2022-31 - Canonical, Red Hat, Cisco, Microsoft, GitHub Published on August 8, 2022

Advisory Week

Week 31, 2022

National Cyber Awareness System

CISA Adds One Known Exploited Vulnerability to Catalog Cisco Releases Security Updates for RV Series Routers F5 Releases Security Updates VMware Releases Security Updates CISA and ACSC Release Top 2021 Malware Strains

Ubuntu Security Notices

USN-5548-1: libxml2 vulnerability USN-5546-2: OpenJDK 8 vulnerabilities USN-5551-1: mod-wsgi vulnerability USN-5550-1: GnuTLS vulnerabilities USN-5549-1: Django vulnerability USN-5546-1: OpenJDK vulnerabilities USN-5547-1: NVIDIA graphics drivers vulnerabilities

Red Hat Security Advisory

(RHSA-2022:5909) Moderate: Openshift Logging Bug Fix and security update Release (5.2.13) (RHSA-2022:5908) Moderate: Openshift Logging Bug Fix and security update Release (5.3.10) (RHSA-2022:5905) Important: xorg-x11-server security update (RHSA-2022:5904) Important: php security update (RHSA-2022:5903) Moderate: Red Hat Process Automation Manager 7.13.0 security update (RHSA-2022:5894) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update. (RHSA-2022:5892) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update (RHSA-2022:5893) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.6 Security update (RHSA-2022:5866) Important: go-toolset-1.17 and go-toolset-1.17-golang security and bug fix update (RHSA-2022:5821) Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update (RHSA-2022:5826) Moderate: mariadb:10.5 security, bug fix, and enhancement update (RHSA-2022:5823) Moderate: 389-ds:1.4 security update (RHSA-2022:5839) Important: kpatch-patch security update (RHSA-2022:5834) Important: kernel-rt security and bug fix update (RHSA-2022:5819) Important: kernel security and bug fix update (RHSA-2022:5818) Moderate: openssl security update (RHSA-2022:5813) Moderate: vim security update (RHSA-2022:5809) Moderate: pcre2 security update (RHSA-2022:5840) Moderate: Migration Toolkit for Containers (MTC) 1.7.3 security and bug fix update (RHSA-2022:5837) Moderate: java-1.8.0-ibm security update (RHSA-2022:5804) Important: kpatch-patch security update (RHSA-2022:5802) Important: kernel security update (RHSA-2022:5806) Important: kernel security update (RHSA-2022:5805) Important: kernel security update (RHSA-2022:5799) Important: go-toolset and golang security and bug fix update (RHSA-2022:5730) Moderate: OpenShift Container Platform 4.10.25 bug fix and security update (RHSA-2022:5729) Moderate: OpenShift Container Platform 4.10.25 security update (RHSA-2022:5779) Moderate: ruby:2.5 security update (RHSA-2022:5775) Important: go-toolset:rhel8 security and bug fix update (RHSA-2022:5777) Important: firefox security update (RHSA-2022:5778) Important: thunderbird security update (RHSA-2022:5776) Important: firefox security update (RHSA-2022:5772) Important: thunderbird security update (RHSA-2022:5774) Important: thunderbird security update (RHSA-2022:5773) Important: thunderbird security update (RHSA-2022:5769) Important: firefox security update (RHSA-2022:5771) Important: thunderbird security update (RHSA-2022:5770) Important: thunderbird security update (RHSA-2022:5767) Important: firefox security update (RHSA-2022:5765) Important: firefox security update (RHSA-2022:5766) Important: firefox security update

Cisco Security Advisory

Cisco Unified Communications Manager Arbitrary File Deletion Vulnerability Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability Cisco Small Business RV Series Routers Vulnerabilities Cisco Webex Meetings Web Interface Vulnerabilities Cisco BroadWorks Application Delivery Platform Software Cross-Site Scripting Vulnerability

Microsoft Security

Chromium: CVE-2022-2619 Insufficient validation of untrusted input in Settings Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability Chromium: CVE-2022-2624 Heap buffer overflow in PDF Chromium: CVE-2022-2623 Use after free in Offline Chromium: CVE-2022-2622 Insufficient validation of untrusted input in Safe Browsing Chromium: CVE-2022-2621 Use after free in Extensions Chromium: CVE-2022-2618 Insufficient validation of untrusted input in Internals Chromium: CVE-2022-2617 Use after free in Extensions API Chromium: CVE-2022-2616 Inappropriate implementation in Extensions API Chromium: CVE-2022-2615 Insufficient policy enforcement in Cookies Chromium: CVE-2022-2614 Use after free in Sign-In Flow Chromium: CVE-2022-2612 Side-channel information leakage in Keyboard input Chromium: CVE-2022-2611 Inappropriate implementation in Fullscreen API Chromium: CVE-2022-2610 Insufficient policy enforcement in Background Fetch Chromium: CVE-2022-2606 Use after free in Managed devices API Chromium: CVE-2022-2605 Out of bounds read in Dawn Chromium: CVE-2022-2604 Use after free in Safe Browsing Chromium: CVE-2022-2603 Use after free in Omnibox Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Github Security Advisories

[GHSA-42wq-rch8-6f6j] CKEditor5 Cross-site scripting caused by the editor instance destroying process [GHSA-v4hr-4jpx-56gc] Streamlit directory traversal vulnerability [GHSA-r38f-c4h4-hqq2] PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names [GHSA-8rmh-55h4-93h5] DSpace ItemImportService API Vulnerable to Path Traversal in Simple Archive Format Package Import [GHSA-qp5m-c3m9-8q2p] JSPUI vulnerable to path traversal in submission (resumable) upload [GHSA-763j-q7wv-vf3m] JSPUI's controlled vocabulary feature vulnerable to Open Redirect before v6.4 and v5.11 [GHSA-4wm8-c2vv-xrpq] JSPUI Possible Cross Site Scripting in "Request a Copy" Feature [GHSA-c558-5gfm-p2r8] Cross Site Scripting (XSS) possible in JSPUI spellcheck and autocomplete tools [GHSA-7w85-pp86-p4pq] XMLUI's metadata of withdrawn Items is exposed to anonymous users [GHSA-c2j7-66m3-r4ff] JSPUI's "Internal System Error" page prints exceptions and stack traces without sanitization [GHSA-j47c-j42c-mwqq] Solana Pay Vulnerable to Weakness in Transfer Validation Logic [GHSA-7xr3-6ggc-wc9p] untangle before 1.2.1 vulnerable to XML Entity Expansion [GHSA-f83q-2cp7-qrjg] untangle before 1.2.1 vulnerable to Improper Restriction of XML External Entity Reference [GHSA-p6mm-27gq-9v3p] next-auth before v4.10.2 and v3.29.9 leaks excessive information into log [GHSA-8cw9-5hmv-77w6] sanic vulnerable to Path Traversal [GHSA-6gjm-6wj6-4px5] Byobu user preference to prevent private discussions being started are not respected [GHSA-qrjv-rf5q-qpxc] Rust-WebSocket memory allocation based on untrusted length [GHSA-xv97-c62v-4587] NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails