ID

VAR-202012-1277

CVE

CVE-2020-8284

TITLE

curl  Information Disclosure Vulnerability

DESCRIPTION

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. curl Contains an information disclosure vulnerability.Information may be obtained. HAXX Haxx curl is a set of file transfer tools that use the URL syntax to work under the command line of the Swedish Haxx (HAXX) company. The tool supports file upload and download and includes a libcurl (client URL transfer library) for program development. Attackers can use this vulnerability to bypass data access restrictions and obtain sensitive information through curl's FTP PASV Responses. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4881-1 security@debian.org https://www.debian.org/security/ Alessandro Ghedini March 30, 2021 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : curl CVE ID : CVE-2020-8169 CVE-2020-8177 CVE-2020-8231 CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 CVE-2021-22876 CVE-2021-22890 Debian Bug : 965280 965281 968831 977161 977162 977163 Multiple vulnerabilities were discovered in cURL, an URL transfer library: CVE-2020-8169 Marek Szlagor reported that libcurl could be tricked into prepending a part of the password to the host name before it resolves it, potentially leaking the partial password over the network and to the DNS server(s). CVE-2020-8177 sn reported that curl could be tricked by a malicious server into overwriting a local file when using th -J (--remote-header-name) and -i (--include) options in the same command line. CVE-2020-8231 Marc Aldorasi reported that libcurl might use the wrong connection when an application using libcurl's multi API sets the option CURLOPT_CONNECT_ONLY, which could lead to information leaks. CVE-2020-8285 xnynx reported that libcurl could run out of stack space when using tha FTP wildcard matching functionality (CURLOPT_CHUNK_BGN_FUNCTION). CVE-2020-8286 It was reported that libcurl didn't verify that an OCSP response actually matches the certificate it is intended to. CVE-2021-22876 Viktor Szakats reported that libcurl does not strip off user credentials from the URL when automatically populating the Referer HTTP request header field in outgoing HTTP requests. CVE-2021-22890 Mingtao Yang reported that, when using an HTTPS proxy and TLS 1.3, libcurl could confuse session tickets arriving from the HTTPS proxy as if they arrived from the remote server instead. This could allow an HTTPS proxy to trick libcurl into using the wrong session ticket for the host and thereby circumvent the server TLS certificate check. For the stable distribution (buster), these problems have been fixed in version 7.64.0-4+deb10u2. We recommend that you upgrade your curl packages. For the detailed security status of curl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/curl Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEBsId305pBx+F583DbwzL4CFiRygFAmBkQCoACgkQbwzL4CFi Ryg6Gg/+LqhhJ8+D7skevVkYzxHzdH2yT/XMeoYp0D37yHmEfH9PyjXwfplG+XEw /xwFRBK8qxD1ja+rQddYyeTvi1OMnMgMS3UsRHlfeMnLxh2+oHnvHDYG848npUEZ Rq4YFoc/n9YTAJZP/G4oiuBeXqH2Sqa5hSNT6VrYfRciCxkYnzA78b85KpI8aYyR lhfiJMNpwrqDbt/QzblpELBkGMIV402VeiqDwHfcVzm2E810xXQNLvPMbWtvDYkA TSrNsdqfuFr1tuQSZY6CGSWEyXtB/tOo8+pvUixlJMBWJMl5TXEcJkD5ckehx0yb C3n9yapfklxHiG9lD4zwwIJDqd3Y4SxdDiSlUC4OhdvpwniMygX0S3ICaPA4iac/ cWanml0Fop3OmRy+vQURTd3sADoT5HoRSUXZVU+HdTrRaEt2xs5okZkWSd3yr4Ux i+HgjUAFkkk8DLRB68Bbpx1LGxFGQT7L8yd4wsWINXlzASIP1A5dnNfE5w0VWOHG 3KDq47wNfjuiZC8GXW+HQCxz5MijnS8Y/Egl0OozNFDwEitNBZEsIjpZaZBdZIwi UFfcK7+u/y/TRY54rA4erkdcHFwpYW5EZVGdb7Z+WPWVlzw0ImXrM68LSAhHQaqW 1Hx4VwwwTsMIPnrx2kriRiiDPOW1r5Kip3yHa+QZLedSRGibQWk= =001T -----END PGP SIGNATURE----- . Bugs fixed (https://bugzilla.redhat.com/): 1918750 - CVE-2021-3114 golang: crypto/elliptic: incorrect operations on the P-224 curve 1945703 - "Guest OS Info" availability in VMI describe is flaky 1958816 - [2.6.z] KubeMacPool fails to start due to OOM likely caused by a high number of Pods running in the cluster 1963275 - migration controller null pointer dereference 1965099 - Live Migration double handoff to virt-handler causes connection failures 1965181 - CDI importer doesn't report AwaitingVDDK like it used to 1967086 - Cloning DataVolumes between namespaces fails while creating cdi-upload pod 1967887 - [2.6.6] nmstate is not progressing on a node and not configuring vlan filtering that causes an outage for VMs 1969756 - Windows VMs fail to start on air-gapped environments 1970372 - Virt-handler fails to verify container-disk 1973227 - segfault in virt-controller during pdb deletion 1974084 - 2.6.6 containers 1975212 - No Virtual Machine Templates Found [EDIT - all templates are marked as depracted] 1975727 - [Regression][VMIO][Warm] The third precopy does not end in warm migration 1977756 - [2.6.z] PVC keeps in pending when using hostpath-provisioner 1982760 - [v2v] no kind VirtualMachine is registered for version \"kubevirt.io/v1\" i... 1986989 - OpenShift Virtualization 2.6.z cannot be upgraded to 4.8.0 initially deployed starting with <= 4.8 5. Description: Red Hat Advanced Cluster Management for Kubernetes 2.3.0 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_mana gement_for_kubernetes/2.3/html/release_notes/ Security: * fastify-reply-from: crafted URL allows prefix scape of the proxied backend service (CVE-2021-21321) * fastify-http-proxy: crafted URL allows prefix scape of the proxied backend service (CVE-2021-21322) * nodejs-netmask: improper input validation of octal input data (CVE-2021-28918) * redis: Integer overflow via STRALGO LCS command (CVE-2021-29477) * redis: Integer overflow via COPY command for large intsets (CVE-2021-29478) * nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469) * nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions (CVE-2020-28500) * golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing - -u- extension (CVE-2020-28851) * golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852) * nodejs-ansi_up: XSS due to insufficient URL sanitization (CVE-2021-3377) * oras: zip-slip vulnerability via oras-pull (CVE-2021-21272) * redis: integer overflow when configurable limit for maximum supported bulk input size is too big on 32-bit platforms (CVE-2021-21309) * nodejs-lodash: command injection via template (CVE-2021-23337) * nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362) * browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS) (CVE-2021-23364) * nodejs-postcss: Regular expression denial of service during source map parsing (CVE-2021-23368) * nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option (CVE-2021-23369) * nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js (CVE-2021-23382) * nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option (CVE-2021-23383) * openssl: integer overflow in CipherUpdate (CVE-2021-23840) * openssl: NULL pointer dereference in X509_issuer_and_serial_hash() (CVE-2021-23841) * nodejs-ua-parser-js: ReDoS via malicious User-Agent header (CVE-2021-27292) * grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call (CVE-2021-27358) * nodejs-is-svg: ReDoS via malicious string (CVE-2021-28092) * nodejs-netmask: incorrectly parses an IP address that has octal integer with invalid character (CVE-2021-29418) * ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482) * normalize-url: ReDoS for data URLs (CVE-2021-33502) * nodejs-trim-newlines: ReDoS in .end() method (CVE-2021-33623) * nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343) * html-parse-stringify: Regular Expression DoS (CVE-2021-23346) * openssl: incorrect SSLv2 rollback protection (CVE-2021-23839) For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section. Bugs: * RFE Make the source code for the endpoint-metrics-operator public (BZ# 1913444) * cluster became offline after apiserver health check (BZ# 1942589) 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/): 1913333 - CVE-2020-28851 golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension 1913338 - CVE-2020-28852 golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag 1913444 - RFE Make the source code for the endpoint-metrics-operator public 1921286 - CVE-2021-21272 oras: zip-slip vulnerability via oras-pull 1927520 - RHACM 2.3.0 images 1928937 - CVE-2021-23337 nodejs-lodash: command injection via template 1928954 - CVE-2020-28500 nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions 1930294 - CVE-2021-23839 openssl: incorrect SSLv2 rollback protection 1930310 - CVE-2021-23841 openssl: NULL pointer dereference in X509_issuer_and_serial_hash() 1930324 - CVE-2021-23840 openssl: integer overflow in CipherUpdate 1932634 - CVE-2021-21309 redis: integer overflow when configurable limit for maximum supported bulk input size is too big on 32-bit platforms 1936427 - CVE-2021-3377 nodejs-ansi_up: XSS due to insufficient URL sanitization 1939103 - CVE-2021-28092 nodejs-is-svg: ReDoS via malicious string 1940196 - View Resource YAML option shows 404 error when reviewing a Subscription for an application 1940613 - CVE-2021-27292 nodejs-ua-parser-js: ReDoS via malicious User-Agent header 1941024 - CVE-2021-27358 grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call 1941675 - CVE-2021-23346 html-parse-stringify: Regular Expression DoS 1942178 - CVE-2021-21321 fastify-reply-from: crafted URL allows prefix scape of the proxied backend service 1942182 - CVE-2021-21322 fastify-http-proxy: crafted URL allows prefix scape of the proxied backend service 1942589 - cluster became offline after apiserver health check 1943208 - CVE-2021-23362 nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() 1944822 - CVE-2021-29418 nodejs-netmask: incorrectly parses an IP address that has octal integer with invalid character 1944827 - CVE-2021-28918 nodejs-netmask: improper input validation of octal input data 1945459 - CVE-2020-28469 nodejs-glob-parent: Regular expression denial of service 1948761 - CVE-2021-23369 nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option 1948763 - CVE-2021-23368 nodejs-postcss: Regular expression denial of service during source map parsing 1954150 - CVE-2021-23382 nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js 1954368 - CVE-2021-29482 ulikunitz/xz: Infinite loop in readUvarint allows for denial of service 1955619 - CVE-2021-23364 browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS) 1956688 - CVE-2021-23383 nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option 1956818 - CVE-2021-23343 nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe 1957410 - CVE-2021-29477 redis: Integer overflow via STRALGO LCS command 1957414 - CVE-2021-29478 redis: Integer overflow via COPY command for large intsets 1964461 - CVE-2021-33502 normalize-url: ReDoS for data URLs 1966615 - CVE-2021-33623 nodejs-trim-newlines: ReDoS in .end() method 1968122 - clusterdeployment fails because hiveadmission sc does not have correct permissions 1972703 - Subctl fails to join cluster, since it cannot auto-generate a valid cluster id 1983131 - Defragmenting an etcd member doesn't reduce the DB size (7.5GB) on a setup with ~1000 spoke clusters 5. Solution: For OpenShift Container Platform 4.7 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.7/release_notes/ocp-4-7-rel ease-notes.html For Red Hat OpenShift Logging 5.0, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-u pgrading.html 4. Bugs fixed (https://bugzilla.redhat.com/): 1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation 5. JIRA issues fixed (https://issues.jboss.org/): LOG-1328 - Port fix to 5.0.z for BZ-1945168 6. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP8 security update Advisory ID: RHSA-2021:2472-01 Product: Red Hat JBoss Core Services Advisory URL: https://access.redhat.com/errata/RHSA-2021:2472 Issue date: 2021-06-17 CVE Names: CVE-2020-8169 CVE-2020-8284 CVE-2020-8285 CVE-2020-8286 CVE-2021-22876 CVE-2021-22890 CVE-2021-22901 CVE-2021-31618 ===================================================================== 1. Summary: Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss Core Services on RHEL 7 Server - noarch, ppc64, x86_64 Red Hat JBoss Core Services on RHEL 8 - noarch, x86_64 3. Description: This release adds the new Apache HTTP Server 2.4.37 Service Pack 8 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 7 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es): * curl: Use-after-free in TLS session handling when using OpenSSL TLS backend (CVE-2021-22901) * httpd: NULL pointer dereference on specially crafted HTTP/2 request (CVE-2021-31618) * libcurl: partial password leak over DNS on HTTP redirect (CVE-2020-8169) * curl: FTP PASV command response can cause curl to connect to arbitrary host (CVE-2020-8284) * curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used (CVE-2020-8285) * curl: Inferior OCSP verification (CVE-2020-8286) * curl: Leak of authentication credentials in URL via automatic Referer (CVE-2021-22876) * curl: TLS 1.3 session ticket mix-up with HTTPS proxy host (CVE-2021-22890) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. Applications using the APR libraries, such as httpd, must be restarted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1847916 - CVE-2020-8169 libcurl: partial password leak over DNS on HTTP redirect 1902667 - CVE-2020-8284 curl: FTP PASV command response can cause curl to connect to arbitrary host 1902687 - CVE-2020-8285 curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used 1906096 - CVE-2020-8286 curl: Inferior OCSP verification 1941964 - CVE-2021-22876 curl: Leak of authentication credentials in URL via automatic Referer 1941965 - CVE-2021-22890 curl: TLS 1.3 session ticket mix-up with HTTPS proxy host 1963146 - CVE-2021-22901 curl: Use-after-free in TLS session handling when using OpenSSL TLS backend 1968013 - CVE-2021-31618 httpd: NULL pointer dereference on specially crafted HTTP/2 request 6. Package List: Red Hat JBoss Core Services on RHEL 7 Server: Source: jbcs-httpd24-1-18.jbcs.el7.src.rpm jbcs-httpd24-apr-1.6.3-105.jbcs.el7.src.rpm jbcs-httpd24-apr-util-1.6.1-82.jbcs.el7.src.rpm jbcs-httpd24-curl-7.77.0-2.jbcs.el7.src.rpm jbcs-httpd24-httpd-2.4.37-74.jbcs.el7.src.rpm jbcs-httpd24-jansson-2.11-55.jbcs.el7.src.rpm jbcs-httpd24-mod_cluster-native-1.3.16-5.Final_redhat_2.jbcs.el7.src.rpm jbcs-httpd24-mod_http2-1.15.7-17.jbcs.el7.src.rpm jbcs-httpd24-mod_jk-1.2.48-16.redhat_1.jbcs.el7.src.rpm jbcs-httpd24-mod_md-2.0.8-36.jbcs.el7.src.rpm jbcs-httpd24-mod_security-2.9.2-63.GA.jbcs.el7.src.rpm noarch: jbcs-httpd24-httpd-manual-2.4.37-74.jbcs.el7.noarch.rpm ppc64: jbcs-httpd24-1-18.jbcs.el7.ppc64.rpm jbcs-httpd24-curl-7.77.0-2.jbcs.el7.ppc64.rpm jbcs-httpd24-curl-debuginfo-7.77.0-2.jbcs.el7.ppc64.rpm jbcs-httpd24-jansson-2.11-55.jbcs.el7.ppc64.rpm jbcs-httpd24-jansson-debuginfo-2.11-55.jbcs.el7.ppc64.rpm jbcs-httpd24-jansson-devel-2.11-55.jbcs.el7.ppc64.rpm jbcs-httpd24-libcurl-7.77.0-2.jbcs.el7.ppc64.rpm jbcs-httpd24-libcurl-devel-7.77.0-2.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_http2-1.15.7-17.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_http2-debuginfo-1.15.7-17.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_md-2.0.8-36.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_md-debuginfo-2.0.8-36.jbcs.el7.ppc64.rpm jbcs-httpd24-runtime-1-18.jbcs.el7.ppc64.rpm x86_64: jbcs-httpd24-1-18.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-1.6.3-105.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-debuginfo-1.6.3-105.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-devel-1.6.3-105.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-debuginfo-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-devel-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-ldap-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-mysql-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-nss-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-odbc-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-openssl-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-pgsql-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-sqlite-1.6.1-82.jbcs.el7.x86_64.rpm jbcs-httpd24-curl-7.77.0-2.jbcs.el7.x86_64.rpm jbcs-httpd24-curl-debuginfo-7.77.0-2.