJ9UMIvZMpRjSQ9gtdPgsxMhe3eu4/ 12gTKH4Z9XO7+bPbIQ/iXTHicitCEMHj66HOGgfbauSZUDps0f5y2nIokU3gYPp5 eQMISh30XsW8r0qXn8D+vpy1YFXGej3W9Fd9BtJl906Qvn4NxwJOqYvYVjphGJ/O ctvb5seZxIddE+QHGe1VsVvYYvXewjxFCT9Cmkctgjz5QFiwifQdEfTBP87vy3jt maUWsCL2ymfpo2L5revTrZUUw67TyrEiTPPrPcq7xnVfYcoXDVBOPu4Tsc98FzWF is/YhU4mY2HXYJFPMzi+o4VPUu70JWH/h5/wVLXGnduZhMU32PwZMLiirIGX/Omm SyQagHEUu8lW88URzLNBsxvqenCmNlICv0WcN9XeAl1k5JoBGkdUQkGW28TW2Njr PHEMKBkrqKsF089RTbmDCqwKoCTnvW3vLQdmHHFMK0REgH9g9adtr51Xf1g+zueR ze/ZcLAGpbM= =wGL4 -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2367 - [SUSE] Linux Kernel: CVSS (Max): 7.0

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2367 Security update for the Linux Kernel 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Linux Kernel Publisher: SUSE Operating System: SUSE Resolution: Patch/Upgrade CVE Names: CVE-2022-28748 CVE-2022-23960 CVE-2022-1516 CVE-2022-1419 CVE-2022-1353 CVE-2022-1280 CVE-2022-1011 CVE-2021-43389 CVE-2021-38208 CVE-2021-20321 CVE-2021-20292 CVE-2019-20811 CVE-2018-7755 Original Bulletin: https://www.suse.com/support/update/announcement/2022/suse-su-20221651-1/ Comment: CVSS (Max): 7.0 CVE-2022-1280 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) CVSS Source: SUSE Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1651-1 Rating: important References: #1028340 #1065729 #1071995 #1084513 #1114648 #1121726 #1129770 #1137728 #1172456 #1183723 #1187055 #1191647 #1191958 #1194625 #1196018 #1196247 #1196657 #1196901 #1197075 #1197343 #1197663 #1197888 #1197914 #1198217 #1198228 #1198400 #1198413 #1198516 #1198660 #1198687 #1198742 #1198825 #1199012 Cross-References: CVE-2018-7755 CVE-2019-20811 CVE-2021-20292 CVE-2021-20321 CVE-2021-38208 CVE-2021-43389 CVE-2022-1011 CVE-2022-1280 CVE-2022-1353 CVE-2022-1419 CVE-2022-1516 CVE-2022-23960 CVE-2022-28748 Affected Products: SUSE Linux Enterprise Server 12-SP5 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has 20 fixes is now available. Description: The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: o CVE-2018-7755: Fixed an issue in the fd_locked_ioctl function in drivers/ block/floppy.c. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR (bnc# 1084513). o CVE-2019-20811: Fixed issue in rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, where a reference count is mishandled (bnc#1172456). o CVE-2021-20292: Fixed object validation prior to performing operations on the object in nouveau_sgdma_create_ttm in Nouveau DRM subsystem (bnc# 1183723). o CVE-2021-20321: Fixed a race condition accessing file object in the OverlayFS subsystem in the way users do rename in specific way with OverlayFS. A local user could have used this flaw to crash the system (bnc# 1191647). o CVE-2021-38208: Fixed a denial of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure of a bind call (bnc#1187055). o CVE-2021-43389: Fixed an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c (bnc#1191958). o CVE-2022-1011: Fixed a use-after-free flaw inside the FUSE filesystem in the way a user triggers write(). This flaw allowed a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation (bnc#1197343). o CVE-2022-1280: Fixed a use-after-free vulnerability in drm_lease_held in drivers/gpu/drm/drm_lease.c (bnc#1197914). o CVE-2022-1353: Fixed access controll to kernel memory in the pfkey_register function in net/key/af_key.c (bnc#1198516). o CVE-2022-1419: Fixed a concurrency use-after-free in vgem_gem_dumb_create (bsc#1198742). o CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect (bsc#1199012). o CVE-2022-23960: Fixed speculation issues in the Branch History Buffer that allowed an attacker to obtain sensitive information using cache allocation (bnc#1196657). o CVE-2022-28748: Fixed memory lead over the network by ax88179_178a devices (bsc#1196018). The following non-security bugs were fixed: o IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() (git-fixes) o NFSD: prevent underflow in nfssvc_decode_writeargs() (git-fixes). o NFSv4: recover from pre-mature loss of openstateid (bsc#1196247). o NFSv4: Do not try to CLOSE if the stateid 'other' field has changed (bsc# 1196247). o NFSv4: Fix a regression in nfs_set_open_stateid_locked() (bsc#1196247). o NFSv4: Handle NFS4ERR_OLD_STATEID in CLOSE/OPEN_DOWNGRADE (bsc#1196247). o NFSv4: Wait for stateid updates after CLOSE/OPEN_DOWNGRADE (bsc#1196247). o NFSv4: fix open failure with O_ACCMODE flag (git-fixes). o PCI/switchtec: Read all 64 bits of part_event_bitmap (git-fixes). o PCI: Add device even if driver attach failed (git-fixes). o PCI: Fix overflow in command-line resource alignment requests (git-fixes). o PCI: iproc: Fix out-of-bound array accesses (git-fixes). o PCI: iproc: Set affinity mask on MSI interrupts (git-fixes). o PCI: qcom: Change duplicate PCI reset to phy reset (git-fixes). o PCI: qcom: Make sure PCIe is reset before init for rev 2.1.0 (git-fixes). o RDMA/rxe: Missing unlock on error in get_srq_wqe() (git-fixes) o RDMA/rxe: Restore setting tot_len in the IPv4 header (git-fixes) o RDMA/rxe: Use the correct size of wqe when processing SRQ (git-fixes) o SUNRPC: Handle low memory situations in call_status() (git-fixes). o USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status (git-fixes). o USB: core: Fix bug in resuming hub's handling of wakeup requests (git-fixes). o USB: serial: cp210x: add NCR Retail IO box id (git-fixes). o USB: serial: pl2303: add IBM device IDs (git-fixes). o USB: serial: simple: add Nokia phone driver (git-fixes). o USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c (git-fixes). o arm64: cmpxchg: Use "K" instead of "L" for ll/sc immediate constraint (git-fixes) o arm64: compat: Provide definition for COMPAT_SIGMINSTKSZ (git-fixes) o arm64: drop linker script hack to hide __efistub_ symbols (git-fixes) o arm64: fix for bad_mode() handler to always result in panic (git-fixes) o arm64: hibernate: Clean the __hyp_text to PoC after resume (git-fixes) o arm64: hyp-stub: Forbid kprobing of the hyp-stub (git-fixes) o arm64: kaslr: ensure randomized quantities are clean also when kaslr (git-fixes) o arm64: kaslr: ensure randomized quantities are clean to the PoC (git-fixes) o arm64: kprobe: Always blacklist the KVM world-switch code (git-fixes) o arm64: only advance singlestep for user instruction traps (git-fixes) o arm64: relocatable: fix inconsistencies in linker script and options (git-fixes) o ath10k: fix max antenna gain unit (git-fixes). o ath6kl: fix control-message timeout (git-fixes). o ath6kl: fix division by zero in send path (git-fixes). o ath9k: Fix potential interrupt storm on queue reset (git-fixes). o b43: fix a lower bounds test (git-fixes). o b43legacy: fix a lower bounds test (git-fixes). o backlight: pwm_bl: Improve bootloader/kernel device handover (bsc#1129770) o bnx2x: fix napi API usage sequence (bsc#1198217). o can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data (git-fixes). o char/mwave: Adjust io port register size (git-fixes). o cifs: do not skip link targets when an I/O fails (bsc#1194625). o crypto: arm64/aes-ce-cipher - move assembler code to .S file (git-fixes) o drm: add a locked version of drm_is_current_master (bsc#1197914). o drm: drm_file struct kABI compatibility workaround (bsc#1197914). o drm: protect drm_master pointers in drm_lease.c (bsc#1197914). o drm: serialize drm_file.master with a new spinlock (bsc#1197914). o drm: use the lookup lock in drm_is_current_master (bsc#1197914). o fbmem: do not allow too huge resolutions (bsc#1129770) o fs/nfs: Use fatal_signal_pending instead of signal_pending (git-fixes). o fsl/fman: Check for null pointer after calling devm_ioremap (git-fixes). o hwrng: atmel - disable trng on failure path (git-fixes). o hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER (git-fixes). o i40e: Fix incorrect netdev's real number of RX/TX queues (git-fixes). o i40e: add correct exception tracing for XDP (git-fixes). o i40e: optimize for XDP_REDIRECT in xsk path (git-fixes). o ieee802154: atusb: fix uninit value in atusb_set_extended_addr (git-fixes). o io-64-nonatomic: add io{read|write}64{_lo_hi|_hi_lo} macros (git-fixes). o libertas: Fix possible memory leak in probe and disconnect (git-fixes). o libertas_tf: Fix possible memory leak in probe and disconnect (git-fixes). o livepatch: Do not block removal of patches that are safe to unload (bsc# 1071995). o mac80211: mesh: fix potentially unaligned access (git-fixes). o media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init (git-fixes). o media: dvb-usb: fix uninit-value in vp702x_read_mac_addr (git-fixes). o media: dvb-usb: fix ununit-value in az6027_rc_query (git-fixes). o media: em28xx: fix memory leak in em28xx_init_dev (git-fixes). o media: lmedm04: Fix misuse of comma (git-fixes). o media: rc-loopback: return number of emitters rather than error (git-fixes). o media: stkwebcam: fix memory leak in stk_camera_probe (git-fixes). o media: uvc: do not do DMA on stack (git-fixes). o media: v4l2-ioctl: S_CTRL output the right value (git-fixes). o media: videobuf2-core: dequeue if start_streaming fails (git-fixes). o mt7601u: fix rx buffer refcounting (git-fixes). o mwifiex: Read a PCI register after writing the TX ring write pointer (git-fixes). o mwifiex: Send DELBA requests according to spec (git-fixes). o mxser: fix xmit_buf leak in activate when LSR == 0xff (git-fixes). o net/mlx5e: Reduce tc unsupported key print level (git-fixes). o net: davinci_emac: Fix incorrect masking of tx and rx error channel (git-fixes). o net: ethernet: mtk_eth_soc: fix return values and refactor MDIO ops (git-fixes). o net: rtlwifi: properly check for alloc_workqueue() failure (git-fixes). o net: stmicro: handle clk_prepare() failure during init (git-fixes). o net: emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (git-fixes). o parisc/sticon: fix reverse colors (bsc#1129770) o powerpc/perf: Fix power9 event alternatives (bsc#1137728, LTC#178106, git-fixes). o ppp: ensure minimum packet size in ppp_write() (git-fixes). o ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE (bsc# 1198413). o random: check for signal_pending() outside of need_resched() check (git-fixes). o random: fix data race on crng_node_pool (git-fixes). o rtl8187: fix control-message timeouts (git-fixes). o scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands (git-fixes). o scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() (bsc#1028340 bsc# 1198825). o tcp: Fix potential use-after-free due to double kfree() (bsc#1197075). o tcp: fix race condition when creating child sockets from syncookies (bsc# 1197075). o usb: hub: Fix usb enumeration issue due to address0 race (git-fixes). o usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect (git-fixes). o usb: ulpi: Call of_node_put correctly (git-fixes). o usb: ulpi: Move of_node_put to ulpi_dev_release (git-fixes). o video: fbdev: atari: Atari 2 bpp (STe) palette bugfix (bsc#1129770) o video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() (bsc# 1129770) o video: fbdev: chipsfb: use memset_io() instead of memset() (bsc#1129770) o video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() (bsc#1129770) o video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of (bsc# 1129770) o video: fbdev: sm712fb: Fix crash in smtcfb_read() (bsc#1129770) o video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() (bsc#1129770) o video: fbdev: udlfb: properly check endpoint type (bsc#1129770) o wcn36xx: Fix HT40 capability for 2Ghz band (git-fixes). o wcn36xx: add proper DMA memory barriers in rx path (git-fixes). o x86/pm: Save the MSR validity status at context setup (bsc#1114648). o x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO (git-fixes). o x86/speculation: Restore speculation related MSRs during S3 resume (bsc# 1114648). o xen/blkfront: fix comment for need_copy (git-fixes). o xen: detect uninitialized xenbus in xenbus_init (git-fixes). o xen: do not continue xenstore initialization in case of errors (git-fixes). o xen: fix is_xen_pmu() (git-fixes). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-1651=1 Package List: o SUSE Linux Enterprise Server 12-SP5 (noarch): kernel-devel-azure-4.12.14-16.97.1 kernel-source-azure-4.12.14-16.97.1 o SUSE Linux Enterprise Server 12-SP5 (x86_64): kernel-azure-4.12.14-16.97.1 kernel-azure-base-4.12.14-16.97.1 kernel-azure-base-debuginfo-4.12.14-16.97.1 kernel-azure-debuginfo-4.12.14-16.97.1 kernel-azure-debugsource-4.12.14-16.97.1 kernel-azure-devel-4.12.14-16.97.1 kernel-syms-azure-4.12.14-16.97.1 References: o https://www.suse.com/security/cve/CVE-2018-7755.html o https://www.suse.com/security/cve/CVE-2019-20811.html o https://www.suse.com/security/cve/CVE-2021-20292.html o https://www.suse.com/security/cve/CVE-2021-20321.html o https://www.suse.com/security/cve/CVE-2021-38208.html o https://www.suse.com/security/cve/CVE-2021-43389.html o https://www.suse.com/security/cve/CVE-2022-1011.html o https://www.suse.com/security/cve/CVE-2022-1280.html o https://www.suse.com/security/cve/CVE-2022-1353.html o https://www.suse.com/security/cve/CVE-2022-1419.html o https://www.suse.com/security/cve/CVE-2022-1516.html o https://www.suse.com/security/cve/CVE-2022-23960.html o https://www.suse.com/security/cve/CVE-2022-28748.html o https://bugzilla.suse.com/1028340 o https://bugzilla.suse.com/1065729 o https://bugzilla.suse.com/1071995 o https://bugzilla.suse.com/1084513 o https://bugzilla.suse.com/1114648 o https://bugzilla.suse.com/1121726 o https://bugzilla.suse.com/1129770 o https://bugzilla.suse.com/1137728 o https://bugzilla.suse.com/1172456 o https://bugzilla.suse.com/1183723 o https://bugzilla.suse.com/1187055 o https://bugzilla.suse.com/1191647 o https://bugzilla.suse.com/1191958 o https://bugzilla.suse.com/1194625 o https://bugzilla.suse.com/1196018 o https://bugzilla.suse.com/1196247 o https://bugzilla.suse.com/1196657 o https://bugzilla.suse.com/1196901 o https://bugzilla.suse.com/1197075 o https://bugzilla.suse.com/1197343 o https://bugzilla.suse.com/1197663 o https://bugzilla.suse.com/1197888 o https://bugzilla.suse.com/1197914 o https://bugzilla.suse.com/1198217 o https://bugzilla.suse.com/1198228 o https://bugzilla.suse.com/1198400 o https://bugzilla.suse.com/1198413 o https://bugzilla.suse.com/1198516 o https://bugzilla.suse.com/1198660 o https://bugzilla.suse.com/1198687 o https://bugzilla.suse.com/1198742 o https://bugzilla.suse.com/1198825 o https://bugzilla.suse.com/1199012 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG8rskNZI30y1K9AQjYSw//Rlq9y/U/fsDo+kl9xXX69MzMrxdstY/4 2yA9Y2pvKfMUzyY4s1C96jl+AJqF3ouV0J1pu/XyuidBhwOphyA8/5Q5wWsEgvi7 iuiXjRVt+bTBD2NT8n/0pcO9enwZKprhi8XD+HZrd5IdclEdUKctFA58WRs9+1jc Gy4B+WO/kj9eJ5r5Bak2+EAn9zZEX5Kj5ufX5uDSzjakB/DOfbeV3ySEjFiRTJ8v QFbg/ZrnFpjW1xvk/xkK37XiOLSVkXtFkvDlLmBtM2LfjSn8u2HJRTqjxR6pMMaE V5Fhz48J3Qa0OqQIKoCwJKKd2IcnCvOmWsoII+o6jvaeAIcqFsVtYz9Hsjvz3LK5 PCapPciJhgE8f0XqI260efUkfCtePJC3hLIDeS3FiR3QrchFfhDbWuSmad8tUsUB boqwzmaZfrRC6+dCtIkvTI1znrQwRRuP7yBL3VumWje6P7iOjrC+kzfAucVgbXLF ZR9RMJ5pbTI73u3un2ikXmt50xm+w5vNpCobwfbrZrutGr3cPF91bfY4zj653IC5 hM9MD9t4slFFLjDu/nkQy2OHmtwFYV2syjXv1mkxZOGhlFdIpG/VrJLqiLSksNQE UZAXdRpD4nsHmoKuE7zTeQJHxUENwhKJIB/u6vKmMfpFFvDGSkmdqcuSrS1L/ELA mUQhTFZNVek= =3ZeW -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2366 - [SUSE] gzip: CVSS (Max): 8.4

