2022-8 - Mozilla, Canonical, Red Hat, Cisco, GitHub Published on February 28, 2022

Advisory Week

Week 8, 2022

Mozilla Security Advisories

Mozilla VPN local privilege escalation vis uncontrolled OpenSSL search path mfsa2022-08

Ubuntu Security Notices

USN-5292-4: snapd regression USN-5302-1: Linux kernel (OEM) vulnerabilities USN-5301-2: Cyrus SASL vulnerability USN-5300-1: PHP vulnerabilities USN-5301-1: Cyrus SASL vulnerability USN-5299-1: Linux kernel vulnerabilities USN-5298-1: Linux kernel vulnerabilities USN-5294-2: Linux kernel vulnerabilities USN-5297-1: Linux kernel (GKE) vulnerabilities USN-5295-2: Linux kernel vulnerabilities USN-5293-1: c3p0 vulnerability USN-5288-1: Expat vulnerabilities

Red Hat Security Advisory

(RHSA-2022:0682) Important: Red Hat OpenShift GitOps security update (RHSA-2022:0565) Important: OpenShift Container Platform 4.6.55 packages and security update (RHSA-2022:0672) Moderate: ruby:2.5 security update (RHSA-2022:0555) Important: OpenShift Container Platform 3.11.634 security update (RHSA-2022:0666) Important: cyrus-sasl security update (RHSA-2022:0668) Important: cyrus-sasl security update (RHSA-2022:0667) Important: python-pillow security update (RHSA-2022:0665) Important: python-pillow security update (RHSA-2022:0669) Important: python-pillow security update (RHSA-2022:0664) Critical: samba security update (RHSA-2022:0663) Critical: samba security update (RHSA-2022:0661) Moderate: Red Hat Fuse 7.10.1 release and security update (RHSA-2022:0658) Important: cyrus-sasl security update (RHSA-2022:0561) Moderate: OpenShift Container Platform 4.9.22 security update (RHSA-2022:0557) Moderate: OpenShift Container Platform 4.9.22 security update (RHSA-2022:0643) Important: python-pillow security update (RHSA-2022:0628) Low: 389-ds-base security and bug fix update (RHSA-2022:0622) Important: kernel-rt security and bug fix update (RHSA-2022:0620) Important: kernel security and bug fix update (RHSA-2022:0621) Moderate: openldap security update (RHSA-2022:0636) Important: kernel security and bug fix update (RHSA-2022:0634) Moderate: rpm security update (RHSA-2022:0635) Moderate: curl security update (RHSA-2022:0633) Low: sysstat security update (RHSA-2022:0632) Moderate: unbound security update (RHSA-2022:0629) Important: kernel-rt security and bug fix update (RHSA-2022:0609) Important: python-pillow security update (RHSA-2022:0595) Important: Red Hat Advanced Cluster Management 2.3.6 security updates and bug fixes (RHSA-2022:0590) Important: kpatch-patch security update (RHSA-2022:0592) Important: kpatch-patch security update (RHSA-2022:0589) Moderate: Red Hat build of Quarkus 2.2.5 release and security update (RHSA-2022:0587) Important: Service Telemetry Framework 1.3 (sg-core-container) security update (RHSA-2022:0585) Important: Service Telemetry Framework 1.4 (sg-core-container) security update (RHSA-2022:0582) Important: ruby:2.6 security update (RHSA-2022:0581) Important: ruby:2.6 security update

Cisco Security Advisory

Cisco NX-OS Software Cisco Fabric Services Over IP Denial of Service Vulnerability Cisco FXOS and NX-OS Software Cisco Discovery Protocol Service Denial of Service Vulnerability Cisco NX-OS Software NX-API Command Injection Vulnerability Cisco Nexus 9000 Series Switches Bidirectional Forwarding Detection Denial of Service Vulnerability

Github Security Advisories

[GHSA-6jp6-9rf9-gc66] Cross-site Scripting in Weblate [GHSA-fq42-c5rg-92c2] Vulnerable dependencies in Nokogiri [GHSA-mf22-92pm-m8p8] Cross site scripting in @awsui/components-react [GHSA-8wr4-2wm6-w3pr] B2 Command Line Tool TOCTOU application key disclosure [GHSA-53m6-44rc-h2q5] Missing server signature validation in OctoberCMS [GHSA-p867-fxfr-ph2w] b2-sdk-python TOCTOU application key disclosure [GHSA-9cwv-cppx-mqjm] Improper Authentication in Capsule Proxy [GHSA-jmhf-9fj8-88gh] Open Redirect in AllTube [GHSA-79jw-2f46-wv22] Authenticated remote code execution in October CMS [GHSA-vv6j-ww6x-54gx] Use after free in Animation [GHSA-86f3-hf24-76q4] Use of Hard-coded Cryptographic Key in Netmaker [GHSA-ccxc-vr6p-4858] Improper Certificate Validation in Cosign [GHSA-3949-f494-cm99] Cross-site Scripting in Prism