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-debuginfo-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-devel-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-selinux-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-tools-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-jansson-2.11-55.jbcs.el7.x86_64.rpm jbcs-httpd24-jansson-debuginfo-2.11-55.jbcs.el7.x86_64.rpm jbcs-httpd24-jansson-devel-2.11-55.jbcs.el7.x86_64.rpm jbcs-httpd24-libcurl-7.77.0-2.jbcs.el7.x86_64.rpm jbcs-httpd24-libcurl-devel-7.77.0-2.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_cluster-native-1.3.16-5.Final_redhat_2.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_cluster-native-debuginfo-1.3.16-5.Final_redhat_2.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_http2-1.15.7-17.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_http2-debuginfo-1.15.7-17.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_jk-ap24-1.2.48-16.redhat_1.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_jk-debuginfo-1.2.48-16.redhat_1.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_jk-manual-1.2.48-16.redhat_1.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_ldap-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_md-2.0.8-36.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_md-debuginfo-2.0.8-36.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_proxy_html-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_security-2.9.2-63.GA.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_security-debuginfo-2.9.2-63.GA.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_session-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_ssl-2.4.37-74.jbcs.el7.x86_64.rpm jbcs-httpd24-runtime-1-18.jbcs.el7.x86_64.rpm Red Hat JBoss Core Services on RHEL 8: Source: jbcs-httpd24-1-18.el8jbcs.src.rpm jbcs-httpd24-apr-1.6.3-105.el8jbcs.src.rpm jbcs-httpd24-apr-util-1.6.1-82.el8jbcs.src.rpm jbcs-httpd24-brotli-1.0.6-40.el8jbcs.src.rpm jbcs-httpd24-curl-7.77.0-2.el8jbcs.src.rpm jbcs-httpd24-httpd-2.4.37-74.el8jbcs.src.rpm jbcs-httpd24-jansson-2.11-55.el8jbcs.src.rpm jbcs-httpd24-mod_cluster-native-1.3.16-5.Final_redhat_2.el8jbcs.src.rpm jbcs-httpd24-mod_http2-1.15.7-17.el8jbcs.src.rpm jbcs-httpd24-mod_jk-1.2.48-16.redhat_1.el8jbcs.src.rpm jbcs-httpd24-mod_md-2.0.8-36.el8jbcs.src.rpm jbcs-httpd24-mod_security-2.9.2-63.GA.el8jbcs.src.rpm jbcs-httpd24-nghttp2-1.39.2-37.el8jbcs.src.rpm jbcs-httpd24-openssl-1.1.1g-6.el8jbcs.src.rpm jbcs-httpd24-openssl-chil-1.0.0-5.el8jbcs.src.rpm jbcs-httpd24-openssl-pkcs11-0.4.10-20.el8jbcs.src.rpm noarch: jbcs-httpd24-httpd-manual-2.4.37-74.el8jbcs.noarch.rpm x86_64: jbcs-httpd24-1-18.el8jbcs.x86_64.rpm jbcs-httpd24-apr-1.6.3-105.el8jbcs.x86_64.rpm jbcs-httpd24-apr-debuginfo-1.6.3-105.el8jbcs.x86_64.rpm jbcs-httpd24-apr-devel-1.6.3-105.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-devel-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-ldap-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-ldap-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-mysql-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-mysql-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-nss-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-nss-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-odbc-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-odbc-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-openssl-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-openssl-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-pgsql-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-pgsql-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-sqlite-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-apr-util-sqlite-debuginfo-1.6.1-82.el8jbcs.x86_64.rpm jbcs-httpd24-brotli-1.0.6-40.el8jbcs.x86_64.rpm jbcs-httpd24-brotli-debuginfo-1.0.6-40.el8jbcs.x86_64.rpm jbcs-httpd24-brotli-devel-1.0.6-40.el8jbcs.x86_64.rpm