2022-23 - Canonical, Red Hat, Microsoft, GitHub Published on June 13, 2022

Advisory Week

Week 23, 2022

Ubuntu Security Notices

USN-5396-2: Ghostscript vulnerability USN-5474-1: Varnish Cache vulnerabilities USN-5472-1: FFmpeg vulnerabilities USN-5473-1: ca-certificates update USN-5471-1: Linux kernel (OEM) vulnerabilities USN-5469-1: Linux kernel vulnerabilities USN-5470-1: Linux kernel (OEM) vulnerabilities USN-5468-1: Linux kernel vulnerabilities USN-5467-1: Linux kernel vulnerabilities USN-5466-1: Linux kernel vulnerabilities USN-5465-1: Linux kernel vulnerabilities USN-5464-1: E2fsprogs vulnerability USN-5463-1: NTFS-3G vulnerabilities USN-5462-2: Ruby vulnerability USN-5462-1: Ruby vulnerabilities USN-5461-1: FreeRDP vulnerabilities USN-5460-1: Vim vulnerabilities

Red Hat Security Advisory

(RHSA-2022:4909) Important: OpenShift Container Platform 4.7.52 paackages and security update (RHSA-2022:4985) Moderate: Cryostat 2.1.1: new Cryostat on RHEL 8 container images (RHSA-2022:4959) Moderate: java-1.8.0-ibm security update (RHSA-2022:4957) Moderate: java-1.7.1-ibm security update (RHSA-2022:4956) Important: Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes (RHSA-2022:4941) Important: subversion:1.14 security update (RHSA-2022:4940) Important: xz security update (RHSA-2022:4942) Important: kpatch-patch security update (RHSA-2022:4932) Important: Red Hat Fuse 7.10.2.P1 security update (RHSA-2022:4931) Moderate: RHV Appliance (rhvm-appliance) security update [ovirt-4.5.0] (RHSA-2022:4930) Important: python-twisted-web security update (RHSA-2022:4929) Important: rh-postgresql13-postgresql security update (RHSA-2022:4924) Important: kernel security and bug fix update (RHSA-2022:4922) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.5 security update (RHSA-2022:4918) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7 (RHSA-2022:4919) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8 (RHSA-2022:4913) Important: rh-postgresql10-postgresql security update (RHSA-2022:4915) Important: rh-postgresql12-postgresql security update (RHSA-2022:4914) Moderate: rh-nodejs12-nodejs security, bug fix, and enhancement update

Microsoft Security

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Github Security Advisories

[GHSA-xwx5-5c9g-x68x] Ill-formed headers may lead to unexpected behavior in Istio [GHSA-x9jp-4w8m-4f3c] Cross Site Scripting vulnerability in django-jsonform's admin form. [GHSA-x2pg-mjhr-2m5x] Exposure of Sensitive Information to an Unauthorized Actor in semantic-release [GHSA-64qm-hrgp-pgr9] Authorization header leak on port redirect in mechanize [GHSA-f2wf-25xc-69c9] Failure to strip the Cookie header on change in host or HTTP downgrade [GHSA-w248-ffj2-4v5q] Fix failure to strip Authorization header on HTTP downgrade [GHSA-6vcc-v9vw-g2x5] Path Traversal in Git HTTP endpoints in Gogs [GHSA-67mx-jc2f-jgjm] OS Command Injection in file editor in Gogs [GHSA-xq4v-vrp9-vcf2] Cross-site Scripting vulnerability in repository issue list in Gogs [GHSA-994f-7g86-qr56] Path Traversal in file editor on Windows in Gogs [GHSA-fqx3-r75h-vc89] Improperly checked IDs on itemstacks received from the client leading to server crash in PocketMine-MP [GHSA-5ffw-gxpp-mxpf] containerd CRI plugin: Host memory exhaustion through ExecSync [GHSA-fcm2-6c3h-pg6j] Node DOS by way of memory exhaustion through ExecSync request in CRI-O [GHSA-48f2-m7jg-866x] Failed payment recorded has completed in Silverstripe Omnipay [GHSA-4w8f-hjm9-xwgf] Path Traversal in django-s3file [GHSA-4v9q-cgpw-cf38] Multiple evaluation of contract address in call in vyper [GHSA-4whx-7p29-mq22] TiDB authentication bypass vulnerability [GHSA-5g4r-2qhx-vqfm] Use of Uninitialized Variable in trilogy [GHSA-r7v4-jwx9-wx43] Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator