2021-48 - Mozilla, Canonical, Red Hat, GitHub Published on December 6, 2021

Advisory Week

Week 48, 2021

Mozilla Security Advisories

Memory corruption in NSS via DER-encoded DSA and RSA-PSS signatures mfsa2021-51

Ubuntu Security Notices

USN-5168-3: NSS vulnerability USN-5168-1: NSS vulnerability USN-5168-2: Thunderbird vulnerability USN-5165-1: Linux kernel (OEM) vulnerabilities USN-5164-1: Linux kernel vulnerabilities USN-5163-1: Linux kernel vulnerabilities USN-5162-1: Linux kernel vulnerabilities USN-5161-1: Linux kernel vulnerabilities USN-5158-1: ImageMagick vulnerabilities

Red Hat Security Advisory

(RHSA-2021:4827) Important: OpenShift Container Platform 3.11.569 security update (RHSA-2021:4799) Important: OpenShift Container Platform 4.6.51 packages and security update (RHSA-2021:4919) Critical: nss security update (RHSA-2021:4918) Moderate: Red Hat Integration Camel-K 1.6 release and security update (RHSA-2021:4915) Important: mailman:2.1 security update (RHSA-2021:4916) Important: mailman:2.1 security update (RHSA-2021:4914) Moderate: OpenShift Virtualization 4.8.3 Images security and bug fix update (RHSA-2021:4913) Important: mailman security update (RHSA-2021:4910) Moderate: OpenShift Virtualization 4.8.3 RPMs security and bug fix update (RHSA-2021:4909) Critical: nss security update (RHSA-2021:4907) Critical: nss security update (RHSA-2021:4904) Critical: nss security update (RHSA-2021:4903) Critical: nss security update (RHSA-2021:4902) Moderate: ACS 3.67 security and enhancement update (RHSA-2021:4801) Important: OpenShift Container Platform 4.7.38 security update (RHSA-2021:4875) Important: kernel-rt security and bug fix update (RHSA-2021:4871) Important: kernel security and bug fix update (RHSA-2021:4866) Moderate: samba security update (RHSA-2021:4863) Important: Red Hat JBoss Web Server 5.6.0 Security release (RHSA-2021:4861) Important: Red Hat JBoss Web Server 5.6.0 Security release (RHSA-2021:4859) Important: kpatch-patch security update (RHSA-2021:4829) Important: OpenShift Container Platform 4.8.22 security update (RHSA-2021:4851) Low: Red Hat AMQ Broker 7.9.1 release and security update (RHSA-2021:4848) Moderate: Migration Toolkit for Containers (MTC) 1.5.2 security update and bugfix advisory (RHSA-2021:4845) Moderate: Red Hat OpenShift Container Storage 4.8.5 Security and Bug Fix Update (RHSA-2021:4843) Important: samba security update (RHSA-2021:4844) Important: samba security update (RHSA-2021:4833) Important: OpenShift Container Platform 4.9.9 security update

Github Security Advisories

[GHSA-8fp4-rp6c-5gcv] Path Traversal in com.linecorp.armeria:armeria [GHSA-7rpc-9m88-cf9w] OS Command Injection Vulnerability and Potential Zip Slip Vulnerability in baserCMS [GHSA-4x2f-54wr-4hjg] Potential Zip Slip Vulnerability in baserCMS [GHSA-w7fj-336r-vw49] Cross-Site Scripting vulnerability in @backstage/plugin-auth-backend [GHSA-2g8g-63j4-9w3r] RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend [GHSA-f34m-x9pj-62vq] Cross-Site Scripting Vulnerability in @joeattardi/emoji-button [GHSA-mg3m-f475-28hv] Path Traversal in @backstage/plugin-scaffolder-backend [GHSA-9jp8-cwwx-p64q] XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext [GHSA-fxwm-rx68-p5vx] XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext [GHSA-hf2m-j98r-4fqw] API token verification can be bypassed in NodeBB [GHSA-wx69-rvg3-x7fc] XSS via prototype pollution in NodeBB [GHSA-pfj7-2qfw-vwgm] Path traversal in translator module in NodeBB [GHSA-hf79-8hjp-rrvq] Use After Free in lucet [GHSA-r8wq-qrxc-hmcm] ReDoS in LDAP schema parser