- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2024:0310: openssl security update (Moderate)
by AlmaLinux Errata Notifications 22 Jan '24

22 Jan '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2024-01-22 Summary: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: Incorrect cipher key and IV length processing (CVE-2023-5363) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-0310.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0249: java-21-openjdk security update (Important)
by AlmaLinux Errata Notifications 20 Jan '24

20 Jan '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2024-01-20 Summary: The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-0249.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0266: java-11-openjdk security update (Important)
by AlmaLinux Errata Notifications 20 Jan '24

20 Jan '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2024-01-20 Summary: The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-0266.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0265: java-1.8.0-openjdk security and bug fix update (Important)
by AlmaLinux Errata Notifications 20 Jan '24

20 Jan '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2024-01-20 Summary: The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * In the previous release in October 2023 (8u392), the RPMs on AlmaLinux 8 were changed to use Provides for java, jre, java-headless, jre-headless, java-devel and java-sdk which included the full RPM version. This prevented the Provides being used to resolve a dependency on Java 1.8.0 (for example, "Requires: java-headless 1:1.8.0"). This change has now been reverted to the old "1:1.8.0" value. (AlmaLinux-19636, AlmaLinux-19637) Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-0265.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0267: java-17-openjdk security and bug fix update (Important)
by AlmaLinux Errata Notifications 20 Jan '24

20 Jan '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2024-01-20 Summary: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: incorrect handling of ZIP files with duplicate entries (8276123) (CVE-2024-20932) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * When Transparent Huge Pages (THP) are unconditionally enabled on a system, Java applications using many threads were found to have a large Resident Set Size (RSS). This was due to a race between the kernel transforming thread stack memory into huge pages and the Java Virtual Machine (JVM) shattering these pages into smaller ones when adding a guard page. This release resolves this issue by getting glibc to insert a guard page and prevent the creation of huge pages. (AlmaLinux-13930, AlmaLinux-13931, AlmaLinux-13934, AlmaLinux-13935) Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-0267.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0248: java-21-openjdk security update (Important)
by AlmaLinux Errata Notifications 20 Jan '24

20 Jan '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2024-01-20 Summary: The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-0248.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0113: kernel security update (Important)
by AlmaLinux Errata Notifications 17 Jan '24

17 Jan '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2024-01-17 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: use after free in unix_stream_sendpage (CVE-2023-4622) * kernel: vmwgfx: reference count issue leads to use-after-free in surface handling (CVE-2023-5633) * kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753) * Kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162) * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Backport OVS l4 Symmetric Hashing to almalinux-8 (JIRA:AlmaLinux-12746) * Unbounded memory usage by TCP for receive buffers (JIRA:AlmaLinux-15096) * various kind of guests freeze on rhel 8.8 (JIRA:AlmaLinux-15121) * AlmaLinux 8: netfilter: conntrack: Fix gre tunneling over ipv6 (JIRA:AlmaLinux-15259) * NFSv4.1 needs to handle ENOENT error from GETDEVICEINFO (JIRA:AlmaLinux-16407) * DM multipath showing failed path for an nvme-o-FC LUN when performing I/O operations (JIRA:AlmaLinux-14718) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-0113.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0114: python3 security update (Moderate)
by AlmaLinux Errata Notifications 17 Jan '24

17 Jan '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2024-01-16 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: use after free in heappushpop() of heapq module (CVE-2022-48560) * python: DoS when processing malformed Apple Property List files in binary format (CVE-2022-48564) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-0114.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0253: sqlite security update (Moderate)
by AlmaLinux Errata Notifications 17 Jan '24

17 Jan '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2024-01-16 Summary: SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Security Fix(es): * sqlite: heap-buffer-overflow at sessionfuzz (CVE-2023-7104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-0253.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0116: python-urllib3 security update (Moderate)
by AlmaLinux Errata Notifications 17 Jan '24

17 Jan '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2024-01-16 Summary: The python-urllib3 package provides the Python HTTP module with connection pooling and file POST abilities. Security Fix(es): * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804) * urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-0116.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0