ID

VAR-202208-0404

CVE

CVE-2022-37434

TITLE

zlib  Out-of-bounds write vulnerability in

DESCRIPTION

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). zlib Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: zlib security update Advisory ID: RHSA-2023:1095-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:1095 Issue date: 2023-03-07 CVE Names: CVE-2022-37434 ==================================================================== 1. Summary: An update for zlib is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: The zlib packages provide a general-purpose lossless data compression library that is used by many different programs. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Package List: Red Hat Enterprise Linux Client (v. 7): Source: zlib-1.2.7-21.el7_9.src.rpm x86_64: zlib-1.2.7-21.el7_9.i686.rpm zlib-1.2.7-21.el7_9.x86_64.rpm zlib-debuginfo-1.2.7-21.el7_9.i686.rpm zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: minizip-1.2.7-21.el7_9.i686.rpm minizip-1.2.7-21.el7_9.x86_64.rpm minizip-devel-1.2.7-21.el7_9.i686.rpm minizip-devel-1.2.7-21.el7_9.x86_64.rpm zlib-debuginfo-1.2.7-21.el7_9.i686.rpm zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm zlib-devel-1.2.7-21.el7_9.i686.rpm zlib-devel-1.2.7-21.el7_9.x86_64.rpm zlib-static-1.2.7-21.el7_9.i686.rpm zlib-static-1.2.7-21.el7_9.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: zlib-1.2.7-21.el7_9.src.rpm x86_64: zlib-1.2.7-21.el7_9.i686.rpm zlib-1.2.7-21.el7_9.x86_64.rpm zlib-debuginfo-1.2.7-21.el7_9.i686.rpm zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: minizip-1.2.7-21.el7_9.i686.rpm minizip-1.2.7-21.el7_9.x86_64.rpm minizip-devel-1.2.7-21.el7_9.i686.rpm minizip-devel-1.2.7-21.el7_9.x86_64.rpm zlib-debuginfo-1.2.7-21.el7_9.i686.rpm zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm zlib-devel-1.2.7-21.el7_9.i686.rpm zlib-devel-1.2.7-21.el7_9.x86_64.rpm zlib-static-1.2.7-21.el7_9.i686.rpm zlib-static-1.2.7-21.el7_9.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: zlib-1.2.7-21.el7_9.src.rpm ppc64: zlib-1.2.7-21.el7_9.ppc.rpm zlib-1.2.7-21.el7_9.ppc64.rpm zlib-debuginfo-1.2.7-21.el7_9.ppc.rpm zlib-debuginfo-1.2.7-21.el7_9.ppc64.rpm zlib-devel-1.2.7-21.el7_9.ppc.rpm zlib-devel-1.2.7-21.el7_9.ppc64.rpm ppc64le: zlib-1.2.7-21.el7_9.ppc64le.rpm zlib-debuginfo-1.2.7-21.el7_9.ppc64le.rpm zlib-devel-1.2.7-21.el7_9.ppc64le.rpm s390x: zlib-1.2.7-21.el7_9.s390.rpm zlib-1.2.7-21.el7_9.s390x.rpm zlib-debuginfo-1.2.7-21.el7_9.s390.rpm zlib-debuginfo-1.2.7-21.el7_9.s390x.rpm zlib-devel-1.2.7-21.el7_9.s390.rpm zlib-devel-1.2.7-21.el7_9.s390x.rpm x86_64: zlib-1.2.7-21.el7_9.i686.rpm zlib-1.2.7-21.el7_9.x86_64.rpm zlib-debuginfo-1.2.7-21.el7_9.i686.rpm zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm zlib-devel-1.2.7-21.el7_9.i686.rpm zlib-devel-1.2.7-21.el7_9.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: minizip-1.2.7-21.el7_9.ppc.rpm minizip-1.2.7-21.el7_9.ppc64.rpm minizip-devel-1.2.7-21.el7_9.ppc.rpm minizip-devel-1.2.7-21.el7_9.ppc64.rpm zlib-debuginfo-1.2.7-21.el7_9.ppc.rpm zlib-debuginfo-1.2.7-21.el7_9.ppc64.rpm zlib-static-1.2.7-21.el7_9.ppc.rpm zlib-static-1.2.7-21.el7_9.ppc64.rpm ppc64le: minizip-1.2.7-21.el7_9.ppc64le.rpm minizip-devel-1.2.7-21.el7_9.ppc64le.rpm zlib-debuginfo-1.2.7-21.el7_9.ppc64le.rpm zlib-static-1.2.7-21.el7_9.ppc64le.rpm s390x: minizip-1.2.7-21.el7_9.s390.rpm minizip-1.2.7-21.el7_9.s390x.rpm minizip-devel-1.2.7-21.el7_9.s390.rpm minizip-devel-1.2.7-21.el7_9.s390x.rpm zlib-debuginfo-1.2.7-21.el7_9.s390.rpm zlib-debuginfo-1.2.7-21.el7_9.s390x.rpm zlib-static-1.2.7-21.el7_9.s390.rpm zlib-static-1.2.7-21.el7_9.s390x.rpm x86_64: minizip-1.2.7-21.el7_9.i686.rpm minizip-1.2.7-21.el7_9.x86_64.rpm minizip-devel-1.2.7-21.el7_9.i686.rpm minizip-devel-1.2.7-21.el7_9.x86_64.rpm zlib-debuginfo-1.2.7-21.el7_9.i686.rpm zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm zlib-static-1.2.7-21.el7_9.i686.rpm zlib-static-1.2.7-21.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: zlib-1.2.7-21.el7_9.src.rpm x86_64: zlib-1.2.7-21.el7_9.i686.rpm zlib-1.2.7-21.el7_9.x86_64.rpm zlib-debuginfo-1.2.7-21.el7_9.i686.rpm zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm zlib-devel-1.2.7-21.el7_9.i686.rpm zlib-devel-1.2.7-21.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: minizip-1.2.7-21.el7_9.i686.rpm minizip-1.2.7-21.el7_9.x86_64.rpm minizip-devel-1.2.7-21.el7_9.i686.rpm minizip-devel-1.2.7-21.el7_9.x86_64.rpm zlib-debuginfo-1.2.7-21.el7_9.i686.rpm zlib-debuginfo-1.2.7-21.el7_9.x86_64.rpm zlib-static-1.2.7-21.el7_9.i686.rpm zlib-static-1.2.7-21.el7_9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-37434 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZAcuDNzjgjWX9erEAQhBfxAAnzhxAmg+iqzHC7pYiVpoAR4rHumYqU06 6mzA0Y2UcTuzx/baoTpN2lxDJlKcJxijzXAVFDVK/FMfxeznMSl5LziNzdc07Vb0 rlNzQ0UXCaRAOVrHI4cWIi+XOLnwfFT+3ZzLGnIni6ZvdMroQCNJ2AlfLCeQwZ4M 59JZeHsYMJTg2E/sgQ9KALmCA+g+XVPmjrigoEG2DSOgXS/65t0SQ0DvMDeN8nT2 G9fWqBwDZpJcgqUTDI/5JSQ0kgENR4KLmnxbRJETHvydH+0LBlthqNSGmEWuVJYe /Uw/YoffoP3tDzITzJEk5PdN6Y53atG25haf7wLmKWmfWdd2sfNqIOWZN7iUrpGG V/pWF0kamiyrJ3CzLCr73hKWwaN3+tKyX5NlwFyKg67EwujAVS8upcGLgCCy/TDc VuvvK6JiXgz0ieqhfoUXLOw4blF30OnUWWe2WHNTmXxEagRWFDmcyau0+xCs6ZtI 0e/9w8fC8qG79T8tlfM3QbYljHeyDwYRLu8S4D00eQD/KBRTren40qhDiYMjcvtQ hAgDKEkcDR1cKDgalHCNpEWN+WWJdQbCetrAzkqinbVnjXVtNlrVQrgQrQF8RvsA 4vKUM3m4sedi7CblWgtPtUU4KiLNlq2oF03RjrVnW1FohuOJ8oRQ4pnb/5iZ9b1h huKrzrky4/I=yKEJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Description: Submariner enables direct networking between pods and services on different Kubernetes clusters that are either on-premises or in the cloud. For more information about Submariner, see the Submariner open source community website at: https://submariner.io/. Security fixes: * CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY * CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters * CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps * CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests Bugs addressed: * subctl diagnose firewall metrics does not work on merged kubeconfig (BZ# 2013711) * [Submariner] - Fails to increase gateway amount after deployment (BZ# 2097381) * Submariner gateway node does not get deleted with subctl cloud cleanup command (BZ# 2108634) * submariner GW pods are unable to resolve the DNS of the Broker K8s API URL (BZ# 2119362) * Submariner gateway node does not get deployed after applying ManagedClusterAddOn on Openstack (BZ# 2124219) * unable to run subctl benchmark latency, pods fail with ImagePullBackOff (BZ# 2130326) * [IBM Z] - Submariner addon unistallation doesnt work from ACM console (BZ# 2136442) * Tags on AWS security group for gateway node break cloud-controller LoadBalancer (BZ# 2139477) * RHACM - Submariner: UI support for OpenStack #19297 (ACM-1242) * Submariner OVN support (ACM-1358) * Submariner Azure Console support (ACM-1388) * ManagedClusterSet consumers migrate to v1beta2 (ACM-1614) * Submariner on disconnected ACM #22000 (ACM-1678) * Submariner gateway: Error creating AWS security group if already exists (ACM-2055) * Submariner gateway security group in AWS not deleted when uninstalling submariner (ACM-2057) * The submariner-metrics-proxy pod pulls an image with wrong naming convention (ACM-2058) * The submariner-metrics-proxy pod is not part of the Agent readiness check (ACM-2067) * Subctl 0.14.0 prints version "vsubctl" (ACM-2132) * managedclusters "local-cluster" not found and missing Submariner Broker CRD (ACM-2145) * Add support of ARO to Submariner deployment (ACM-2150) * The e2e tests execution fails for "Basic TCP connectivity" tests (ACM-2204) * Gateway error shown "diagnose all" tests (ACM-2206) * Submariner does not support cluster "kube-proxy ipvs mode"(ACM-2211) * Vsphere cluster shows Pod Security admission controller warnings (ACM-2256) * Cannot use submariner with OSP and self signed certs (ACM-2274) * Subctl diagnose tests spawn nettest image with wrong tag nameing convention (ACM-2387) * Subctl 0.14.1 prints version "devel" (ACM-2482) 3. Bugs fixed (https://bugzilla.redhat.com/): 2013711 - subctl diagnose firewall metrics does not work on merged kubeconfig 2097381 - [Submariner] - Fails to increase gateway amount after deployment 2108634 - Submariner gateway