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2366 Security update for gzip 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: gzip Publisher: SUSE Operating System: SUSE Resolution: Patch/Upgrade CVE Names: CVE-2022-1271 Original Bulletin: https://www.suse.com/support/update/announcement/2022/suse-su-20221650-1 Comment: CVSS (Max): 8.4 CVE-2022-1271 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVSS Source: SUSE Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- SUSE Security Update: Security update for gzip ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1650-1 Rating: important References: Affected Products: SUSE Linux Enterprise Server 12-SP5 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for gzip fixes the following issues: o CVE-2022-1271: Add hardening for zgrep. (bsc#1198062) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-1650=1 Package List: o SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64): gzip-1.10-4.14.1 gzip-debuginfo-1.10-4.14.1 gzip-debugsource-1.10-4.14.1 References: - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG8n8kNZI30y1K9AQjYbBAAlO8seb7x1t1Laf8fDJP6mlu7Aqzr8X8j R8PdGkDmpt+Qcn8QerRKkVChtrYgsAAYVdvFmc7rbnv4PIp6IRpGLAuUASyGBgQD mLV0Joimrv1jW6q9EOXpjwSDcNYZ4wDr/CdsuHLxIULOcbO69XNak+I65z0vBXmR cIj9N41EYusTONfxwypYGenxwlJeSNQnhAUmDzLek2apm4oZO0pHCK+tzGO1XlNf ImcHXuq0Fd880n4jGZLl8aVNkojpYFwa3Rxoy8rNa+Rd+uWc+Hcmp/9G3xG0VDL/ 6JVmjtZPgV+tv22s2rQBfyl6btYcupRjrQN9dTRGooDpigSavcQQi6xfjUL5uGCp bjR81I3gLRK7jovvlo3rFuw3ZyaZVcYpx0NCzrhuuLjuZGobvN+wqrD+h/Du7Bfp C9I0GMQO5LZaIkGr8iUY9m54jlcr+cIA+YSWtfXpGRPFAP8JLFtTsA5fz0fUrSfq a1HqQ1kfczmyMCua10kjiaqzkjJ2UvGayVeayKoqZurJKY6DUljd2MAfQ0RA3Icz D+ljpn9wU9hD4m1g1Ws5zGkl+j1NImGKFdujUX/cSqRBMO2/nsWNPtO/nirFTsxp wgSPENHgsQ3fuvnvRpB4utZhIylAq+JOtBGN8yD6kapyXKas+9d1aqrmeqipJkA1 6UIgFb7S4dQ= =WiUD -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2365 - [SUSE] e2fsprogs: CVSS (Max): 7.0

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2365 Security update for e2fsprogs 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: e2fsprogs Publisher: SUSE Operating System: SUSE Resolution: Patch/Upgrade CVE Names: CVE-2022-1304 Original Bulletin: https://www.suse.com/support/update/announcement/2022/suse-su-20221652-1 Comment: CVSS (Max): 7.0 CVE-2022-1304 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) CVSS Source: SUSE Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- SUSE Security Update: Security update for e2fsprogs ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1652-1 Rating: important References: #1198446 Cross-References: CVE-2022-1304 Affected Products: HPE Helion Openstack 8 SUSE Linux Enterprise Server 12-SP2-BCL SUSE Linux Enterprise Server 12-SP3-BCL SUSE Linux Enterprise Server 12-SP3-LTSS SUSE Linux Enterprise Server for SAP 12-SP3 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for e2fsprogs fixes the following issues: o CVE-2022-1304: Fixed out-of-bounds read/write leading to segmentation fault and possibly arbitrary code execution. (bsc#1198446) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o SUSE OpenStack Cloud Crowbar 8: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2022-1652=1 o SUSE OpenStack Cloud 8: zypper in -t patch SUSE-OpenStack-Cloud-8-2022-1652=1 o SUSE Linux Enterprise Server for SAP 12-SP3: zypper in -t patch SUSE-SLE-SAP-12-SP3-2022-1652=1 o SUSE Linux Enterprise Server 12-SP3-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2022-1652=1 o SUSE Linux Enterprise Server 12-SP3-BCL: zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2022-1652=1 o SUSE Linux Enterprise Server 12-SP2-BCL: zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2022-1652=1 o HPE Helion Openstack 8: zypper in -t patch HPE-Helion-OpenStack-8-2022-1652=1 Package List: o SUSE OpenStack Cloud Crowbar 8 (x86_64): e2fsprogs-1.42.11-16.9.1 e2fsprogs-debuginfo-1.42.11-16.9.1 e2fsprogs-debuginfo-32bit-1.42.11-16.9.1 e2fsprogs-debugsource-1.42.11-16.9.1 libcom_err2-1.42.11-16.9.1 libcom_err2-32bit-1.42.11-16.9.1 libcom_err2-debuginfo-1.42.11-16.9.1 libcom_err2-debuginfo-32bit-1.42.11-16.9.1 libext2fs2-1.42.11-16.9.1 libext2fs2-debuginfo-1.42.11-16.9.1 o SUSE OpenStack Cloud 8 (x86_64): e2fsprogs-1.42.11-16.9.1 e2fsprogs-debuginfo-1.42.11-16.9.1 e2fsprogs-debuginfo-32bit-1.42.11-16.9.1 e2fsprogs-debugsource-1.42.11-16.9.1 libcom_err2-1.42.11-16.9.1 libcom_err2-32bit-1.42.11-16.9.1 libcom_err2-debuginfo-1.42.11-16.9.1 libcom_err2-debuginfo-32bit-1.42.11-16.9.1 libext2fs2-1.42.11-16.9.1 libext2fs2-debuginfo-1.42.11-16.9.1 o SUSE Linux Enterprise Server for SAP 12-SP3 (ppc64le x86_64): e2fsprogs-1.42.11-16.9.1 e2fsprogs-debuginfo-1.42.11-16.9.1 e2fsprogs-debugsource-1.42.11-16.9.1 libcom_err2-1.42.11-16.9.1 libcom_err2-debuginfo-1.42.11-16.9.1 libext2fs2-1.42.11-16.9.1 libext2fs2-debuginfo-1.42.11-16.9.1 o SUSE Linux Enterprise Server for SAP 12-SP3 (x86_64): e2fsprogs-debuginfo-32bit-1.42.11-16.9.1 libcom_err2-32bit-1.42.11-16.9.1 libcom_err2-debuginfo-32bit-1.42.11-16.9.1 o SUSE Linux Enterprise Server 12-SP3-LTSS (aarch64 ppc64le s390x x86_64): e2fsprogs-1.42.11-16.9.1 e2fsprogs-debuginfo-1.42.11-16.9.1 e2fsprogs-debugsource-1.42.11-16.9.1 libcom_err2-1.42.11-16.9.1 libcom_err2-debuginfo-1.42.11-16.9.1 libext2fs2-1.42.11-16.9.1 libext2fs2-debuginfo-1.42.11-16.9.1 o SUSE Linux Enterprise Server 12-SP3-LTSS (s390x x86_64): e2fsprogs-debuginfo-32bit-1.42.11-16.9.1 libcom_err2-32bit-1.42.11-16.9.1 libcom_err2-debuginfo-32bit-1.42.11-16.9.1 o SUSE Linux Enterprise Server 12-SP3-BCL (x86_64): e2fsprogs-1.42.11-16.9.1 e2fsprogs-debuginfo-1.42.11-16.9.1 e2fsprogs-debuginfo-32bit-1.42.11-16.9.1 e2fsprogs-debugsource-1.42.11-16.9.1 libcom_err2-1.42.11-16.9.1 libcom_err2-32bit-1.42.11-16.9.1 libcom_err2-debuginfo-1.42.11-16.9.1 libcom_err2-debuginfo-32bit-1.42.11-16.9.1 libext2fs2-1.42.11-16.9.1 libext2fs2-debuginfo-1.42.11-16.9.1 o SUSE Linux Enterprise Server 12-SP2-BCL (x86_64): e2fsprogs-1.42.11-16.9.1 e2fsprogs-debuginfo-1.42.11-16.9.1 e2fsprogs-debuginfo-32bit-1.42.11-16.9.1 e2fsprogs-debugsource-1.42.11-16.9.1 libcom_err2-1.42.11-16.9.1 libcom_err2-32bit-1.42.11-16.9.1 libcom_err2-debuginfo-1.42.11-16.9.1 libcom_err2-debuginfo-32bit-1.42.11-16.9.1 libext2fs2-1.42.11-16.9.1 libext2fs2-debuginfo-1.42.11-16.9.1 o HPE Helion Openstack 8 (x86_64): e2fsprogs-1.42.11-16.9.1 e2fsprogs-debuginfo-1.42.11-16.9.1 e2fsprogs-debuginfo-32bit-1.42.11-16.9.1 e2fsprogs-debugsource-1.42.11-16.9.1 libcom_err2-1.42.11-16.9.1 libcom_err2-32bit-1.42.11-16.9.1 libcom_err2-debuginfo-1.42.11-16.9.1 libcom_err2-debuginfo-32bit-1.42.11-16.9.1 libext2fs2-1.42.11-16.9.1 libext2fs2-debuginfo-1.42.11-16.9.1 References: o https://www.suse.com/security/cve/CVE-2022-1304.html o https://bugzilla.suse.com/1198446 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG8j8kNZI30y1K9AQhS+Q//XmVYJNEWaX/UqtVS5NT7nT2nZW/st7eu yEvwThCTsdxTDqxylEyKVV5dtHNAzMfpcMLBU2PSD0xLnpiuRuaZetbtPRn1Grpx AyQu7rtNW4NgR9T+3e5aChBjKb9GQGa2JrU+r1JucHrxlfszCCGC9Ylf0uXorNml 8B1rRPHFTcBp3phUHjs7ZmXlEbv/6BgWsjAy/xp7ZwydBwAhv0cT5Fx1YXWFQBQq otK/v2/W+8640OGWW0A8OUpb0c9wRfjVwsBGZOf9/fHpByjVjdOq0++uqu8z/ntk yLoI1qPIer5J55DXxwqd9VSTg15i3zGx2xwBzD0UPNciroSICKmESHtMHqReXU9q As7ufbwgDwnpBapdiTF/hGahPHbRVLoJdxqxbLquxHfZPovFI7UnwlsdwRMRjpba Y7duX/g8k8RnvyvzbgDmDunpXZ6twgX0GuBXgE8s0qduoeFOoyV9X9TG33GL+Yt/ Mq8BGLI+HruYmJphP223jH3ED1RFrOos7c8HZu1pNmWoQPsrSjX0/uZVOAzeI8Y3 /oJ1CHbTO+DXXhupSWPuVd9WZzb5Vr+B/bUGTkEgaxUHDAO3PVxueu26oYJeOnsH J3aJH/yCZ99lnUe0K/kvTntGRXto+GnUHeoRx8/Vghqwk6b83lN8AJmGocdQprhD SUgo3qnSltc= =rSJz -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2364 - [SUSE] documentation-suse-openstack-cloud, kibana, openstack-keystone, openstack-monasca-notification: CVSS (Max): 7.