2023-17 - Canonical, Red Hat, Cisco, Microsoft, Amazon, GitHub Published on May 1, 2023

Advisory Week

Week 17, 2023

Ubuntu Security Notices

Netty vulnerabilities: USN-6049-1

Apache Commons Net vulnerability: USN-6037-1

ZenLib vulnerability: USN-6048-1

Linux kernel vulnerability: USN-6047-1

OpenSSL-ibmca vulnerabilities: USN-6046-1

Cloud-init vulnerability: USN-6042-1

Ghostscript vulnerability: USN-6017-2

Linux kernel vulnerabilities: USN-6045-1 / USN-6044-1 / USN-6043-1

Firefox regressions: USN-6010-3

OpenSSL vulnerabilities: USN-6039-1

Linux kernel (HWE) vulnerabilities: USN-6040-1

Go vulnerabilities: USN-6038-1

Red Hat Security Advisory

Important: Migration Toolkit for Applications security and bug fix update: RHSA-2023:2041

Low: Red Hat OpenStack Platform 16.2 (openstack-nova) security update: RHSA-2023:1948

Important: Red Hat OpenShift Data Foundation 4.11.7 Bug Fix and security update: RHSA-2023:2023

Important: edk2 security update: RHSA-2023:2022

Moderate: Logging Subsystem 5.6.5 - Red Hat OpenShift security update: RHSA-2023:1953

Moderate: OpenShift Container Platform 4.10.58 security update: RHSA-2023:1866

Important: emacs security update: RHSA-2023:2010 / RHSA-2023:1958 / RHSA-2023:1931 / RHSA-2023:1930

Moderate: kernel security and bug fix update: RHSA-2023:1987

Moderate: kernel-rt security and bug fix update: RHSA-2023:1988

Important: OpenJDK 8u372 Security Update for Portable Linux Builds: RHSA-2023:1903

Important: OpenJDK 8u372 Windows Security Update: RHSA-2023:1912

Important: java-1.8.0-openjdk security update: RHSA-2023:1907 / RHSA-2023:1908 / RHSA-2023:1906 / RHSA-2023:1905 / RHSA-2023:1911

Important: java-1.8.0-openjdk security and bug fix update: RHSA-2023:1910 / RHSA-2023:1909 / RHSA-2023:1904

Important: kpatch-patch security update: RHSA-2023:1984

Important: kernel-rt security and bug fix update: RHSA-2023:1980

Moderate: pcs security and bug fix update: RHSA-2023:1981 / RHSA-2023:1961

Important: qatzip security and bug fix update: RHSA-2023:1976

Moderate: haproxy security update: RHSA-2023:1978

Important: kernel security and bug fix update: RHSA-2023:1970

Important: pki-core:10.6 security update: RHSA-2023:1966

Cisco Security Advisory

Cisco Prime Collaboration Deployment Cross-Site Scripting Vulnerability

Microsoft Security

Microsoft May 2023 Security Update Guide

Microsoft Edge (Chromium-based) Spoofing Vulnerability: CVE-2023-29334

Amazon AWS Security Advisories

Issue With IAM Supporting Multiple MFA Devices

Github Security Advisories

[GHSA-6vrj-ph27-qfp3] Remote code injection in wwbn/avideo

[GHSA-jgvc-jfgh-rjvv] Chosen Ciphertext Attack in Jose4j

[GHSA-j5c3-r84f-9596] Arbitrary File Read in Admin JS CSS files

[GHSA-g93x-fm2w-5pxw] Cross-site Scripting (XSS) in DataObject columns grid

[GHSA-6fvf-x8c6-2f6j] Cross-site Scripting (XSS) in DataObject Any Getter grid operator

[GHSA-hg77-vx9v-f49x] Path Traversal in Asset "import from server" option

[GHSA-r7mm-jx6h-hv7m] Cross-site Scripting (XSS) in Conditions tab of Pricing Rules

[GHSA-2295-vh28-pphc] Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition

[GHSA-x9xj-pqmv-8jf7] Cross-site Scripting (XSS) in DataObject Class date fields

[GHSA-cjv6-w5hf-5wr6] Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field

[GHSA-476g-v7hf-cw5m] Cross-site Scripting (XSS) in Document Properties Parameter

[GHSA-4x35-vr82-xvj6] SQL Injection in AssetController

[GHSA-2c67-p4xh-m34w] Cross-site Scripting (XSS) in Website Settings name field

[GHSA-fq95-rx4q-qgg2] Cross-site Scripting (XSS) in Admin Login too many attempts notice

[GHSA-9q7q-r54q-3f3g] Cross-site Scripting (XSS) in DataObject Classification Store

[GHSA-jwg4-qcgv-5wg6] SQL Injection in Admin Translations API

[GHSA-xmg8-w465-mr56] SQL Injection in Translation Export API

[GHSA-6mhm-gcpf-5gr8] SQL Injection in Admin Search Find API

[GHSA-ch89-5g45-qwc7] Undefined Behavior in Rust runtime functions

[GHSA-558p-m34m-vpmq] Potential leak of authentication data to 3rd parties

[GHSA-jh3w-6jp2-vqqm] Missing permission check of canView in GridFieldPrintButton

[GHSA-fw84-xgm8-9jmv] Open redirect vulnerability on CMSSecurity relogin screen

[GHSA-9wh7-397j-722m] Ironic and ironic-inspector may expose as ConfigMaps

[GHSA-35jj-vqcf-f2jf] Hidden fields can be leaked on readable collections in Payload

[GHSA-w9mr-28mw-j8hg] Hop-by-hop abuse to malform header mutator

[GHSA-2fch-hv74-fgw9] Cross site scripting (XSS) in wwbn/avideo

[GHSA-6w4m-2xhg-2658] Buffer overflow in sponge queue functions

[GHSA-fp7q-xhhw-6rj3] Path traversal vulnerability in the file manager

[GHSA-8r4m-5p6p-52rp] Arbitrary file read via SQL injection

[GHSA-mjv9-vp6w-3rc9] AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

[GHSA-wqm8-jx8r-8rcq] Cross-site scripting vulnerabilities in old version of bundled TinyMCE

[GHSA-j4rf-7357-f4cg] Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer and Singularity

[GHSA-xv83-x443-7rmw] HTML injection in search results via plaintext message highlighting

[GHSA-fh7r-996q-gvcp] Possible XSS injection through Validate::isCleanHTML method

[GHSA-p379-cxqh-q822] SQL filter bypass leading to arbitrary write requests using "SQL Manager"

[GHSA-65g2-x53q-cmf6] Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform

[GHSA-fwcf-753v-fgcj] Unrestricted file upload in kiwi TCMS

[GHSA-xv3h-4844-9h36] HTTP Multiline Header Termination

[GHSA-9p5f-5x8v-x65m] Directory traversal + file write causing arbitrary code execution

[GHSA-6m9f-pj6w-w87g] Rancher Webhook is misconfigured during upgrade process

[GHSA-w9g2-3w7p-72g9] Incorrect success value returned in vyper

[GHSA-rg3q-prf8-qxmp] Arbitrary command injection in embano1/wip

[GHSA-7x6q-3v3m-cwjg] kiwi TCMS has possibility for user to update email address to unverified one