node does not get deleted with subctl cloud cleanup command 2119362 - submariner GW pods are unable to resolve the DNS of the Broker K8s API URL 2124219 - Submariner gateway node does not get deployed after applying ManagedClusterAddOn on Openstack 2124669 - CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY 2130326 - unable to run subctl benchmark latency, pods fail with ImagePullBackOff 2132868 - CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters 2132872 - CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps 2136442 - [IBM Z] - Submariner addon unistallation doesnt work from ACM console 2139477 - Tags on AWS security group for gateway node break cloud-controller LoadBalancer 2161274 - CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests 5. JIRA issues fixed (https://issues.jboss.org/): ACM-1614 - ManagedClusterSet consumers migrate to v1beta2 (Submariner) ACM-2055 - Submariner gateway: Error creating AWS security group if already exists ACM-2057 - [Submariner] - submariner gateway security group in aws not deleted when uninstalling submariner ACM-2058 - [Submariner] - The submariner-metrics-proxy pod pulls an image with wrong naming convention ACM-2067 - [Submariner] - The submariner-metrics-proxy pod is not part of the Agent readiness check ACM-2132 - Subctl 0.14.0 prints version "vsubctl" ACM-2145 - managedclusters "local-cluster" not found and missing Submariner Broker CRD ACM-2150 - Add support of ARO to Submariner deployment ACM-2204 - [Submariner] - e2e tests execution fails for "Basic TCP connectivity" tests ACM-2206 - [Submariner] - Gateway error shown "diagnose all" tests ACM-2211 - [Submariner] - Submariner does not support cluster "kube-proxy ipvs mode" ACM-2256 - [Submariner] - Vsphere cluster shows Pod Security admission controller warnings ACM-2274 - Cannot use submariner with OSP and self signed certs ACM-2387 - [Submariner] - subctl diagnose tests spawn nettest image with wrong tag nameing convention ACM-2482 - Subctl 0.14.1 prints version "devel" 6. Bugs fixed (https://bugzilla.redhat.com/): 2030787 - CVE-2021-43565 golang.org/x/crypto: empty plaintext packet causes panic 2064702 - CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server 2142799 - Release of OpenShift Serverless Serving 1.26.0 2142801 - Release of OpenShift Serverless Eventing 1.26.0 5. Bugs fixed (https://bugzilla.redhat.com/): 2134010 - CVE-2022-32149 golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags 5. JIRA issues fixed (https://issues.jboss.org/): LOG-2674 - Many `can't remove non-existent inotify watch for: /var/log/pods/xxxxxx` errors in logfilesmetricexporter container. LOG-3042 - Logging view plugin removes part of LogQL query LOG-3049 - [release-5.5] Resources associated with collector / fluentd keep on getting recreated LOG-3127 - The alerts are Fluentd when type=vector LOG-3138 - [release-5.5] the content of secret elasticsearch-metrics-token is recreated continually LOG-3175 - [release-5.5] Vector healthcheck fails when forwarding logs to Cloudwatch LOG-3213 - must-gather is empty for logging with CLO image LOG-3234 - [release-5.5] Loki gateway is crashing because cipher-suites are not set LOG-3251 - [release-5.5] Adding Valid Subscription Annotation 6. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2022-10-27-6 Additional information for APPLE-SA-2022-10-24-3 macOS Monterey 12.6.1 macOS Monterey 12.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213494. AppleMobileFileIntegrity Available for: macOS Monterey Impact: An app may be able to modify protected parts of the file system Description: This issue was addressed by removing additional entitlements. CVE-2022-42825: Mickey Jin (@patch1t) Audio Available for: macOS Monterey Impact: Parsing a maliciously crafted audio file may lead to disclosure of user information Description: The issue was addressed with improved memory handling. CVE-2022-42798: Anonymous working with Trend Micro Zero Day Initiative Entry added October 27, 2022 Kernel Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2022-32944: Tim Michaud (@TimGMichaud) of Moveworks.ai Entry added October 27, 2022 Kernel Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A race condition was addressed with improved locking. CVE-2022-42803: Xinru Chi of Pangu Lab, John Aakerblom (@jaakerblom) Entry added October 27, 2022 Kernel Available for: macOS Monterey Impact: An app may be able to execute arbitrary code with kernel privileges Description: A logic issue was addressed with improved checks. CVE-2022-42801: Ian Beer of Google Project Zero Entry added October 27, 2022 ppp Available for: macOS Monterey Impact: A buffer overflow may result in arbitrary code execution Description: The issue was addressed with improved bounds checks. CVE-2022-32941: an anonymous researcher Entry added October 27, 2022 Ruby Available for: macOS Monterey Impact: A remote user may be able to cause unexpected app termination or arbitrary code execution Description: A memory corruption issue was addressed by updating Ruby to version 2.6.10. CVE-2022-28739 Sandbox Available for: macOS Monterey Impact: An app with root privileges may be able to access private information Description: This issue was addressed with improved data protection. CVE-2022-32862: an anonymous researcher zlib Available for: macOS Monterey Impact: A user may be able to cause unexpected app termination or arbitrary code execution Description: This issue was addressed with improved checks. CVE-2022-37434: Evgeny Legerov CVE-2022-42800: Evgeny Legerov Entry added October 27, 2022 Additional recognition Calendar We would like to acknowledge an anonymous researcher for their assistance. macOS Monterey 12.6.1 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Updates web site: https://support.apple.com/en-us/HT201222. Description: Red Hat Advanced Cluster Management for Kubernetes 2.6.2 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/release_notes/ Security fixes: * moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129) * passport: incorrect session regeneration (CVE-2022-25896) * sanitize-html: insecure global regular expression replacement logic may lead to ReDoS (CVE-2022-25887) * terser: insecure use of regular expressions leads to ReDoS (CVE-2022-25858) * search-api: SQL injection leads to remote denial of service (CVE-2022-2238) Bug fixes: * ACM 2.6.2 images (BZ# 2126195) * Infra MachineSet Replicate Taint (BZ# 2116528) * Work agent panic when apply the manifestwork (BZ# 2120920) * unexpected difference of behavior in inform policies with lists of apiGroups for ClusterRole resources (BZ# 2130985) 3. Bugs fixed (https://bugzilla.redhat.com/): 2101669 - CVE-2022-2238 search-api: SQL injection leads to remote denial of service 2105075 - CVE-2022-31129 moment: inefficient parsing algorithm resulting in DoS 2111862 - CVE-2022-25896 passport: incorrect session regeneration 2116528 - Infra MachineSet Replicate Taint 2120920 - work agent panic when apply the manifestwork 2123376 - CVE-2022-25887 sanitize-html: insecure global regular expression replacement logic may lead to ReDoS 2126277 - CVE-2022-25858 terser: insecure use of regular expressions leads to ReDoS 2130985 - unexpected difference of behaviour in inform policies with lists of apiGroups for ClusterRole ressources 5. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202210-42 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: zlib: Multiple vulnerabilities Date: October 31, 2022 Bugs: #863851, #835958 ID: 202210-42 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A buffer overflow in zlib might allow an attacker to cause remote code execution. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-libs/zlib < 1.2.12-r3 >= 1.2.12-r3 Description =========== Multiple vulnerabilities have been discovered in zlib. Please review the CVE identifiers referenced below for details. Impact ====== Maliciously crafted input handled by zlib may result in remote code execution. Workaround ========== There is no known workaround at this time. Resolution ========== All zlib users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/zlib-1.2.12-r3" References ========== [ 1 ] CVE-2018-25032 https://nvd.nist.gov/vuln/detail/CVE-2018-25032 [ 2 ] CVE-2022-37434 https://nvd.nist.gov/vuln/detail/CVE-2022-37434 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202210-42 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. License ======= Copyright 2022 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . ========================================================================== Ubuntu Security Notice USN-6736-1 April 16, 2024 klibc vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: Several security issues were fixed in klibc. Software Description: - klibc: small utilities built with klibc for early boot Details: It was discovered that zlib, vendored in klibc, incorrectly handled pointer arithmetic. An attacker could use this issue to cause klibc to crash or to possibly execute arbitrary code. (CVE-2016-9840, CVE-2016-9841) Danilo Ramos discovered that zlib, vendored in klibc, incorrectly handled memory when performing certain deflating operations. An attacker could use this issue to cause klibc to crash or to possibly execute arbitrary code. (CVE-2018-25032) Evgeny Legerov discovered that zlib, vendored in klibc, incorrectly handled memory when performing certain inflate operations. An attacker could use this issue to cause klibc to crash or to possibly execute arbitrary code. (CVE-2022-37434) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: klibc-utils 2.0.13-1ubuntu0.1 libklibc 2.0.13-1ubuntu0.1 Ubuntu 22.04 LTS: klibc-utils 2.0.10-4ubuntu0.1 libklibc 2.0.10-4ubuntu0.1 Ubuntu 20.04 LTS: klibc-utils 2.0.7-1ubuntu5.2 libklibc 2.0.7-1ubuntu5.2 Ubuntu 18.04 LTS (Available with Ubuntu Pro): klibc-utils 2.0.4-9ubuntu2.2+esm1 libklibc 2.0.4-9ubuntu2.2+esm1 Ubuntu 16.04 LTS (Available with Ubuntu Pro): klibc-utils 2.0.4-8ubuntu1.16.04.4+esm2 libklibc 2.0.4-8ubuntu1.16.04.4+esm2 Ubuntu 14.04 LTS (Available with Ubuntu Pro): klibc-utils 2.0.3-0ubuntu1.14.04.3+esm3 libklibc 2.0.3-0ubuntu1.14.04.3+esm3 In general, a standard system update will make all the necessary changes. Description: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.45. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2023:4052 Space precludes documenting all of the container images in this advisory. All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html 3. Solution: For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are (For x86_64 architecture) The image digest is sha256:c6771b12bd873c0e3e5fbc7afa600d92079de6534dcb52f09cb1d22ee49608a9 (For s390x architecture) The image digest is sha256:622b5361f95d1d512ea84f363ac06155cbb9ee28e85ccaae1acd80b98b660fa8 (For ppc64le architecture) The image digest is sha256:50c131cf85dfb00f258af350a46b85eff8fb8084d3e1617520cd69b59caeaff7 (For aarch64 architecture) The image digest is sha256:9e575c4ece9caaf31acbef246ccad71959cd5bf634e7cb284b0849ddfa205ad7 All OpenShift Container Platform 4.11 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.11/updating/updating-cluster-cli.html 4. Bugs fixed (https://bugzilla.redhat.com/): 2215317 - CVE-2022-21235 github.com/Masterminds/vcs: Command Injection via argument injection 5. JIRA issues fixed (https://issues.redhat.com/): OCPBUGS-15446 - (release-4.11) gather "gateway-mode-config" config map from "openshift-network-operator" namespace OCPBUGS-15532 - visiting Configurations page returns error Cannot read properties of undefined (reading 'apiGroup') OCPBUGS-15645 - Can't use git lfs in BuildConfig git source with strategy Docker OCPBUGS-15739 - Environment cannot find Python OCPBUGS-15758 - [release-4.11] Bump Jenkins and Jenkins Agent Base image versions OCPBUGS-15942 - 9% of OKD tests failing on error: tag latest failed: Internal error occurred: registry.centos.org/dotnet/dotnet-31-centos7:latest: Get "https://registry.centos.org/v2/": dial tcp: lookup registry.centos.org on 172.30.0.10:53: no such host OCPBUGS-15966 - [4.12] MetalLB contains incorrect data Correct and incorrect MetalLB resources coexist should have correct statuses 6

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

buffer error

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2025-08-12T23:02:43.817000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE