2023-17 - Canonical, Red Hat, Cisco, Microsoft, Amazon, GitHub Published on May 1, 2023

Advisory Week

Week 17, 2023

Ubuntu Security Notices

Netty vulnerabilities: USN-6049-1 Apache Commons Net vulnerability: USN-6037-1 ZenLib vulnerability: USN-6048-1 Linux kernel vulnerability: USN-6047-1 OpenSSL-ibmca vulnerabilities: USN-6046-1 Cloud-init vulnerability: USN-6042-1 Ghostscript vulnerability: USN-6017-2 Linux kernel vulnerabilities: USN-6045-1 / USN-6044-1 / USN-6043-1 Firefox regressions: USN-6010-3 OpenSSL vulnerabilities: USN-6039-1 Linux kernel (HWE) vulnerabilities: USN-6040-1 Go vulnerabilities: USN-6038-1

Red Hat Security Advisory

Important: Migration Toolkit for Applications security and bug fix update: RHSA-2023:2041 Low: Red Hat OpenStack Platform 16.2 (openstack-nova) security update: RHSA-2023:1948 Important: Red Hat OpenShift Data Foundation 4.11.7 Bug Fix and security update: RHSA-2023:2023 Important: edk2 security update: RHSA-2023:2022 Moderate: Logging Subsystem 5.6.5 - Red Hat OpenShift security update: RHSA-2023:1953 Moderate: OpenShift Container Platform 4.10.58 security update: RHSA-2023:1866 Important: emacs security update: RHSA-2023:2010 / RHSA-2023:1958 / RHSA-2023:1931 / RHSA-2023:1930 Moderate: kernel security and bug fix update: RHSA-2023:1987 Moderate: kernel-rt security and bug fix update: RHSA-2023:1988 Important: OpenJDK 8u372 Security Update for Portable Linux Builds: RHSA-2023:1903 Important: OpenJDK 8u372 Windows Security Update: RHSA-2023:1912 Important: java-1.8.0-openjdk security update: RHSA-2023:1907 / RHSA-2023:1908 / RHSA-2023:1906 / RHSA-2023:1905 / RHSA-2023:1911 Important: java-1.8.0-openjdk security and bug fix update: RHSA-2023:1910 / RHSA-2023:1909 / RHSA-2023:1904 Important: kpatch-patch security update: RHSA-2023:1984 Important: kernel-rt security and bug fix update: RHSA-2023:1980 Moderate: pcs security and bug fix update: RHSA-2023:1981 / RHSA-2023:1961 Important: qatzip security and bug fix update: RHSA-2023:1976 Moderate: haproxy security update: RHSA-2023:1978 Important: kernel security and bug fix update: RHSA-2023:1970 Important: pki-core:10.6 security update: RHSA-2023:1966

Cisco Security Advisory

Cisco Prime Collaboration Deployment Cross-Site Scripting Vulnerability

Microsoft Security

Microsoft May 2023 Security Update Guide Microsoft Edge (Chromium-based) Spoofing Vulnerability: CVE-2023-29334

Amazon AWS Security Advisories

Issue With IAM Supporting Multiple MFA Devices

Github Security Advisories

[GHSA-6vrj-ph27-qfp3] Remote code injection in wwbn/avideo [GHSA-jgvc-jfgh-rjvv] Chosen Ciphertext Attack in Jose4j [GHSA-j5c3-r84f-9596] Arbitrary File Read in Admin JS CSS files [GHSA-g93x-fm2w-5pxw] Cross-site Scripting (XSS) in DataObject columns grid [GHSA-6fvf-x8c6-2f6j] Cross-site Scripting (XSS) in DataObject Any Getter grid operator [GHSA-hg77-vx9v-f49x] Path Traversal in Asset "import from server" option [GHSA-r7mm-jx6h-hv7m] Cross-site Scripting (XSS) in Conditions tab of Pricing Rules [GHSA-2295-vh28-pphc] Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition [GHSA-x9xj-pqmv-8jf7] Cross-site Scripting (XSS) in DataObject Class date fields [GHSA-cjv6-w5hf-5wr6] Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field [GHSA-476g-v7hf-cw5m] Cross-site Scripting (XSS) in Document Properties Parameter [GHSA-4x35-vr82-xvj6] SQL Injection in AssetController [GHSA-2c67-p4xh-m34w] Cross-site Scripting (XSS) in Website Settings name field [GHSA-fq95-rx4q-qgg2] Cross-site Scripting (XSS) in Admin Login too many attempts notice [GHSA-9q7q-r54q-3f3g] Cross-site Scripting (XSS) in DataObject Classification Store [GHSA-jwg4-qcgv-5wg6] SQL Injection in Admin Translations API [GHSA-xmg8-w465-mr56] SQL Injection in Translation Export API [GHSA-6mhm-gcpf-5gr8] SQL Injection in Admin Search Find API [GHSA-ch89-5g45-qwc7] Undefined Behavior in Rust runtime functions [GHSA-558p-m34m-vpmq] Potential leak of authentication data to 3rd parties [GHSA-jh3w-6jp2-vqqm] Missing permission check of canView in GridFieldPrintButton [GHSA-fw84-xgm8-9jmv] Open redirect vulnerability on CMSSecurity relogin screen [GHSA-9wh7-397j-722m] Ironic and ironic-inspector may expose as ConfigMaps [GHSA-35jj-vqcf-f2jf] Hidden fields can be leaked on readable collections in Payload [GHSA-w9mr-28mw-j8hg] Hop-by-hop abuse to malform header mutator [GHSA-2fch-hv74-fgw9] Cross site scripting (XSS) in wwbn/avideo [GHSA-6w4m-2xhg-2658] Buffer overflow in sponge queue functions [GHSA-fp7q-xhhw-6rj3] Path traversal vulnerability in the file manager [GHSA-8r4m-5p6p-52rp] Arbitrary file read via SQL injection [GHSA-mjv9-vp6w-3rc9] AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending [GHSA-wqm8-jx8r-8rcq] Cross-site scripting vulnerabilities in old version of bundled TinyMCE [GHSA-j4rf-7357-f4cg] Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer and Singularity [GHSA-xv83-x443-7rmw] HTML injection in search results via plaintext message highlighting [GHSA-fh7r-996q-gvcp] Possible XSS injection through Validate::isCleanHTML method [GHSA-p379-cxqh-q822] SQL filter bypass leading to arbitrary write requests using "SQL Manager" [GHSA-65g2-x53q-cmf6] Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform [GHSA-fwcf-753v-fgcj] Unrestricted file upload in kiwi TCMS [GHSA-xv3h-4844-9h36] HTTP Multiline Header Termination [GHSA-9p5f-5x8v-x65m] Directory traversal + file write causing arbitrary code execution [GHSA-6m9f-pj6w-w87g] Rancher Webhook is misconfigured during upgrade process [GHSA-w9g2-3w7p-72g9] Incorrect success value returned in vyper [GHSA-rg3q-prf8-qxmp] Arbitrary command injection in embano1/wip [GHSA-7x6q-3v3m-cwjg] kiwi TCMS has possibility for user to update email address to unverified one