2022-1 - Canonical, Red Hat, nodejs, Cisco, Microsoft, GitHub Published on January 10, 2022

Advisory Week

Week 1, 2022

Ubuntu Security Notices

USN-5213-1: WebKitGTK vulnerabilities USN-5212-1: Apache HTTP Server vulnerabilities LSN-0083-1: Kernel Live Patch Security Notice USN-5211-1: Linux kernel vulnerability USN-5209-1: Linux kernel vulnerabilities USN-5208-1: Linux kernel vulnerabilities USN-5210-1: Linux kernel vulnerabilities USN-5206-1: Linux kernel (OEM) vulnerability USN-5207-1: Linux kernel (OEM) vulnerabilities USN-5204-1: Django vulnerabilities

Red Hat Security Advisory

(RHSA-2022:0041) Moderate: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update (RHSA-2022:0034) Important: security update of rh-sso-7/sso75 container images for IBM P/Z (RHSA-2021:5208) Moderate: OpenShift Container Platform 4.8.25 security update (RHSA-2022:0015) Important: security update of rh-sso-7/sso75 container images (RHSA-2022:0011) Important: telnet security update (RHSA-2022:0007) Moderate: idm:DL1 security update (RHSA-2022:0008) Important: samba security update (RHSA-2022:0003) Important: xorg-x11-server security update (RHSA-2022:0002) Important: grafana security update (RHSA-2022:0001) Important: grafana security update

Node.js Security Advisories

January 10th 2022 Security Releases

Cisco Security Advisory

Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager SQL Injection Vulnerability

Microsoft Security

Chromium: CVE-2022-0114 Out of bounds memory access in Web Serial Chromium: CVE-2022-0115 Uninitialized Use in File API Chromium: CVE-2022-0116 Inappropriate implementation in Compositing Chromium: CVE-2022-0117 Policy bypass in Service Workers Chromium: CVE-2022-0118 Inappropriate implementation in WebShare Chromium: CVE-2022-0120 Inappropriate implementation in Passwords Chromium: CVE-2022-0113 Inappropriate implementation in Blink Chromium: CVE-2022-0112 Incorrect security UI in Browser UI Chromium: CVE-2022-0111 Inappropriate implementation in Navigation Chromium: CVE-2022-0110 Incorrect security UI in Autofill Chromium: CVE-2022-0109 Inappropriate implementation in Autofill Chromium: CVE-2022-0108 Inappropriate implementation in Navigation Chromium: CVE-2022-0107 Use after free in File Manager API Chromium: CVE-2022-0106 Use after free in Autofill Chromium: CVE-2022-0104 Heap buffer overflow in ANGLE Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Chromium: CVE-2022-0096 Use after free in Storage Chromium: CVE-2022-0097 Inappropriate implementation in DevTools Chromium: CVE-2022-0098 Use after free in Screen Capture Chromium: CVE-2022-0099 Use after free in Sign-in Chromium: CVE-2022-0100 Heap buffer overflow in Media streams API Chromium: CVE-2022-0101 Heap buffer overflow in Bookmarks Chromium: CVE-2022-0102 Type Confusion in V8 Chromium: CVE-2022-0103 Use after free in SwiftShader Chromium: CVE-2022-0105 Use after free in PDF

Github Security Advisories

[GHSA-86ch-6w7v-v6xf] Denial of Service in soketi [GHSA-5rrq-pxf6-6jx5] Prototype Pollution in node-forge debug API. [GHSA-wxgw-qj99-44c2] Prototype Pollution in node-forge util.setPath API [GHSA-gf8q-jrpm-jvxq] URL parsing in node-forge could lead to undesired behavior. [GHSA-wrvw-hg22-4m67] A potential Denial of Service issue in protobuf-java [GHSA-h376-j262-vhq6] RCE in H2 Console [GHSA-c6fg-99pr-25m9] Uncapped length of skin data fields submitted by players [GHSA-p62j-hrxm-xcxf] Book page text, count, and author/title length is not limited in PocketMine-MP [GHSA-c53v-qmrx-93hg] Open redirect in shopware [GHSA-p523-jrph-qjc6] Insufficient Session Expiration in shopware [GHSA-756h-r2c9-qp5j] An authenticated user can execute arbitrary command in Gerapy [GHSA-vc89-hccf-rq55] Hash collision in typelevel jawn [GHSA-36m2-8rhx-f36j] Sandbox bypass in Latte templates [GHSA-w6jr-wj64-mc9x] Deserialization of Untrusted Data in Codeigniter4 [GHSA-x9r5-jxvq-4387] Self XSS on user input in jquery.terminal [GHSA-p3rp-vmj9-gv6v] Incorrect sanitisation function leads to `XSS` in mermaid [GHSA-qv7g-j98v-8pp7] XSS vulnerability on email template preview page [GHSA-hp68-xhvj-x6j6] Insufficient patch for Regular Expression Denial of Service (ReDoS) to jsx-slack v4.5.1 [GHSA-h3fg-h5v3-vf8m] CSRF forgery protection bypass in solidus_frontend [GHSA-83x4-9cwr-5487] Improper Authorization in Keycloak [GHSA-5q7q-qqw2-hjq7] Cross-Site Scripting in AjaxNetProfessional [GHSA-3qpm-h9ch-px3c] Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library [GHSA-f854-hpxv-cw9r] Drainage of FeeCollector's Block Transaction Fees in cronos [GHSA-gp6j-vx54-5pmf] Incorrect validation of parties IDs leaks secret keys in Secret-sharing scheme [GHSA-jx5q-g37m-h5hj] Client-Side JavaScript Prototype Pollution in oro/platform [GHSA-f8m6-h2c7-8h9x] Inefficient Regular Expression Complexity in nltk (word_tokenize, sent_tokenize) [GHSA-mvff-h3cj-wj9c] Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux [GHSA-9w7f-m4j4-j3xw] Gerapy < 0.9.8 may cause remote code execution