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2364 Security update for documentation-suse-openstack-cloud, kibana, openstack-keystone, openstack-monasca-notification 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: documentation-suse-openstack-cloud, kibana, openstack-keystone, openstack-monasca-notification Publisher: SUSE Operating System: SUSE Resolution: Patch/Upgrade CVE Names: CVE-2021-38155 CVE-2021-22141 Original Bulletin: https://www.suse.com/support/update/announcement/2022/suse-su-20221654-1 Comment: CVSS (Max): 7.5 CVE-2021-38155 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) CVSS Source: SUSE Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - --------------------------BEGIN INCLUDED TEXT-------------------- SUSE Security Update: Security update for documentation-suse-openstack-cloud, kibana, openstack-keystone, openstack-monasca-notification ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1654-1 Rating: important References: #1186868 #1189390 #1197204 Cross-References: CVE-2021-22141 CVE-2021-38155 Affected Products: HPE Helion Openstack 8 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for documentation-suse-openstack-cloud, kibana, openstack-keystone, openstack-monasca-notification fixes the following issues: o CVE-2021-22141: Fixed URL redirection flaw (bsc#1186868). o CVE-2021-38155: Fixed information disclosure during account locking (bsc# 1189390). The following non-security bugs were fixed: o Fix smtp server authentication (bsc#1197204) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o SUSE OpenStack Cloud Crowbar 8: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2022-1654=1 o SUSE OpenStack Cloud 8: zypper in -t patch SUSE-OpenStack-Cloud-8-2022-1654=1 o HPE Helion Openstack 8: zypper in -t patch HPE-Helion-OpenStack-8-2022-1654=1 Package List: o SUSE OpenStack Cloud Crowbar 8 (noarch): documentation-suse-openstack-cloud-deployment-8.20211112-1.38.1 documentation-suse-openstack-cloud-supplement-8.20211112-1.38.1 documentation-suse-openstack-cloud-upstream-admin-8.20211112-1.38.1 documentation-suse-openstack-cloud-upstream-user-8.20211112-1.38.1 openstack-keystone-12.0.4~dev11-5.36.1 openstack-keystone-doc-12.0.4~dev11-5.36.1 openstack-monasca-notification-1.10.2~dev4-3.9.1 python-keystone-12.0.4~dev11-5.36.1 python-monasca-notification-1.10.2~dev4-3.9.1 o SUSE OpenStack Cloud Crowbar 8 (x86_64): kibana-4.6.6-3.12.1 kibana-debuginfo-4.6.6-3.12.1 o SUSE OpenStack Cloud 8 (x86_64): kibana-4.6.6-3.12.1 kibana-debuginfo-4.6.6-3.12.1 o SUSE OpenStack Cloud 8 (noarch): documentation-suse-openstack-cloud-installation-8.20211112-1.38.1 documentation-suse-openstack-cloud-operations-8.20211112-1.38.1 documentation-suse-openstack-cloud-opsconsole-8.20211112-1.38.1 documentation-suse-openstack-cloud-planning-8.20211112-1.38.1 documentation-suse-openstack-cloud-security-8.20211112-1.38.1 documentation-suse-openstack-cloud-supplement-8.20211112-1.38.1 documentation-suse-openstack-cloud-upstream-admin-8.20211112-1.38.1 documentation-suse-openstack-cloud-upstream-user-8.20211112-1.38.1 documentation-suse-openstack-cloud-user-8.20211112-1.38.1 openstack-keystone-12.0.4~dev11-5.36.1 openstack-keystone-doc-12.0.4~dev11-5.36.1 openstack-monasca-notification-1.10.2~dev4-3.9.1 python-keystone-12.0.4~dev11-5.36.1 python-monasca-notification-1.10.2~dev4-3.9.1 venv-openstack-keystone-x86_64-12.0.4~dev11-11.45.1 venv-openstack-monasca-x86_64-2.2.2~dev1-11.45.1 o HPE Helion Openstack 8 (noarch): documentation-hpe-helion-openstack-installation-8.20211112-1.38.1 documentation-hpe-helion-openstack-operations-8.20211112-1.38.1 documentation-hpe-helion-openstack-opsconsole-8.20211112-1.38.1 documentation-hpe-helion-openstack-planning-8.20211112-1.38.1 documentation-hpe-helion-openstack-security-8.20211112-1.38.1 documentation-hpe-helion-openstack-user-8.20211112-1.38.1 openstack-keystone-12.0.4~dev11-5.36.1 openstack-keystone-doc-12.0.4~dev11-5.36.1 openstack-monasca-notification-1.10.2~dev4-3.9.1 python-keystone-12.0.4~dev11-5.36.1 python-monasca-notification-1.10.2~dev4-3.9.1 venv-openstack-keystone-x86_64-12.0.4~dev11-11.45.1 venv-openstack-monasca-x86_64-2.2.2~dev1-11.45.1 o HPE Helion Openstack 8 (x86_64): kibana-4.6.6-3.12.1 kibana-debuginfo-4.6.6-3.12.1 References: o https://www.suse.com/security/cve/CVE-2021-22141.html o https://www.suse.com/security/cve/CVE-2021-38155.html o https://bugzilla.suse.com/1186868 o https://bugzilla.suse.com/1189390 o https://bugzilla.suse.com/1197204 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG8fckNZI30y1K9AQhONA/+M4f5l6XgxAEhhJXB8qZBitmWACuUeS8I K1b7WCJ20nimLLFKhRFj1yfU9h0wksFVxqwY7otLrekMnOqJDgYwkX4AQEGMKG3T SpdTsJS0gkOnQ6cJVCBn5aIJHcSEKZHCEdqbR/DRc6KtqblaBjwG09Spx8ci88Rd N4zyJz5+5F55o3NtvfkeNfVDXRpRDTQ8SvgDvWxZrVyQUY+yLlJioQG8KRP8iW0P wzIMY1u5ZKJwdohRuCVYQpGA/J3YifcD5jaqPw6e9OGhOSb9SCzP6ypYH89GSf1g b+HOPmF3P3JR2Ffz7kBUPKrTAsmghRx7dwNIdWON4HWy86gQMjFtjx9uGAFU/8R1 MtAMv4QF9MmWxZK44jt0ZQMckpNUbXFLyLVyxA2aSLLgNaPAVMXQSYMes70k4VSp o+bzgqjbyjqqsgv4O3QMcRXCSG/RCH17nGrYVF4zZ5lLZNvxVRtSi4b4Oh9OV8RB Ys2NKHocNlgQ2fJPMKlN4fkDna5vsEt/u0SJZ7+cQdb6jVq5bBrZg1KtZ0ltQWqJ bhK26PQvcWk1lWeHHXFmLKJaZwoOKTIIRmYMmxfr5KzbB/Z1w8eRSWeK/xZlKQan C3GSbm6nAgty2s2C8B4r0MbqT59ZXyja0iQyrSOWP0jEINAKW45VGV3UdsxexdeO 0OUmQdbUmTA= =Zrdt -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2363 - [SUSE] curl: CVSS (Max): 5.6

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2363 Security update for curl 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: curl Publisher: SUSE Operating System: SUSE Resolution: Patch/Upgrade CVE Names: CVE-2022-27776 CVE-2022-27775 CVE-2022-22576 Original Bulletin: https://www.suse.com/support/update/announcement/2022/suse-su-20221657-1 Comment: CVSS (Max): 5.6 CVE-2022-27775 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) CVSS Source: SUSE Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - --------------------------BEGIN INCLUDED TEXT-------------------- SUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1657-1 Rating: moderate References: #1198614 #1198723 #1198766 Cross-References: CVE-2022-22576 CVE-2022-27775 CVE-2022-27776 Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for curl fixes the following issues: o CVE-2022-27776: Fixed auth/cookie leak on redirect (bsc#1198766) o CVE-2022-27775: Fixed bad local IPv6 connection reuse (bsc#1198723) o CVE-2022-22576: Fixed OAUTH2 bearer bypass in connection re-use (bsc# 1198614) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1657=1 o SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1657=1 o SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-1657=1 o SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-1657=1 Package List: o openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): curl-7.66.0-150200.4.30.1 curl-debuginfo-7.66.0-150200.4.30.1 curl-debugsource-7.66.0-150200.4.30.1 libcurl-devel-7.66.0-150200.4.30.1 libcurl4-7.66.0-150200.4.30.1 libcurl4-debuginfo-7.66.0-150200.4.30.1 o openSUSE Leap 15.3 (x86_64): libcurl-devel-32bit-7.66.0-150200.4.30.1 libcurl4-32bit-7.66.0-150200.4.30.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.30.1 o SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): curl-7.66.0-150200.4.30.1 curl-debuginfo-7.66.0-150200.4.30.1 curl-debugsource-7.66.0-150200.4.30.1 libcurl-devel-7.66.0-150200.4.30.1 libcurl4-7.66.0-150200.4.30.1 libcurl4-debuginfo-7.66.0-150200.4.30.1 o SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): libcurl4-32bit-7.66.0-150200.4.30.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.30.1 o SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): curl-7.66.0-150200.4.30.1 curl-debuginfo-7.66.0-150200.4.30.1 curl-debugsource-7.66.0-150200.4.30.1 libcurl4-7.66.0-150200.4.30.1 libcurl4-debuginfo-7.66.0-150200.4.30.1 o SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): curl-7.66.0-150200.4.30.1 curl-debuginfo-7.66.0-150200.4.30.1 curl-debugsource-7.66.0-150200.4.30.1 libcurl4-7.66.0-150200.4.30.1 libcurl4-debuginfo-7.66.0-150200.4.30.1 References: o https://www.suse.com/security/cve/CVE-2022-22576.html o https://www.suse.com/security/cve/CVE-2022-27775.html o https://www.suse.com/security/cve/CVE-2022-27776.html o https://bugzilla.suse.com/1198614 o https://bugzilla.suse.com/1198723 o https://bugzilla.suse.com/1198766 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG8bckNZI30y1K9AQgypA/9ECYjWziT9T5Wj1xVhiSEdjnai1KOuWNM lwvn5Ft25wsYnB1SWaZJHRat+1YLYDfvfm0wjtzJakJoP5kS95fcRIA/cYmrufIf 7N8HHQIngmlf1QTc8z66hXzB5unLrXuuDvjB9gqx+SNkEX2XN0JtdH8WI8HlRz0E 0wU8HR7+Cgg/+1Kymi95t5pF+3Z50hm/W6z514banVYf3DDRjCoU3n7Nk8WWkuTq wMqxfeWLtWqUDaE9HFE4HUiRJrO97kZlgxCkSIOzJleuR0/xuE5xBm030YVsdtri +S/LUDawNM/OV+7TfKZK2JS4NpdlaDAeSUV3FrD54gkGHChyZFTl3Ori8uUa5l4q ArZUB6rEQKQ1KLcWISOnhbTwGAIHcIAFMfqCDpiQW5St5OP0FZNeWwGgMd8FcwbO QlAR8gCOyo+0wx3vt2F9CrITdZIcI3w8fkBFBdL8tGxE5HBm/NK/vCQgjlaatCxM 7kJDmzvgIJSaB5wiPUHb1KP1UvNEj1+kp37t5Jeuv5Z/fnu4wMAaYZChaGEadd/O fJOIkrNQ9GFzlQh3UbSPTkpN5POinlT3/OW2ZASlbK7rxf7rH7xjq30mNHOqykon HTVZD/bYCC5DenKfw3Ryx8kTFsLcPmDzoHyf30PGqZP2teEO8lSiZyd4vKTFCncg sSrPg2tTUZg= =FZJN -----END PGP SIGNATURE-----
2022. május 16.

ESB-2022.2362 - [SUSE] clamav: CVSS (Max): 7.8

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2362 Security update for clamav 16 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: clamav Publisher: SUSE Operating System: SUSE Resolution: Patch/Upgrade CVE Names: CVE-2022-20796 CVE-2022-20792 CVE-2022-20785 CVE-2022-20771 CVE-2022-20770 Original Bulletin: https://www.suse.com/support/update/announcement/2022/suse-su-20221647-1 Comment: CVSS (Max): 7.8 CVE-2022-20792 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) CVSS Source: SUSE Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- SUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1647-1 Rating: important References: #1199242 #1199244 #1199245 #1199246 #1199274 Cross-References: CVE-2022-20770 CVE-2022-20771 CVE-2022-20785 CVE-2022-20792 CVE-2022-20796 Affected Products: SUSE Linux Enterprise Server 12-SP5 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for clamav fixes the following issues: o CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM file parser (bsc#1199242). o CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the scan verdict cache check (bsc#1199246). o CVE-2022-20771: Fixed a possible infinite loop vulnerability in the TIFF file parser (bsc#1199244). o CVE-2022-20785: Fixed a possible memory leak in the HTML file parser / Javascript normalizer (bsc#1199245). o CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write vulnerability in the signature database load module (bsc#1199274). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-1647=1 Package List: o SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64): clamav-0.103.6-3.18.1 clamav-debuginfo-0.103.6-3.18.1 clamav-debugsource-0.103.6-3.18.1 References: o https://www.suse.com/security/cve/CVE-2022-20770.html o https://www.suse.com/security/cve/CVE-2022-20771.html o https://www.suse.com/security/cve/CVE-2022-20785.html o https://www.suse.com/security/cve/CVE-2022-20792.html o https://www.suse.com/security/cve/CVE-2022-20796.html o https://bugzilla.suse.com/1199242 o https://bugzilla.suse.com/1199244 o https://bugzilla.suse.com/1199245 o https://bugzilla.suse.com/1199246 o https://bugzilla.suse.com/1199274 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYoG8XckNZI30y1K9AQgGRA//euTNlqTUrsCNoeYxx3DyjLhSiL9GFxaD +mxaH49cYPyApv30QZFc0gakhvtEJrb5eHGSWZwikr7WbUcvIjkR7pgTxY9l2wfi d/zuQIRSluKWd/Cm6IYR1BIhJvgfoNKBDQfBGCboydMBe0R9rn3CUqxhNsxkJdSP UlHLWJY0HOU0c3yyrTRrqbUYraTg6wnMic5noqa2aVDCOYdMRrDc5WWrLxCcP6Rt geFeGG2Fky55jbvAbpXMtN/uzEEXCI4JWlrihoTdGHxzvnwTkyVOBKDB78E+WGh/ ATXTMSyH4qskhpHwDgwkmJhdCG3fhWEiS8pXDD+btlPbK6f0lRvEJeuYEw3nxycJ 7fBw2fC1K7xB0mPmb2Iwiwfl1r4PTs3VjGnmFrK+XYyJzqhnhZoq08UZeKIs2TeC t9SV08fIPgH2YBz4cQVew17a/C5KVTQzOp6nfL2MaJ3ihmXhy0gOdjhfE48TLaRT qkHk2xOAfzl29BEOMiq7HFOnogNbayMvst+nBwzCGRfiM8nTcaGr57byqiLOT5ZE tKSl/tgN/CMYRbYfl9+JVQv3f/aST65vMlwNWnfMVgNHTjbU/ZXTH0RsAqTh+fpb 5qnQ1Y23YLZprCMtMhTxykriWpAdqPuM7rvjPHvFTJrDomehKAg5tjw0aGa9BT2q 0Q8hLcWE4EU= =B2yN -----END PGP SIGNATURE-----
2022. május 13.

ASB-2022.0126 - AusCERT PGP Public Key:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT Security Bulletin ASB-2022.0126 AusCERT PGP Public Key Update 13 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: AusCERT PGP Public Key Resolution: Patch/Upgrade OVERVIEW AusCERT has generated a new PGP/GPG Key to use for signing and receiving encrypted data. This key came into effect as of: 11 May 2022 IMPACT PGP and GPG users are required to import AusCERT's new public key into their keyring so that they can validate future bulletins and other communications. AusCERT will no longer be using the old key: key id: 7228F628 fingerprint: 2B94 4D32 0813 377F F623 7E2D E34B 289B 7228 F628 AusCERT will now be using the following new key: key id: F4CB52BD fingerprint: 34D8 7588 1B56 A8E7 079C 2332 C90D 648D F4CB 52BD MITIGATION The key can be downloaded from our website [1] over SSL to secure the transaction. You can verify the contents of this file by issuing the command: $ gpg --show-keys F4CB52BD.asc pub rsa4096 2022-05-11 [SC] [expires: 2024-05-10] 34D875881B56A8E7079C2332C90D648DF4CB52BD uid AusCERT (Australia's premier CERT) sub rsa4096 2022-05-11 [E] [expires: 2024-05-10] If you require further information you can contact AusCERT via phone and confirm the Key ID and fingerprint. To phone AusCERT call +61 7 3365 4417. REFERENCES [1] AusCERT PGP Public Key https://auscert.org.au/gpg-key/ AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYn3fBMkNZI30y1K9AQg+GA/6A7A3ltjXRnFfSeLgoj0GkbdWeMi2Bzcy KXt26Yr7v+ue6LYNbNX1JsSCjvVgJqTChxF22SutJC2mL3hyOwGEmSn8KHP2DP3D 56553BtmQMlpdHSqB5pJGDNTUOSSfJ71kxzLRIjtpTHdCTzeufslt4Gc+1/okLUA 7h3r2lQMBjNdkurU7spawdWfeDB9s4UMdmf6nx7ybosZinG4BQAAzFW+KXn2oyv8 gtPunweue7q6RNI4UZWH2mRz2YqMv8UFlTa8q+XyfD/WJ2GfFCSxX+Ta1dfzGqcH F0jf/2VeLPLV/RCpuYM9Ni2hEEzqCQelfQcC7I91uWy7yY9fsbDMpEd9Ai/O7bHy WqhwyOjbemX/D7hK/u8LQoYTb58Yw5S/EkECCqS21CWty6UK/o98I0XwiYdOe25Q NquowG9PxbYf6E7dEQbxkHeFysllijtS0elU/w19EmFKyJbfRfvwSmMYJqzJFPoj QrCgkqOPX/lCXF68ncMVYKXudC7sb5wkmmryNK6Wj9QkJUnH9pF/l2YBzSrzfxyH pZvP+/thkiAY4R9h4Lp/rtORQxza8gBOWEha4y/cSmrYN1nphdPzGNJySrOsGktv c7BZispJQ7dPwYInhVIS0JcOQzzy7e8y2ACFYPRerjAIGORW0g4qTUmTawCfexBV FNojylqqf+k= =OH43 -----END PGP SIGNATURE-----
2022. május 13.

ESB-2022.2361 - [Win][Linux][Mac] PAN-OS, GlobalProtect app and Cortex XDR agent: CVSS (Max): 7.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2361 CVE-2022-0778 Impact of the OpenSSL Infinite Loop Vulnerability CVE-2022-0778 13 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: PAN-OS GlobalProtect app Cortex XDR agent Publisher: Palo Alto Operating System: Windows macOS Linux variants Resolution: Patch/Upgrade CVE Names: CVE-2022-0778 Original Bulletin: https://securityadvisories.paloaltonetworks.com/CVE-2022-0778 Comment: CVSS (Max): 7.5 CVE-2022-0778 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVSS Source: NVD Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Palo Alto Networks Security Advisories / CVE-2022-0778 CVE-2022-0778 Impact of the OpenSSL Infinite Loop Vulnerability CVE-2022-0778 047910 Severity 7.5 . HIGH Attack Vector NETWORK Scope UNCHANGED Attack Complexity LOW Confidentiality Impact NONE Privileges Required NONE Integrity Impact NONE User Interaction NONE Availability Impact HIGH NVD JSON Published 2022-03-31 Updated 2022-05-12 Reference PAN-190175 and PAN-190223 Discovered externally Description The Palo Alto Networks Product Security Assurance team has evaluated the OpenSSL infinite loop vulnerability (CVE-2022-0778) as it relates to our products. This vulnerability causes the OpenSSL library to enter an infinite loop when parsing an invalid certificate and can result in a Denial-of-Service (DoS) to the application. An attacker does not need a verified certificate to exploit this vulnerability because parsing a bad certificate triggers the infinite loop before the verification process is completed. The Prisma Cloud and Cortex XSOAR products are not impacted by this vulnerability. However, PAN-OS, GlobalProtect app, and Cortex XDR agent software contain a vulnerable version of the OpenSSL library and product availability is impacted by this vulnerability. For PAN-OS software, this includes both hardware and virtual firewalls and Panorama appliances as well as Prisma Access customers. This vulnerability has reduced severity on Cortex XDR agent and GlobalProtect app as successful exploitation requires a meddler-in-the-middle attack (MITM): 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/ S:U/C:N/I:N/A:H). We are working diligently on fixes to remove the vulnerable code from our GlobalProtect app software. All fixed versions of Cortex XDR agent and PAN-OS are now available. This issue impacts the following versions of PAN-OS: PAN-OS 8.1 versions earlier than PAN-OS 8.1.23; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16-h2; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13-h3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5-h1; PAN-OS 10.2 versions earlier than PAN-OS 10.2.1. This issue impacts the following versions of GlobalProtect app: GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.11; GlobalProtect app 5.2 versions earlier than GlobalProtect app 5.2.12 (ETA: month of May, 2022); GlobalProtect app 5.3 versions earlier than GlobalProtect app 5.3.4 (ETA: month of May, 2022); GlobalProtect app 6.0 versions earlier than GlobalProtect app 6.0.1. This issue impacts the following versions and builds of Cortex XDR agent: Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9 hotfix build 6.1.9.61370 on Windows; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.7 hotfix build 6.1.7.1690 on macOS; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.7 hotfix build 6.1.7.60245 on Linux; All versions and builds of Cortex XDR agent 7.4; Cortex XDR agent 7.5-CE versions earlier than Cortex XDR agent 7.5.100-CE hotfix build 7.5.100.60642 on Windows; Cortex XDR agent 7.5-CE versions earlier than Cortex XDR agent 7.5.100-CE hotfix build 7.5.100.2276 on macOS; Cortex XDR agent 7.5-CE versions earlier than Cortex XDR agent 7.5.100-CE hotfix build 7.5.100.59687 on Linux Cortex XDR agent 7.5 versions earlier than Cortex XDR agent 7.5.3 build 7.5.3.60113 on Windows; Cortex XDR agent 7.5 versions earlier than Cortex XDR agent 7.5.3 build 7.5.3.2265 on macOS; Cortex XDR agent 7.5 versions earlier than Cortex XDR agent 7.5.3 build 7.5.3.59465 on Linux; Cortex XDR agent 7.6 versions earlier than Cortex XDR agent 7.6.2 hotfix build 7.6.2.60545 on Windows; Cortex XDR agent 7.6 versions earlier than Cortex XDR agent 7.6.2 hotfix build 7.6.2.2311 on macOS; Cortex XDR agent 7.6 versions earlier than Cortex XDR agent 7.6.2 hotfix build 7.6.2.59612 on Linux; Cortex XDR agent 7.7 versions earlier than Cortex XDR agent 7.7.0 hotfix build 7.7.0.60725 on Windows; Cortex XDR agent 7.7 versions earlier than Cortex XDR agent 7.7.0 hotfix build 7.7.0.2356 on macOS; Cortex XDR agent 7.7 versions earlier than Cortex XDR agent 7.7.0 hotfix build 7.7.0.59559 on Linux. This issue is addressed for Prisma Access customers in the Prisma Access patch rollout that will begin on May 7, 2022 and will be a phased rollout performed based on theaters. Palo Alto Networks will send an additional email notification through Prisma Access Insights one week before the rollout begins for affected tenant(s). Product Status Versions Affected Unaffected Cortex XDR < 7.7.0.60725 on Windows, < >= 7.7.0.60725 on Windows, >= Agent 7.7 7.7.0.2356 on macOS, < 7.7.0.2356 on macOS, >= 7.7.0.59559 on Linux 7.7.0.59559 on Linux Cortex XDR < 7.6.2.60545 on Windows, < >= 7.6.2.60545 on Windows, >= Agent 7.6 7.6.2.2311 on macOS, < 7.6.2.2311 on macOS, >= 7.6.2.59612 on Linux 7.6.2.59612 on Linux Cortex XDR < 7.5.100.60642 on Windows, < >= 7.5.100.60642 on Windows, >= Agent 7.5-CE 7.5.100.2276 on macOS, < 7.5.100.2276 on macOS, >= 7.5.100.59687 on Linux 7.5.100.59687 on Linux Cortex XDR < 7.5.3.60113 on Windows, < >= 7.5.3.60113 on Windows, >= Agent 7.5 7.5.3.2265 on macOS, < 7.5.3.2265 on macOS, >= 7.5.3.59465 on Linux 7.5.3.59465 on Linux Cortex XDR 7.4.* Agent 7.4 Cortex XDR < 6.1.9.61370 on Windows, < >= 6.1.9.61370 on Windows, >= Agent 6.1 6.1.7.1690 on macOS, < 6.1.7.1690 on macOS, >= 6.1.7.60245 on Linux 6.1.7.60245 on Linux Cortex XSOAR None all GlobalProtect < 6.0.1 >= 6.0.1 App 6.0 GlobalProtect < 5.3.4 >= 5.3.4 App 5.3 GlobalProtect < 5.2.12 >= 5.2.12 App 5.2 GlobalProtect < 5.1.11 >= 5.1.11 App 5.1 PAN-OS 10.2 < 10.2.1 >= 10.2.1 PAN-OS 10.1 < 10.1.5-h1 >= 10.1.5-h1 PAN-OS 10.0 < 10.0.10 >= 10.0.10 PAN-OS 9.1 < 9.1.13-h3 >= 9.1.13-h3 PAN-OS 9.0 < 9.0.16-h2 >= 9.0.16-h2 PAN-OS 8.1 < 8.1.23 >= 8.1.23 Prisma Access Preferred, Innovation 3.1 Prisma Access Preferred, Innovation 3.0 Prisma Access Preferred 2.2 Prisma Access Preferred, Innovation 2.1 Prisma Cloud None all Severity: HIGH CVSSv3.1 Base Score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Exploitation Status Palo Alto Networks is not aware of any malicious exploitation of this issue on any of our products. Weakness Type CWE-834 Excessive Iteration Solution This issue is fixed in PAN-OS 8.1.23, PAN-OS 9.0.16-h2, PAN-OS 9.1.13-h3, PAN-OS 10.0.10, PAN-OS 10.1.5-h1, PAN-OS 10.2.1, and all later PAN-OS versions. This issue is fixed in GlobalProtect app 5.1.11 and GlobalProtect app 6.0.1. We intend to fix this issue in the following GlobalProtect app releases: GlobalProtect app 5.2.12, GlobalProtect app 5.3.4. These updates are expected to be available during the month of May, 2022. This issue is fixed in Cortex XDR agent 6.1.9 hotfix build 6.1.9.61370 on Windows, Cortex XDR agent 6.1.7 hotfix build 6.1.7.1690 on macOS, Cortex XDR agent 6.1.7 hotfix build 6.1.7.60245 on Linux, Cortex XDR agent 7.5.100-CE hotfix build 7.5.100.60642 on Windows, Cortex XDR agent 7.5.100-CE hotfix build 7.5.100.2276 on macOS, Cortex XDR agent 7.5.100-CE hotfix build 7.5.100.59687 on Linux, Cortex XDR agent 7.5.3 build 7.5.3.60113 on Windows, Cortex XDR agent 7.5.3 build 7.5.3.2265 on macOS, Cortex XDR agent 7.5.3 build 7.5.3.59465 on Linux, Cortex XDR agent 7.6.2 hotfix build 7.6.2.60545 on Windows, Cortex XDR agent 7.6.2 hotfix build 7.6.2.2311 on macOS, Cortex XDR agent 7.6.2 hotfix build 7.6.2.59612 hotfix on Linux, Cortex XDR agent 7.7.0 hotfix build 7.7.0.60725 on Windows, Cortex XDR agent 7.7.0 hotfix build 7.7.0.2356 on macOS, Cortex XDR agent 7.7.0 hotfix build 7.7.0.59559 on Linux, and all later versions and builds of Cortex XDR agent. Cortex XDR agent 7.4 is end-of-life on May 24, 2022 and is not expected to receive a fix for this issue. This issue is addressed for Prisma Access customers in the Prisma Access patch rollout that will begin on May 7, 2022 and will be a phased rollout performed based on theaters. Palo Alto Networks will send an additional email notification through Prisma Access Insights one week before the rollout begins for affected tenant(s). This advisory will be updated as more fixed version information becomes available for the GlobalProtect app releases. Workarounds and Mitigations Customers with a Threat Prevention subscription can block known attacks for this vulnerability by enabling Threat IDs 92409 and 92411 (Applications and Threats content update 8552). This mitigation reduces the risk of exploitation from known exploits. Customers will need to upgrade their products to a fixed version to completely remove the risk of this issue. Frequently Asked Questions Q. When will fixes for PAN-OS be available? The fix for this issue is available in PAN-OS 8.1.23, PAN-OS 9.0.16-h2, PAN-OS 9.1.13-h3, PAN-OS 10.0.10, PAN-OS 10.1.5-h1, and PAN-OS 10.2.1 versions. All fixed versions of PAN-OS are now available. Q. Are Threat Prevention signatures available for this issue? Customers with a Threat Prevention subscription can block known attacks for this vulnerability by enabling Threat IDs 92409 and 92411 (Applications and Threats content update 8552). This mitigation reduces the risk of exploitation from known exploits. Q. Where can I get the most up-to-date information on product fixes for this issue? This security advisory will be continually updated with the latest fixed version information for all listed Palo Alto Networks products. Q. What will happen to PAN-OS if this issue is encountered? If this issue is encountered in the firewall data plane or management plane, the impacted PAN-OS process will abort and generate crash related debug information. If this issue is encountered repeatedly, there will be a firewall reboot and can result in the denial-of-service to all PAN-OS services. Timeline 2022-05-12 GlobalProtect app fixed version GlobalProtect app 5.1.11 is now available. 2022-05-11 Cortex XDR agent fixes for Cortex XDR agent 6.1 and 7.5-CE are now available. 2022-05-04 GlobalProtect app fixed version GlobalProtect app 6.0.1 is now available. 2022-04-30 Updated fix information for Cortex XDR agent. New fix ETA for Prisma Access customers. 2022-04-27 PAN-OS fixed version PAN-OS 8.1.23 is now available. 2022-04-22 Added new Cortex XDR agent fix ETAs. Updated ETA for PAN-OS 8.1.23 fix. 2022-04-20 Added new GlobalProtect app 5.3 fix ETA. 2022-04-19 PAN-OS fixed version PAN-OS 10.2.1 is now available. 2022-04-15 Added new GlobalProtect app fix ETAs. 2022-04-12 PAN-OS fixed version PAN-OS 10.0.10 is now available. 2022-04-12 PAN-OS fixed version PAN-OS 9.0.16-h2 is now available. 2022-04-07 PAN-OS fixed versions PAN-OS 9.1.13-h3 and PAN-OS 10.1.5-h1 are now available. 2022-04-06 Added new PAN-OS fix ETAs, available threat prevention signatures, and additional FAQ. 2022-03-31 Initial publication Terms of usePrivacyProduct Security Assurance and Vulnerability Disclosure Policy Report vulnerabilitiesManage subscriptions (C) 2020 Palo Alto Networks, Inc. All rights reserved. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYn2fF8kNZI30y1K9AQhayg//Yet7r4ElUFxmEZGaqnGYiL2X4MfFbFkG u41ATm3yPL0wRjYjJi9HShP8fGRymzOF4WMPK4cljyw0sPAMjVoy4WjcVGOzRfFQ mejQReBJmlkJK1Irh0bfxTHEbsQ7Y7NM/+sC3lmDht20oMpOOCRl4S0hA8+UrsTe uJSeVmpFEwHlTlXQK8FN2VBGO5iMskGrLoPGC/3CHEZnRG30PSWV2FHfROgxuQs/ eesMxLQpi4pplTd4b0mhdS8f3Mko0pDbT752ZQ/EbPyiKvsvEZH9hHsJaFRpF54H eMVUczgOpgmhGJGZ0VQ3yJZosZXXxmx9rhJDdO2FGaBBXyUJ2/OG/LXEkQYqwkty RkTtuY7PGLcuv/HMEg3ha8O5B2zg7bJF+kflvaHTXO7jQ2PcYlCMi/jIuphYJji5 uI7uPq7Vi2IHfnS8BGpl1dqgw99EtPFXGUlwn16yRawHtNqnohN1OLum3n9DsTeE mHjhaDIPqfDBJx/TjQ2N1CKKRTaRd8HzNSjZzzr9Y7PQRHE4xQwLnzYcPsHt8mL2 ZKd1TIgt7nj+E+uR35s28BHPLMSn/dFGyqSPPXo+pFIdmSqmYaxSFFDSdh4o4b66 mYfgrEIHxnL9iubI5zUebJpFZ0PVxhvINeGCkd6npX37DuGyiQcuZq21yjpqs/D0 antJj4mHLVI= =xSdQ -----END PGP SIGNATURE-----
2022. május 13.

ESB-2022.2360 - [RedHat] OpenShift Container Platform 4.7.50: CVSS (Max): 7.8

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2360 OpenShift Container Platform 4.7.50 security update 13 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: OpenShift Container Platform 4.7.50 Publisher: Red Hat Operating System: Red Hat Resolution: Patch/Upgrade CVE Names: CVE-2022-25636 CVE-2022-24769 CVE-2022-21496 CVE-2022-21476 CVE-2022-21443 CVE-2022-21434 CVE-2022-21426 CVE-2022-0492 CVE-2021-4083 Original Bulletin: https://access.redhat.com/errata/RHSA-2022:1699 Comment: CVSS (Max): 7.8 CVE-2022-25636 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) CVSS Source: Red Hat Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: OpenShift Container Platform 4.7.50 security update Advisory ID: RHSA-2022:1699-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2022:1699 Issue date: 2022-05-12 CVE Names: CVE-2021-4083 CVE-2022-0492 CVE-2022-21426 CVE-2022-21434 CVE-2022-21443 CVE-2022-21476 CVE-2022-21496 CVE-2022-24769 CVE-2022-25636 ===================================================================== 1. Summary: Red Hat OpenShift Container Platform release 4.7.50 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.7 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.7.50. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHBA-2022:1698 Security Fix(es): * moby: Default inheritable capabilities for linux container should be empty (CVE-2022-24769) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.7 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html 3. Solution: For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.7/updating/updating-cluster-cli.html 4. Bugs fixed (https://bugzilla.redhat.com/): 2066837 - CVE-2022-24769 moby: Default inheritable capabilities for linux container should be empty 2081642 - Placeholder bug for OCP 4.7.0 extras release 5. References: https://access.redhat.com/security/cve/CVE-2021-4083 https://access.redhat.com/security/cve/CVE-2022-0492 https://access.redhat.com/security/cve/CVE-2022-21426 https://access.redhat.com/security/cve/CVE-2022-21434 https://access.redhat.com/security/cve/CVE-2022-21443 https://access.redhat.com/security/cve/CVE-2022-21476 https://access.redhat.com/security/cve/CVE-2022-21496 https://access.redhat.com/security/cve/CVE-2022-24769 https://access.redhat.com/security/cve/CVE-2022-25636 https://access.redhat.com/security/updates/classification/#moderate 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYn2HZ9zjgjWX9erEAQizaQ//T02RdRaOlGM/5yKV3pDL5MWHYhvS+JR9 KRZHFWrTniXAxH7WTKa8Bh01BUBo8q/QSEW1Qy6FsNO7PpQeiu0YXp7bwMX/83RR itLKuWjbaXXcB2Cxr5m1BjkqKLLyCklWoHLpJnnhMnVQz5mFLgWqNGNSxm1b3YKY cSNSQZcNJANvQnW9bhj+gt9oVljhjyz3lKpP/HpRZaZnD5A6NB8bpARyq27+5N1B 8NCDLHHPnWWpj5hE+1KtaTmwFyWhRunh0KFt3m1YhIwW63ABL6zU0sRyaX1H+1fM pzGzIZPA5UG9JhR7rU5y4pQIi1UNH4FNDH9bO7UUdNt7jknAymYC2qMw5IJUcwrn nVQReWMnn/3i7aOQJFg2wHeotruifewhu677yz39C8pqwWJicypCk3hIAd5uL/BR 975zpEdT5jRGHZa8ac6ICxOLR50AFVaI1zFEuBVm+YzDxlqEE08ZBGyCq58uWHof wUSa9UjjEAeyq3yqwmKt8CtiHtNVSAnEYFay8WB4sV7WkfH08w2r0+vcXEm5VS8T znRVYh1AQpt6dIg3+ml+2XM/1fSCD3tbJv/eDw3T0WC7lf/Duf/vlfRq5gXxlmAX NwtQbtXevzBCUhm06I9VzvWoVVlKrkxLWxUbcRLnCuiB+SAli3doh4duCZWyhpv1 RQBEytmSfBM= =fZjG - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYn2e5MkNZI30y1K9AQhOsRAAuaWEwoslnLUS+EeNv5jVA3gQK6MGDD2Q ZvZTQvQSD/F0jy6Hdqt8K1FwcT3m9BE2/NjGynASzeSCcSfkLMSM5lXQAVt3UmdR G/vySaV2GL9+ksLblsXEqVzgQdSOqsE8zqN/NHcHH7NbfIqX8TiRd681hcWojTjs Br3l10/yFLYRiRy5DxdOVzwOpDyCZLeNzk4Ya7nvSZMlDsqdnGkD14Dm83Wp8CCC ov8MgfyQFLULz9Htl5JygT6jzSZ4yb7pAetcRxkr9N7eM+bIacmttujRmxDdPgJ8 2Rb0nXY4/SggrVBAjCgh+wf5fj8GEcrGG4fVdeQxo9ejsLz2psusJL+rj02IKKVY J8F5TrzJAjnCPjLOQD7cyp3VKsFsLIsMM71CK0r2GuX2T8NHJFp3+Scno2vixhxB k4UTMnlRhhwq+Xm675yFBj+gfqzaB7QwYEXs63rnxSDo2eokLLY+WNPhhqck7X+u AFmcRHL0ItSHihRCpp70ekA8v0MOOIi0qSLdgwUoApujbBhCcbi59jTXcN9DWXu7 zM5FvOVZr38kCfHmCTx5TYe7jcybbGCfKdGdPagCejSgPFlFBmpIUFB6+VihX2hP XreDnCGqK2dfkEmmG3OUre6FQQ+1ZorCMbPvAcyKt4WYoxP+TEU/Em0aRNKr2tPi EieBEAYORN8= =Cwv8 -----END PGP SIGNATURE-----
2022. május 13.

ESB-2022.2359 - [Appliance] Delta Electronics CNCSoft: CVSS (Max): 7.8

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2359 Advisory (icsa-22-132-01) Delta Electronics CNCSoft 13 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Delta Electronics CNCSoft Publisher: ICS-CERT Operating System: Network Appliance Resolution: Patch/Upgrade CVE Names: CVE-2022-1405 CVE-2022-1404 Original Bulletin: https://us-cert.cisa.gov/ics/advisories/icsa-22-132-01 Comment: CVSS (Max): 7.8 CVE-2022-1405 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) CVSS Source: ICS-CERT Calculator: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- ICS Advisory (ICSA-22-132-01) Delta Electronics CNCSoft Original release date: May 12, 2022 Legal Notice All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/ . 1. EXECUTIVE SUMMARY o CVSS v3 7.8 o ATTENTION: Low attack complexity o Vendor: Delta Electronics o Equipment: CNCSoft o Vulnerabilities: Stack-based Buffer Overflow, Out-of-bounds Read 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow arbitrary code execution or information disclosure. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of CNCSoft, a software management platform, are affected: o CNCSoft: All versions prior to 1.01.32 3.2 VULNERABILITY OVERVIEW 3.2.1 STACK-BASED BUFFER OVERFLOW CWE-121 The affected product does not properly sanitize input while processing a specific project file, allowing a possible stack-based buffer overflow condition. CVE-2022-1405 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:N/UI:R/S:U/ C:H/I:H/A:H ). 3.2.2 OUT-OF-BOUNDS READ CWE-125 The affected product does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds read condition. CVE-2022-1404 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:N/UI:R/S:U/ C:L/I:N/A:N ). 3.3 BACKGROUND o CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing o COUNTRIES/AREAS DEPLOYED: Worldwide o COMPANY HEADQUARTERS LOCATION: Taiwan 3.4 RESEARCHER An anonymous researcher working with Trend Micro Zero Day Initiative reported these vulnerabilities to CISA. 4. MITIGATIONS Delta Electronics has released an updated version of CNCSoft and recommends users update to v1.01.32 or later . CISA recommends users take the following measures to protect themselves from social engineering attacks: o Only use project files from trusted sources. o Do not click web links or open unsolicited attachments in email messages. o Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. o Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents. No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely. For any questions related to this report, please contact the CISA at: Email: CISAservicedesk@cisa.dhs.gov Toll Free: 1-888-282-0870 CISA continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYn2SnskNZI30y1K9AQhoug/7BQm3+1omm4s8FfpMyzkRCtGMs4x7abSI eUCgQJwtrtFuTLEwvQyueX3hlj6QseN6ur3GQZHVSoNTxQxkRr9UE9c0JeobYWKl Z/M+XNg0qlvq+TojpsrIJJIRA2GJi70rsdI4JPaaAm8xqLxVAQUGLKwZLD7+UnkQ OTHD+ALEi85nwsBNsjA1O04EL3ZY2/CRxPMP1IgHSxRXwJPkXQ/0N3JOi4KEfHBO /XNALhc2/tX1ROCmupLA/MMiC6ce+KUwL9u3rISVKvJQs2PlF9JQi+jwqgygfdqk bf0ZYJhlDn7fgiVyfWDK6bTowULF9FpGjR4VRTvRGuUcYMBV40XlYy/Nna8FmmgP qPLHEmLdZz0aapWo54Rn/wJQK4eMdwAHDgL6TE4alMwkqbhUjgjy2O81n6RRS/J5 aMU/QRL9SSFugPlygPR41KgNWdGwTk4drTWioeQ6pBclJB7n2/D03ZwmqH1w0399 zT+J2hKaE3kPYMfgUsEzsM3XsUgYY+XTjIK0yg1frsufsb0lzZccPF4L6S8w7ds7 HSiryTqKwFN+a8CL7erLkCBUTkxlxobO/5ZPbCNQfQNBJYAoQf69tvPMUN1AJsyq PxyqhJx6xUNc9j18GvAebeG7hJvWKKjPWSgOVO9p+EsO1v2Sh09jNefNwRA14XF/ Ak/oIA2pi9k= =BFKP -----END PGP SIGNATURE-----
2022. május 13.

ESB-2022.2358 - [Appliance] Siemens Industrial Products with OPC UA: CVSS (Max): 6.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.2358 Advisory (icsa-22-132-08) Siemens Industrial Products with OPC UA 13 May 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Siemens Industrial Products with OPC UA Publisher: ICS-CERT Operating System: Network Appliance Resolution: Patch/Upgrade CVE Names: CVE-2021-45117 Original Bulletin: https://us-cert.cisa.gov/ics/advisories/icsa-22-132-08 Comment: CVSS (Max): 6.5 CVE-2021-45117 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) CVSS Source: ICS-CERT Calculator: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- ICS Advisory (ICSA-22-132-08) Siemens Industrial Products with OPC UA Original release date: May 12, 2022 Legal Notice All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/ . 1. EXECUTIVE SUMMARY o CVSS v3 6.5 o ATTENTION: Exploitable remotely/low attack complexity o Vendor: Siemens o Equipment: SIMATIC NET PC, SITOP Manager, TeleControl Server Basic o Vulnerability: Null Pointer Dereference 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the device by sending uncertain status code in a response message. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Siemens industrial products are affected: o SIMATIC NET PC Software v14: All versions prior to 14 SP1 Update 14 o SIMATIC NET PC Software v15: All versions o SIMATIC NET PC Software v16: All versions o SIMATIC NET PC Software v17: All versions prior to 17 SP1 o SITOP Manager: All versions o TeleControl Server Basic v3: All versions 3.2 VULNERABILITY OVERVIEW 3.2.1 NULL POINTER DEREFERENCE CWE-476 The OPC UA ANSIC stack (also called Legacy C-stack) was reported to crash when an unexpected OPC UA response message status code was accessed via the synchronous Client API. The vulnerability was found in generated code of the OPC Foundation C-stack. An unexpected status code in response messages will result in null pointer dereference, leading to a ping-of-death crash. This affects a client, but it might also affect a server when it uses OpcUa_ClientApi_RegisterServer (e.g., register at Local Discovery Server). A specially crafted UA server or machine-in-the-middle attacker can cause the OPC UA application to crash by sending uncertain status code in response messages. CVE-2021-45117 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:R/S:U/ C:N/I:N/A:H ). 3.3 BACKGROUND o CRITICAL INFRASTRUCTURE SECTORS: Multiple Sectors o COUNTRIES/AREAS DEPLOYED: Worldwide o COMPANY HEADQUARTERS LOCATION: Germany 3.4 RESEARCHER Siemens reported this vulnerability to CISA. 4. MITIGATIONS Siemens has recommended the following: o SIMATIC NET PC Software v14, update to v14 SP1 Update 14 or later o SIMATIC NET PC Software v15, no fix is currently planned o SIMATIC NET PC Software v16, currently no fix is planned o SIMATIC NET PC Software v17, update to v17 SP1 or later o SITOP Manager, no fix is currently planned o TeleControl Server Basic, no fix is currently planned Siemens has identified the following specific workarounds and mitigations to reduce risk: o Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners. o Use VPN for protecting network communication between cells. As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens' operational guidelines for industrial security and following the recommendations in the product manuals. For additional information, please refer to Siemens Security Advisory SSA-285795 CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents. No known public exploits specifically target this vulnerability. For any questions related to this report, please contact the CISA at: Email: CISAservicedesk@cisa.dhs.gov Toll Free: 1-888-282-0870 CISA continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYn2SmMkNZI30y1K9AQgIgQ/+Kd7PmfKmcDBgYl/yydcgKh+hXYkhy2QF +qiaI5xrpwdRJDgBubgWxyk+4Qq+Vd69SxaUYyZNmWbk2IB9wYCTRZ2cTs/6OnDT B2wXEsLYVu72aYfyFfKJZTLQwQy2IoPffLbWOWewQJyLwwYMjxcS/l3qUcdmsmAo crf13E5A3/DDgSk7bOCqtizcY8rYq4vP/2jBFE6AYMM1jnUhRa1+mLGB2X8ZIcWY 9zPUXv2Rn5sT87KNstdsT6P5vNqsa3wKUax6LkrJ2/ma0412SBGGqCW9eVj2jdhQ 29SWjamdS09d3HBRXnIKKFXMv9qR04cM25o12Z1GN0elacN7MIgMuknoDa3e1ukq cSjZgnLVmN271GZlrGKcEy63ajiYBvs2rnJ7YLrhGrAskUYUyJRxkY0p38m1shsi acEK3j5D4lMHFA8VYjsyfK9PlY7dX9yJ1dyRU6Vz8Q6obBtzg3jS9YbY9ATIKKN6 iz5IL5dsLmlu4S+/4S9skPLdN+ibftwPy+Czji7zJN/Jz43oPGZXNaq1ACjXH7wp wPlyJhxj47H6RgncMuZZHgPBDSplzAAfkP3R5ij6h8h7X0k+tQG8zEY4e+EBMstp evzpvNxWMxKcqNBw7keblJt48iXwiA9OejEaHJKJKARN2r2xoN4ACYPPAYnRiHb8 32YhKTDgPPM= =JYaN -----END PGP SIGNATURE-----