jbcs-httpd24-curl-7.77.0-2.el8jbcs.x86_64.rpm jbcs-httpd24-curl-debuginfo-7.77.0-2.el8jbcs.x86_64.rpm jbcs-httpd24-httpd-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-httpd-debuginfo-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-httpd-devel-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-httpd-selinux-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-httpd-tools-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-httpd-tools-debuginfo-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-jansson-2.11-55.el8jbcs.x86_64.rpm jbcs-httpd24-jansson-debuginfo-2.11-55.el8jbcs.x86_64.rpm jbcs-httpd24-jansson-devel-2.11-55.el8jbcs.x86_64.rpm jbcs-httpd24-libcurl-7.77.0-2.el8jbcs.x86_64.rpm jbcs-httpd24-libcurl-debuginfo-7.77.0-2.el8jbcs.x86_64.rpm jbcs-httpd24-libcurl-devel-7.77.0-2.el8jbcs.x86_64.rpm jbcs-httpd24-mod_cluster-native-1.3.16-5.Final_redhat_2.el8jbcs.x86_64.rpm jbcs-httpd24-mod_cluster-native-debuginfo-1.3.16-5.Final_redhat_2.el8jbcs.x86_64.rpm jbcs-httpd24-mod_http2-1.15.7-17.el8jbcs.x86_64.rpm jbcs-httpd24-mod_http2-debuginfo-1.15.7-17.el8jbcs.x86_64.rpm jbcs-httpd24-mod_jk-ap24-1.2.48-16.redhat_1.el8jbcs.x86_64.rpm jbcs-httpd24-mod_jk-ap24-debuginfo-1.2.48-16.redhat_1.el8jbcs.x86_64.rpm jbcs-httpd24-mod_jk-manual-1.2.48-16.redhat_1.el8jbcs.x86_64.rpm jbcs-httpd24-mod_ldap-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_ldap-debuginfo-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_md-2.0.8-36.el8jbcs.x86_64.rpm jbcs-httpd24-mod_md-debuginfo-2.0.8-36.el8jbcs.x86_64.rpm jbcs-httpd24-mod_proxy_html-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_proxy_html-debuginfo-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_security-2.9.2-63.GA.el8jbcs.x86_64.rpm jbcs-httpd24-mod_security-debuginfo-2.9.2-63.GA.el8jbcs.x86_64.rpm jbcs-httpd24-mod_session-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_session-debuginfo-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_ssl-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-mod_ssl-debuginfo-2.4.37-74.el8jbcs.x86_64.rpm jbcs-httpd24-nghttp2-1.39.2-37.el8jbcs.x86_64.rpm jbcs-httpd24-nghttp2-debuginfo-1.39.2-37.el8jbcs.x86_64.rpm jbcs-httpd24-nghttp2-devel-1.39.2-37.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-chil-1.0.0-5.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-chil-debuginfo-1.0.0-5.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-debuginfo-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-devel-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-libs-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-libs-debuginfo-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-perl-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-pkcs11-0.4.10-20.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-pkcs11-debuginfo-0.4.10-20.el8jbcs.x86_64.rpm jbcs-httpd24-openssl-static-1.1.1g-6.el8jbcs.x86_64.rpm jbcs-httpd24-runtime-1-18.el8jbcs.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-8169 https://access.redhat.com/security/cve/CVE-2020-8284 https://access.redhat.com/security/cve/CVE-2020-8285 https://access.redhat.com/security/cve/CVE-2020-8286 https://access.redhat.com/security/cve/CVE-2021-22876 https://access.redhat.com/security/cve/CVE-2021-22890 https://access.redhat.com/security/cve/CVE-2021-22901 https://access.redhat.com/security/cve/CVE-2021-31618 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYMs2wNzjgjWX9erEAQiuqA//Wj88udaE82j3T1g70vO9Zf9s0Ym+xAWi SmIBQfiNIh9WRy9Jp6DqIxPtG7HQ+++VwXU2lx9LjXuicsQnmKRjdQtvYtqbCzbq uOrxFeLSK1AeI0ic9wo5a7JHxyzcg9yTxCIw8QtTzqpJjJHWTBK/xtiYp9V6A2xF NaXdlAyCRfje+0+EygZGBdX5UD6cr8vTLPtVmp2t+NfvyB7YQaHwSMi7ZzKvmN61 ZLj5++qEWde9k8zovupYAAe9suIwzaL4bdgbwdSyFYH/CDA1E9oyo22inzO4iaka ixwuhI8rnToaVLNyn7p/Ra585stBQ1GUE27dJBvlabYa35gdoVVy+e0mRsQ/pS3R vE48A9yOLhSaof8l2ZDQRuhr6KBFFEvdln7TcftIdQG7/iTVo0R03AxigGGn1bSv HQ911R6wcPAU300VfeIo5btkbJCPBHoovYCBJYBVlF5wjQ7RCWlr9VrX/wqMun68 8IrfPX8j4PIwUvxPygqIFUjg0xZHWiVN8H6tNeJKD8kHfv/4vCIOo9ZWxFI5VFV/ /2pqWtm5tnf3yfqFn8Z6OrkaQFR8q0jg0d2VLS4AmKC4joLTXvBZVKLEfLF+HGlO QnEYJ2EhDWHSU+ZViI/anzTRnN5tBxNxqsPn7rfTXLmxxwkUH9hgaCzVMG5MXYOZ lIrXPlR2tmY= =6HuS -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Bugs fixed (https://bugzilla.redhat.com/): 1897635 - CVE-2020-28362 golang: math/big: panic during recursive division of very large numbers 1918750 - CVE-2021-3114 golang: crypto/elliptic: incorrect operations on the P-224 curve 1928172 - CVE-2020-13949 libthrift: potential DoS when processing untrusted payloads 1928937 - CVE-2021-23337 nodejs-lodash: command injection via template 1928954 - CVE-2020-28500 nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions 5. ========================================================================== Ubuntu Security Notice USN-4665-1 December 09, 2020 curl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in curl. Software Description: - curl: HTTP, HTTPS, and FTP client and client libraries Details: Marc Aldorasi discovered that curl incorrectly handled the libcurl CURLOPT_CONNECT_ONLY option. This could result in data being sent to the wrong destination, possibly exposing sensitive information. This issue only affected Ubuntu 20.10. (CVE-2020-8231) Varnavas Papaioannou discovered that curl incorrectly handled FTP PASV responses. (CVE-2020-8284) It was discovered that curl incorrectly handled FTP wildcard matchins. A remote attacker could possibly use this issue to cause curl to consume resources and crash, resulting in a denial of service. (CVE-2020-8285) It was discovered that curl incorrectly handled OCSP response verification. A remote attacker could possibly use this issue to provide a fraudulent OCSP response. (CVE-2020-8286) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.10: curl 7.68.0-1ubuntu4.2 libcurl3-gnutls 7.68.0-1ubuntu4.2 libcurl3-nss 7.68.0-1ubuntu4.2 libcurl4 7.68.0-1ubuntu4.2 Ubuntu 20.04 LTS: curl 7.68.0-1ubuntu2.4 libcurl3-gnutls 7.68.0-1ubuntu2.4 libcurl3-nss 7.68.0-1ubuntu2.4 libcurl4 7.68.0-1ubuntu2.4 Ubuntu 18.04 LTS: curl 7.58.0-2ubuntu3.12 libcurl3-gnutls 7.58.0-2ubuntu3.12 libcurl3-nss 7.58.0-2ubuntu3.12 libcurl4 7.58.0-2ubuntu3.12 Ubuntu 16.04 LTS: curl 7.47.0-1ubuntu2.18 libcurl3 7.47.0-1ubuntu2.18 libcurl3-gnutls 7.47.0-1ubuntu2.18 libcurl3-nss 7.47.0-1ubuntu2.18 In general, a standard system update will make all the necessary changes. Description: Red Hat OpenShift Serverless 1.17.0 release of the OpenShift Serverless Operator. Security Fix(es): * golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558) * golang: net: lookup functions may return invalid host names (CVE-2021-33195) * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197) * golang: match/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198) * golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader (CVE-2021-27918) * golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header (CVE-2021-31525) * golang: archive/zip: malformed archive may cause panic or memory exhaustion (CVE-2021-33196) It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless client kn 1.16.0. This has been fixed (CVE-2021-3703). For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bugs fixed (https://bugzilla.redhat.com/): 1983596 - CVE-2021-34558 golang: crypto/tls: certificate of wrong type is causing TLS client to panic 1983651 - Release of OpenShift Serverless Serving 1.17.0 1983654 - Release of OpenShift Serverless Eventing 1.17.0 1989564 - CVE-2021-33195 golang: net: lookup functions may return invalid host names 1989570 - CVE-2021-33197 golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty 1989575 - CVE-2021-33198 golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents 1992955 - CVE-2021-3703 serverless: incomplete fix for CVE-2021-27918 / CVE-2021-31525 / CVE-2021-33196 5

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

TYPE

overflow, code execution, xss

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2025-04-01T20:32:39.221000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE