Red Hat Security AdvisoryRHSA-2024:2094
security update Logging for Red Hat OpenShift - 5.8.6
Released 2024-05-01 · Red Hat rating Moderate · View on Red Hat →
Fixes 16 records
Priority HIGH 72
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01392 · Published 2024-01-16 · Partial fix · 3.8.3, 3.7.6-23.el9_3.3 +36 CWE-347
Priority HIGH 69
A use-after-free flaw was found in the netfilter subsystem of the Linux kernel.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00836 · Published 2024-01-02 · Partial fix · 5.14.0-362.24.1.el9_3, 5.14.0-70.105.1.el9_0 +20 CWE-416
Priority HIGH 68
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01685 · Published 2023-12-07 · Partial fix · 7.46.0 CWE-178
Priority MEDIUM 64
An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel.
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00526 · Published 2023-12-08 · Partial fix · 4.18.0-513.18.1.rt7.320.el8_9, 4.18.0-513.18.1.el8_9 +22 CWE-125
Priority MEDIUM 46
Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03939 · Published 2023-10-24 · Fixed in 3.0.12, 3.1.4 CWE-684
Priority MEDIUM 42
A vulnerability was found in GnuTLS.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01614 · Published 2024-01-16 · Partial fix · 3.8.3, 3.6.16-8.el8_9.1 +39 CWE-203
Priority LOW 38
A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00909 · Published 2023-10-25 · Partial fix · 6.6 CWE-787
Priority LOW 36
An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00308 · Published 2024-01-17 · Partial fix · 6.7-rc5, 4.18.0-513.18.1.rt7.320.el8_9 +29 CWE-787
Priority LOW 36
In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-after-free.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00319 · Published 2024-01-23 · Partial fix CWE-416
Priority LOW 36
A flaw was found in the Linux kernel's NVMe driver.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01549 · Published 2024-02-07 · Partial fix · 4.18.0-513.18.1.rt7.320.el8_9, 4.18.0-513.18.1.el8_9 +22 CWE-476
Priority LOW 36
A flaw was found in the Linux kernel's NVMe driver.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01549 · Published 2024-02-07 · Partial fix · 4.18.0-513.18.1.rt7.320.el8_9, 4.18.0-513.18.1.el8_9 +22 CWE-476
Priority LOW 36
A flaw was found in the Linux kernel's NVMe driver.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0146 · Published 2024-02-07 · Partial fix · 4.18.0-513.18.1.rt7.320.el8_9, 4.18.0-513.18.1.el8_9 +22 CWE-476
Priority LOW 34
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00334 · Published 2023-12-18 · Partial fix · 6.7 CWE-416
Priority LOW 34
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00241 · Published 2023-09-06 · Partial fix · 4.19.316, 5.4.262 +4 CWE-416
Priority LOW 32
An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel.
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.0043 · Published 2023-12-08 · Partial fix · 4.18.0-513.18.1.rt7.320.el8_9, 4.18.0-513.18.1.el8_9 +22 CWE-125
Priority LOW 29
A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01267 · Published 2023-11-28 · Partial fix · 3.6.16-8.el8_9, 3.6.16-5.el8_6.2 +38 CWE-208
THREATIST.IORead the docs