- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2025:0673: git-lfs security update (Important)
by AlmaLinux Errata Notifications 25 Jan '25

25 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2025-01-24 Summary: Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2025-0673.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0422: java-17-openjdk security update for AlmaLinux 8.6, 8.8, 8.10, 9.4 and 9.5 (Moderate)
by AlmaLinux Errata Notifications 25 Jan '25

25 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2025-01-23 Summary: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance array handling (CVE-2025-21502) Bug Fix(es): * The AlmaLinux OpenJDK packages rely on the copy-jdk-configs package to transfer configuration files to a new updated JDK. With this update, the JDK has been updated to use the latest version of copy-jdk-configs, which has been used for some years on later AlmaLinux versions (AlmaLinux-73867, AlmaLinux-73871, AlmaLinux-73872). For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2025-0422.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0595: redis:6 security update (Important)
by AlmaLinux Errata Notifications 23 Jan '25

23 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2025-01-22 Summary: Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log. Security Fix(es): * redis: Integer overflow in the Redis HRANDFIELD and ZRANDMEMBER commands may lead to denial-of-service (CVE-2023-22458) * redis: Integer overflow in the Redis SETRANGE and SORT/SORT_RO commands may result with false OOM panic (CVE-2022-35977) * redis: Specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can trigger an integer overflow (CVE-2022-36021) * redis: String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack (CVE-2023-25155) * redis: Insufficient validation of HINCRBYFLOAT command (CVE-2023-28856) * redis: heap overflow in the lua cjson and cmsgpack libraries (CVE-2022-24834) * redis: possible bypass of Unix socket permissions on startup (CVE-2023-45145) * redis: Lua library commands may lead to stack overflow and RCE in Redis (CVE-2024-31449) * redis: Denial-of-service due to unbounded pattern matching in Redis (CVE-2024-31228) * redis: Redis' Lua library commands may lead to remote code execution (CVE-2024-46981) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-0595.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:4567: java-11-openjdk security update (Important)
by AlmaLinux Errata Notifications 21 Jan '25

21 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2024-07-26 Summary: The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-4567.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

2 1

[Security Advisory] ALSA-2025:0401: grafana security update (Important)
by AlmaLinux Errata Notifications 20 Jan '25

20 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2025-01-20 Summary: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * go-git: argument injection via the URL field (CVE-2025-21613) * go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVE-2025-21614) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-0401.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0334: ipa security update (Moderate)
by AlmaLinux Errata Notifications 18 Jan '25

18 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2025-01-17 Summary: AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeipa: Administrative user data leaked through systemd journal (CVE-2024-11029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2025-0334.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0381: .NET 8.0 security update (Important)
by AlmaLinux Errata Notifications 18 Jan '25

18 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2025-01-17 Summary: .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.112 and .NET Runtime 8.0.1.12. Security Fix(es): * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172) * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173) * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173) * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176) * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-0381.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0377: Security and bug fixes for NetworkManager (Moderate)
by AlmaLinux Errata Notifications 18 Jan '25

18 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2025-01-17 Summary: NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security and bug fix(es): * Routes in table different to main are not deleted on reapply [almalinux-9.5.z] (JIRA:AlmaLinux-73013) * Route to VPN server not stored in routing table that is specified by ipv4.route-table [almalinux-9.5.z] (JIRA:AlmaLinux-73166) * VPN connections do not support ipv4.routing-rules settings [almalinux-9.5.z] (JIRA:AlmaLinux-73167) * CVE-2024-3661 NetworkManager: DHCP routing options can manipulate interface-based VPN traffic [almalinux-9.5.z] (JIRA:AlmaLinux-64726) Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2025-0377.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:0382: .NET 9.0 security update (Important)
by AlmaLinux Errata Notifications 18 Jan '25

18 Jan '25

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2025-01-17 Summary: .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.102 and .NET Runtime 9.0.1. Security Fix(es): * dotnet: .NET Remote Code Execution Vulnerability (CVE-2025-21171) * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172) * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173) * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173) * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176) * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172) * dotnet: .NET Remote Code Execution Vulnerability (CVE-2025-21171) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-0382.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

Rsync Vulnerabilities - Patching Status
by Jonathan Wright 17 Jan '25

17 Jan '25

Hello community, Security researchers at Google, namely Pedro Gallegos, Simon Scannell, and Jasiel Spelman, identified vulnerabilities in both the rsync server and client. These vulnerabilities range from extremely concerning to just annoying, and are at different stages of being patched. This blog post will be updated as patches are released by us. The Announcement The server vulnerabilities (CVE-2024-12084 <https://access.redhat.com/security/cve/CVE-2024-12084> and CVE-2024-12085 <https://access.redhat.com/security/cve/CVE-2024-12085>) can lead to remote code execution (RCE). On the client side, vulnerabilities allow a malicious server to read arbitrary files (CVE-2024-12086 <https://access.redhat.com/security/cve/CVE-2024-12086>), create unsafe symlinks (CVE-2024-12087 <https://access.redhat.com/security/cve/CVE-2024-12087>), and, under certain conditions, overwrite arbitrary files (CVE-2024-12088 <https://access.redhat.com/security/cve/CVE-2024-12088>). Additionally, during the coordinated response to these issues, Aleksei Gorban reported a sixth vulnerability (CVE-2024-12747 <https://access.redhat.com/security/cve/CVE-2024-12747>) related to how the rsync server manages symlinks. These vulnerabilities were responsibly disclosed to us through the CERT/CC Vulnerability Notes Database, ahead of the public disclosure <https://www.kb.cert.org/vuls/id/952657> on January 14, 2025. Impact and Mitigation:AlmaLinux OS 8 & AlmaLinux OS 9 AlmaLinux 8 and AlmaLinux 9 are vulnerable only to 5 of the 6 CVEs (CVE-2024-12085, CVE-2024-12086, CVE-2024-12087, CVE-2024-12088, and CVE-2024-12747). Red Hat has released patches addressing only CVE-2024-12085. That was promptly released for AlmaLinux 8 <https://errata.almalinux.org/8/ALSA-2025-0325.html> and AlmaLinux 9 <https://errata.almalinux.org/9/ALSA-2025-0324.html> as part of our normal patch and release workflow. We have also prepared packages with patches for the remaining vulnerabilities from upstream Rsync, but ALESCo is still discussing releasing those patches if Red Hat does not patch them. If these patches are important to you and your rsync use-cases please let ALESCo know in the ALESCo room on the AlmaLinux community chat <https://chat.almalinux.org/almalinux/channels/alesco>! Vulnerabilitiy Status - CVE-2024-12084 - Not Affected on AlmaLinux 8 or 9 - CVE-2024-12085 - Patched on AlmaLinux 8 and 9 - CVE-2024-12086 - Vulnerable on AlmaLinux 8 and 9 - CVE-2024-12087 - Vulnerable on AlmaLinux 8 and 9 - CVE-2024-12088 - Vulnerable on AlmaLinux 8 and 9 - CVE-2024-12747 - Vulnerable on AlmaLinux 8 and 9 Patched Packages (CVE-2024-12085) - rsync-3.1.3-20.el8_10.x86_64.rpm - rsync-3.1.3-20.el8_10.aarch64.rpm - rsync-3.1.3-20.el8_10.ppc64le.rpm - rsync-3.1.3-20.el8_10.s390x.rpm - rsync-daemon-3.1.3-20.el8_10.x86_64.rpm - rsync-daemon-3.1.3-20.el8_10.aarch64.rpm - rsync-daemon-3.1.3-20.el8_10.ppc64le.rpm - rsync-daemon-3.1.3-20.el8_10.s390x.rpm - rsync-3.2.3-20.el9_5.1.x86_64.rpm - rsync-3.2.3-20.el9_5.1.aarch64.rpm - rsync-3.2.3-20.el9_5.1.ppc64le.rpm - rsync-3.2.3-20.el9_5.1.s390x.rpm - rsync-daemon-3.2.3-20.el9_5.1.x86_64.rpm - rsync-daemon-3.2.3-20.el9_5.1.aarch64.rpm - rsync-daemon-3.2.3-20.el9_5.1.ppc64le.rpm - rsync-daemon-3.2.3-20.el9_5.1.s390x.rpm AlmaLinux OS Kitten 10 On January 14, 2025 we released an updated package for AlmaLinux OS Kitten 10 addressing all six vulnerabilities without waiting for patches to be included in CentOS Stream 10. If Red Hat chooses to only patch some of the vulnerabilities we will carry patches for all of the vulnerabilities within AlmaLinux Kitten 10 (which would be a deviation from Red Hat). Vulnerabilitiy Status - CVE-2024-12084 - Patched on AlmaLinux OS Kitten 10 - CVE-2024-12085 - Patched on AlmaLinux OS Kitten 10 - CVE-2024-12086 - Patched on AlmaLinux OS Kitten 10 - CVE-2024-12087 - Patched on AlmaLinux OS Kitten 10 - CVE-2024-12088 - Patched on AlmaLinux OS Kitten 10 - CVE-2024-12747 - Patched on AlmaLinux OS Kitten 10 Patched Packages - rsync-3.3.0-6.el10.alma.1.x86_64.rpm - rsync-3.3.0-6.el10.alma.1.x86_64_v2.rpm - rsync-3.3.0-6.el10.alma.1.aarch64.rpm - rsync-3.3.0-6.el10.alma.1.ppc64le.rpm - rsync-3.3.0-6.el10.alma.1.s390x.rpm - rsync-daemon-3.3.0-6.el10.alma.1.x86_64.rpm - rsync-daemon-3.3.0-6.el10.alma.1.x86_64_v2.rpm - rsync-daemon-3.3.0-6.el10.alma.1.aarch64.rpm - rsync-daemon-3.3.0-6.el10.alma.1.ppc64le.rpm - rsync-daemon-3.3.0-6.el10.alma.1.s390x.rpm AlmaLinx rsync Backport Package AlmaLinux maintains an optional Rsync package that is primarily used by AlmaLinux Mirror maintainers to allow for additional functionality and performance enhancements and is suggested for our mirrors <https://lists.almalinux.org/hyperkitty/list/mirror-announce@lists.almalinux…> . On January 14 we released updates for these backported rsync RPMs. rsync from this backport repo was at version 3.3.0, and we updated the repo to 3.4.0 and subsequently 3.4.1, as the updates were released upstream. Vulnerabilitiy Status - CVE-2024-12084 - Patched in rsync Backport Package - CVE-2024-12085 - Patched in rsync Backport Package - CVE-2024-12086 - Patched in rsync Backport Package - CVE-2024-12087 - Patched in rsync Backport Package - CVE-2024-12088 - Patched in rsync Backport Package - CVE-2024-12747 - Patched in rsync Backport Package Patched Packages - rsync-3.4.0-1.el8.x86_64.rpm (regressions fixed in rsync-3.4.1-1.el8.x86_64.rpm) - rsync-3.4.0-1.el9.x86_64.rpm (regressions fixed in rsync-3.4.1-1.el9.x86_64.rpm) - rsync-3.4.0-1.el8.aarch64.rpm (regressions fixed in rsync-3.4.1-1.el8.aarch64.rpm) - rsync-3.4.0-1.el9.aarch64.rpm (regressions fixed in rsync-3.4.1-1.el9.aarch64.rpm) - rsync-daemon-3.4.0-1.el8.x86_64.rpm (regressions fixed in rsync-daemon-3.4.1-1.el8.x86_64.rpm) - rsync-daemon-3.4.0-1.el9.x86_64.rpm (regressions fixed in rsync-daemon-3.4.1-1.el9.x86_64.rpm) - rsync-daemon-3.4.0-1.el8.aarch64.rpm (regressions fixed in rsync-daemon-3.4.1-1.el8.aarch64.rpm) - rsync-daemon-3.4.0-1.el9.aarch64.rpm (regressions fixed in rsync-daemon-3.4.1-1.el9.aarch64.rpm) Further updates We will update this blog post as future updates are available. Please also sign up for the AlmaLinux Announce mailing list <https://lists.almalinux.org/mailman3/lists/announce.lists.almalinux.org/> to make sure you don’t miss any updates. If you have any questions or concerns, feel free to reach out in our community chat <https://chat.almalinux.org>! -- Jonathan Wright AlmaLinux Foundation Mattermost: chat <https://chat.almalinux.org/almalinux/messages/@jonathan>

1 0