TI-2024-35008 CVE-2024-52336 · GHSA-cfjc-m7fv-63xj
Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root
Priority LOW 36
A script injection vulnerability was identified in the Tuned package.
RHSA-2024:10384
tuned security update
Released 2024-11-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) tuned-gtk-2.24.0-2.el9_5, tuned-ppd-2.24.0-2.el9_5, tuned-profiles-atomic-2.24.0-2.el9_5 +5
- Red Hat Enterprise Linux BaseOS (v. 9) tuned-2.24.0-2.el9_5, tuned-profiles-cpu-partitioning-2.24.0-2.el9_5
- Red Hat Enterprise Linux Real Time (v. 9) tuned-profiles-realtime-2.24.0-2.el9_5
- Red Hat Enterprise Linux Real Time for NFV (v. 9) tuned-profiles-nfv-2.24.0-2.el9_5, tuned-profiles-nfv-guest-2.24.0-2.el9_5, tuned-profiles-nfv-host-2.24.0-2.el9_5 +1
- Red Hat Enterprise Linux for SAP (v. 9) tuned-profiles-sap-2.24.0-2.el9_5
- Red Hat Enterprise Linux for SAP HANA (v. 9) tuned-profiles-sap-hana-2.24.0-2.el9_5
Fixes 2 records
TI-2024-35009 CVE-2024-52337 · GHSA-8c3c-gvf8-p7v2
Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method
Priority LOW 25
A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments.