- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2023:6402: containernetworking-plugins security and bug fix update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted. Security Fix(es): * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540) * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723) * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724) * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725) * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538) * golang: html/template: improper sanitization of CSS values (CVE-2023-24539) * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400) * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6402.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6420: grafana security and enhancement update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: persistent xss in grafana core plugins (CVE-2022-23552) * grafana: plugin signature bypass (CVE-2022-31123) * grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins (CVE-2022-31130) * grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins (CVE-2022-39201) * grafana: email addresses and usernames cannot be trusted (CVE-2022-39306) * grafana: User enumeration via forget password (CVE-2022-39307) * grafana: Spoofing of the originalUrl parameter of snapshots (CVE-2022-39324) * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717) * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6420.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6380: runc security update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. Security Fix(es): * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724) * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809) * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561) * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration (CVE-2023-28642) * runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration (CVE-2021-43784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6380.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6365: mod_auth_openidc security and bug fix update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527) * mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is supplied (CVE-2023-28625) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6365.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6341: xorg-x11-server-Xwayland security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: Xwayland is an X server for running X clients under Wayland. The following packages have been upgraded to a later upstream version: xorg-x11-server-Xwayland (22.1.9). (BZ#2158761) Security Fix(es): * xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability (CVE-2023-1393) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6341.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

Announcing AlmaLinux Day Tokyo
by benny Vasquez 13 Nov '23

13 Nov '23

Hi all! While the Core SIG <https://wiki.almalinux.org/sigs/Core.html> and Infrastructure SIG <https://wiki.almalinux.org/sigs/Infrastructure.html> have been hard at work bringing us AlmaLinux 9.3 <https://github.com/AlmaLinux/almalinux.org/blob/master/blog/2023-11-13-anno…> (and prepping AlmaLinux 8.9 <https://almalinux.org/blog/2023-11-02-announcing-89-beta/> for next week), the Marketing SIG <https://wiki.almalinux.org/sigs/Marketing.html> has been working on another exciting announcement: an event focused entirely on AlmaLinux. Already in? Reserve your spot at AlmaLinux Day Tokyo now! <https://github.com/AlmaLinux/almalinux.org/blob/master/aldt-2023> Announcing AlmaLinux Day Tokyo <https://github.com/AlmaLinux/almalinux.org/blob/master/content/blog/2023-11…> AlmaLinux Day Tokyo on December 9th, is an exciting event dedicated to all things AlmaLinux! Our team will be at the beautiful Internet Initiative, along with 150 new friends to talk about the current state and future of AlmaLinux. Alongside me, you can expect special apparencies by Igor Seletskiy, the man who got us started, and Yohei Suzuki from Cybertrust Japan, discussing the status of the industry and all the things we're excited to share. AlmaLinux Day Tokyo is also scheduled just a few days after Open Source Summit Japan <https://events.linuxfoundation.org/open-source-summit-japan/>, making it easy for anyone already attending OSSJ to join us for AlmaLinux Day, too! The Schedule <https://github.com/AlmaLinux/almalinux.org/blob/master/content/blog/2023-11…> Opening talks begin at 13:00 local time, along with several others who have had an active hand in contributing to the success of AlmaLinux. We have amazing things to share! See the full schedule with all of its updates on the AlmaLinux Day Tokyo 2023 <https://github.com/AlmaLinux/almalinux.org/blob/master/aldt-2023> page, and make sure to register to save your seat! Can't make it? <https://github.com/AlmaLinux/almalinux.org/blob/master/content/blog/2023-11…> That's OK! All the talks will be recorded and posted to our YouTube channel <https://www.youtube.com/@almalinux6891>. Keep an eye on our channel after the event! We will also be announcing two more events in 2024, so keep an eye out for an event near you! Tokyo is an amazing city, and I am so grateful to Cybertrust Japan and all of our users in Japan for welcoming us. Can't wait to see you all there! benny Vasquez Chair, Board of Directors @AlmaLinux OS Foundation *I am sending this message now because it suits me, but I don’t expect that you will read, respond to, or act on it outside of comfortable hours for your time zone.*

1 0

Resend: AlmaLinux 9.3 Stable now available!
by benny Vasquez 13 Nov '23

13 Nov '23

Sending again due to a problem with our mailing lists. Sorry for those of you who get a duplicate! Hi all! The AlmaLinux OS Foundation is proud to announce the general availability of AlmaLinux OS 9.3 <https://mirrors.almalinux.org/isos.html> codenamed "Shamrock Pampas Cat"! Installation ISOs are available on the mirrors now for all 4 architectures: - Intel/AMD (x86_64) <https://mirrors.almalinux.org/isos/x86_64/9.3.html> - ARM64 (aarch64) <https://mirrors.almalinux.org/isos/aarch64/9.3.html> - IBM PowerPC (ppc64le) <https://mirrors.almalinux.org/isos/ppc64le/9.3.html> - IBM Z (s390x) <https://mirrors.almalinux.org/isos/s390x/9.3.html> Torrents are available as well at: - Intel/AMD (x86_64) <https://repo.almalinux.org/almalinux/9.3/isos/x86_64/AlmaLinux-9.3-x86_64.t…> - ARM64 (aarch64) <https://repo.almalinux.org/almalinux/9.3/isos/aarch64/AlmaLinux-9.3-aarch64…> - IBM PowerPC (ppc64le) <https://repo.almalinux.org/almalinux/9.3/isos/ppc64le/AlmaLinux-9.3-ppc64le…> - IBM Z (s390x) <https://repo.almalinux.org/almalinux/9.3/isos/s390x/AlmaLinux-9.3-s390x.tor…> ISOs, Live Images, Cloud and Containers <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> AlmaLinux also offers a variety of Cloud, Container, and Live Images. The builds for these get kicked off as soon as the public repository is ready. *The following images are expected to be available shortly.* We will post a separate "Images Update" announcement soon, to keep the community informed. - Docker <https://wiki.almalinux.org/containers/docker-images.html#about-almalinux-do…> images including Platform and UBIs alternatives. We provide a wide variety of containers for your use. Please see our Docker Official Image <https://hub.docker.com/_/almalinux> as well as all AlmaLinux images <https://hub.docker.com/u/almalinux>. - LXC/LXD <https://images.linuxcontainers.org/images/almalinux/> - Live Media <https://wiki.almalinux.org/LiveMedia.html> for GNOME, GNOME-mini, KDE, XFCE, MATE and more. - Cloud Images - AWS AMIs <https://wiki.almalinux.org/cloud/AWS.html> for x86_64 and Graviton Instances - Azure <https://wiki.almalinux.org/cloud/Azure.html> Images for in standard and HPC flavors for x86_64 and aarch64 - Google Cloud <https://wiki.almalinux.org/cloud/Google.html> - Generic Cloud/Cloud-init <https://wiki.almalinux.org/cloud/Generic-cloud-on-local.html> for all 4 architectures - Open Nebula <https://wiki.almalinux.org/cloud/OpenNebula.html> for all 4 architectures - Oracle Cloud Infrastructure <https://wiki.almalinux.org/cloud/OCI.html> for x86_64 and aarch64 - Vagrant Boxes <https://app.vagrantup.com/almalinux>: - Libvirt - VirtualBox - Hyper-V - VMWare - Parallels - Raspberry Pi <https://wiki.almalinux.org/documentation/raspberry-pi.html> - Windows Subsystem for Linux <https://wiki.almalinux.org/documentation/wsl.html> Release Notes and More Information <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> AlmaLinux 9.3 aims to improve flexibility and reliability, as well as to enhance security across hybrid environments. This release continues simplifying automation and system management. Web console enhancements simplify management tasks. Additionally, users can configure health check actions for Podman containers and vsock devices in virtual machines. Application Streams updates provide developers with flexibility and customization options without affecting the platform's stability. The 9.3 offers enhanced security and compliance. Additionally, it provides enhanced flexibility, stability, and reliability needed to support hybrid cloud innovation. You can read more about this release by checking out the Release Notes <https://wiki.almalinux.org/release-notes/9.3.html>. Join us on Mastodon! <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> Have you jumped on Mastodon yet? Follow us! @almalinux@fosstodon.org <https://fosstodon.org/@almalinux> Pitch In <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> Join us in the AlmaLinux Community Chat <https://chat.almalinux.org/> to get any assistance you need and help others. You can also post a question on our 9.3 Forum <https://almalinux.discourse.group/c/devel/36-category/36>, on our AlmaLinux Community on Reddit <https://reddit.com/r/almalinux>, or catch us on Twitter <https://twitter.com/almalinux>. Please report any bugs you may see on the Bug Tracker <https://bugs.almalinux.org/>. Enjoy the release and have fun! benny Vasquez Chair, Board of Directors @AlmaLinux OS Foundation *I am sending this message now because it suits me, but I don’t expect that you will read, respond to, or act on it outside of comfortable hours for your time zone.*

1 0

AlmaLinux 9.3 Stable now available!
by benny Vasquez 13 Nov '23

13 Nov '23

Hi all! The AlmaLinux OS Foundation is proud to announce the general availability of AlmaLinux OS 9.3 <https://mirrors.almalinux.org/isos.html> codenamed "Shamrock Pampas Cat"! Installation ISOs are available on the mirrors now for all 4 architectures: - Intel/AMD (x86_64) <https://mirrors.almalinux.org/isos/x86_64/9.3.html> - ARM64 (aarch64) <https://mirrors.almalinux.org/isos/aarch64/9.3.html> - IBM PowerPC (ppc64le) <https://mirrors.almalinux.org/isos/ppc64le/9.3.html> - IBM Z (s390x) <https://mirrors.almalinux.org/isos/s390x/9.3.html> Torrents are available as well at: - Intel/AMD (x86_64) <https://repo.almalinux.org/almalinux/9.3/isos/x86_64/AlmaLinux-9.3-x86_64.t…> - ARM64 (aarch64) <https://repo.almalinux.org/almalinux/9.3/isos/aarch64/AlmaLinux-9.3-aarch64…> - IBM PowerPC (ppc64le) <https://repo.almalinux.org/almalinux/9.3/isos/ppc64le/AlmaLinux-9.3-ppc64le…> - IBM Z (s390x) <https://repo.almalinux.org/almalinux/9.3/isos/s390x/AlmaLinux-9.3-s390x.tor…> ISOs, Live Images, Cloud and Containers <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> AlmaLinux also offers a variety of Cloud, Container, and Live Images. The builds for these get kicked off as soon as the public repository is ready. *The following images are expected to be available shortly.* We will post a separate "Images Update" announcement soon, to keep the community informed. - Docker <https://wiki.almalinux.org/containers/docker-images.html#about-almalinux-do…> images including Platform and UBIs alternatives. We provide a wide variety of containers for your use. Please see our Docker Official Image <https://hub.docker.com/_/almalinux> as well as all AlmaLinux images <https://hub.docker.com/u/almalinux>. - LXC/LXD <https://images.linuxcontainers.org/images/almalinux/> - Live Media <https://wiki.almalinux.org/LiveMedia.html> for GNOME, GNOME-mini, KDE, XFCE, MATE and more. - Cloud Images - AWS AMIs <https://wiki.almalinux.org/cloud/AWS.html> for x86_64 and Graviton Instances - Azure <https://wiki.almalinux.org/cloud/Azure.html> Images for in standard and HPC flavors for x86_64 and aarch64 - Google Cloud <https://wiki.almalinux.org/cloud/Google.html> - Generic Cloud/Cloud-init <https://wiki.almalinux.org/cloud/Generic-cloud-on-local.html> for all 4 architectures - Open Nebula <https://wiki.almalinux.org/cloud/OpenNebula.html> for all 4 architectures - Oracle Cloud Infrastructure <https://wiki.almalinux.org/cloud/OCI.html> for x86_64 and aarch64 - Vagrant Boxes <https://app.vagrantup.com/almalinux>: - Libvirt - VirtualBox - Hyper-V - VMWare - Parallels - Raspberry Pi <https://wiki.almalinux.org/documentation/raspberry-pi.html> - Windows Subsystem for Linux <https://wiki.almalinux.org/documentation/wsl.html> Release Notes and More Information <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> AlmaLinux 9.3 aims to improve flexibility and reliability, as well as to enhance security across hybrid environments. This release continues simplifying automation and system management. Web console enhancements simplify management tasks. Additionally, users can configure health check actions for Podman containers and vsock devices in virtual machines. Application Streams updates provide developers with flexibility and customization options without affecting the platform's stability. The 9.3 offers enhanced security and compliance. Additionally, it provides enhanced flexibility, stability, and reliability needed to support hybrid cloud innovation. You can read more about this release by checking out the Release Notes <https://wiki.almalinux.org/release-notes/9.3.html>. Join us on Mastodon! <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> Have you jumped on Mastodon yet? Follow us! @almalinux@fosstodon.org <https://fosstodon.org/@almalinux> Pitch In <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> Join us in the AlmaLinux Community Chat <https://chat.almalinux.org/> to get any assistance you need and help others. You can also post a question on our 9.3 Forum <https://almalinux.discourse.group/c/devel/36-category/36>, on our AlmaLinux Community on Reddit <https://reddit.com/r/almalinux>, or catch us on Twitter <https://twitter.com/almalinux>. Please report any bugs you may see on the Bug Tracker <https://bugs.almalinux.org/>. Enjoy the release and have fun! benny Vasquez Chair, Board of Directors @AlmaLinux OS Foundation *I am sending this message now because it suits me, but I don’t expect that you will read, respond to, or act on it outside of comfortable hours for your time zone.*

1 0

[Security Advisory] ALSA-2023:6194: thunderbird security update (Important)
by AlmaLinux Errata Notifications 10 Nov '23

10 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2023-11-10 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.4.1. Security Fix(es): * Mozilla: Queued up rendering could have allowed websites to clickjack (CVE-2023-5721) * Mozilla: Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4 (CVE-2023-5730) * libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488) * Mozilla: Large WebGL draw could have led to a crash (CVE-2023-5724) * Mozilla: WebExtensions could open arbitrary URLs (CVE-2023-5725) * Mozilla: Improper object tracking during GC in the JavaScript engine could have led to a crash. (CVE-2023-5728) * Mozilla: Address bar spoofing via bidirectional characters (CVE-2023-5732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-6194.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6267: squid:4 security update (Critical)
by AlmaLinux Errata Notifications 09 Nov '23

09 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2023-11-09 Summary: Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847) * SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-6267.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0