ID

VAR-202104-1841

CVE

CVE-2020-10001

TITLE

macOS  Input verification vulnerability in

DESCRIPTION

An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to read restricted memory. macOS There is an input validation vulnerability in.Information may be obtained. SUSE Linux Enterprise Desktop is an enterprise server version of Linux desktop operating system of German SUSE company. There is a security vulnerability in SUSE Linux Enterprise Desktop. Attackers can use this vulnerability to forcibly read invalid addresses through the Extension field of CUPS to trigger denial of service or obtain sensitive information. A security issue was found in cups before version 2.3.3op2. A missing length check in the ippReadIO function could lead to a buffer over-read. Bugs fixed (https://bugzilla.redhat.com/): 2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: cups security and bug fix update Advisory ID: RHSA-2021:4393-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4393 Issue date: 2021-11-09 CVE Names: CVE-2020-10001 ==================================================================== 1. Summary: An update for cups is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: access to uninitialized buffer in ipp.c (CVE-2020-10001) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the cupsd service will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1782216 - Print queue is paused after ipp backend ends with CUPS_BACKEND_STOP 1921680 - CVE-2020-10001 cups: access to uninitialized buffer in ipp.c 1938384 - CUPS doesn't start if sssd starts after cupsd 1941437 - cupsd doesn't log job ids when logging into journal 1955964 - PreserveJobHistory doesn't work with seconds 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): aarch64: cups-2.2.6-40.el8.aarch64.rpm cups-client-2.2.6-40.el8.aarch64.rpm cups-client-debuginfo-2.2.6-40.el8.aarch64.rpm cups-debuginfo-2.2.6-40.el8.aarch64.rpm cups-debugsource-2.2.6-40.el8.aarch64.rpm cups-devel-2.2.6-40.el8.aarch64.rpm cups-ipptool-2.2.6-40.el8.aarch64.rpm cups-ipptool-debuginfo-2.2.6-40.el8.aarch64.rpm cups-libs-debuginfo-2.2.6-40.el8.aarch64.rpm cups-lpd-2.2.6-40.el8.aarch64.rpm cups-lpd-debuginfo-2.2.6-40.el8.aarch64.rpm noarch: cups-filesystem-2.2.6-40.el8.noarch.rpm ppc64le: cups-2.2.6-40.el8.ppc64le.rpm cups-client-2.2.6-40.el8.ppc64le.rpm cups-client-debuginfo-2.2.6-40.el8.ppc64le.rpm cups-debuginfo-2.2.6-40.el8.ppc64le.rpm cups-debugsource-2.2.6-40.el8.ppc64le.rpm cups-devel-2.2.6-40.el8.ppc64le.rpm cups-ipptool-2.2.6-40.el8.ppc64le.rpm cups-ipptool-debuginfo-2.2.6-40.el8.ppc64le.rpm cups-libs-debuginfo-2.2.6-40.el8.ppc64le.rpm cups-lpd-2.2.6-40.el8.ppc64le.rpm cups-lpd-debuginfo-2.2.6-40.el8.ppc64le.rpm s390x: cups-2.2.6-40.el8.s390x.rpm cups-client-2.2.6-40.el8.s390x.rpm cups-client-debuginfo-2.2.6-40.el8.s390x.rpm cups-debuginfo-2.2.6-40.el8.s390x.rpm cups-debugsource-2.2.6-40.el8.s390x.rpm cups-devel-2.2.6-40.el8.s390x.rpm cups-ipptool-2.2.6-40.el8.s390x.rpm cups-ipptool-debuginfo-2.2.6-40.el8.s390x.rpm cups-libs-debuginfo-2.2.6-40.el8.s390x.rpm cups-lpd-2.2.6-40.el8.s390x.rpm cups-lpd-debuginfo-2.2.6-40.el8.s390x.rpm x86_64: cups-2.2.6-40.el8.x86_64.rpm cups-client-2.2.6-40.el8.x86_64.rpm cups-client-debuginfo-2.2.6-40.el8.i686.rpm cups-client-debuginfo-2.2.6-40.el8.x86_64.rpm cups-debuginfo-2.2.6-40.el8.i686.rpm cups-debuginfo-2.2.6-40.el8.x86_64.rpm cups-debugsource-2.2.6-40.el8.i686.rpm cups-debugsource-2.2.6-40.el8.x86_64.rpm cups-devel-2.2.6-40.el8.i686.rpm cups-devel-2.2.6-40.el8.x86_64.rpm cups-ipptool-2.2.6-40.el8.x86_64.rpm cups-ipptool-debuginfo-2.2.6-40.el8.i686.rpm cups-ipptool-debuginfo-2.2.6-40.el8.x86_64.rpm cups-libs-debuginfo-2.2.6-40.el8.i686.rpm cups-libs-debuginfo-2.2.6-40.el8.x86_64.rpm cups-lpd-2.2.6-40.el8.x86_64.rpm cups-lpd-debuginfo-2.2.6-40.el8.i686.rpm cups-lpd-debuginfo-2.2.6-40.el8.x86_64.rpm Red Hat Enterprise Linux BaseOS (v. 8): Source: cups-2.2.6-40.el8.src.rpm aarch64: cups-client-debuginfo-2.2.6-40.el8.aarch64.rpm cups-debuginfo-2.2.6-40.el8.aarch64.rpm cups-debugsource-2.2.6-40.el8.aarch64.rpm cups-ipptool-debuginfo-2.2.6-40.el8.aarch64.rpm cups-libs-2.2.6-40.el8.aarch64.rpm cups-libs-debuginfo-2.2.6-40.el8.aarch64.rpm cups-lpd-debuginfo-2.2.6-40.el8.aarch64.rpm ppc64le: cups-client-debuginfo-2.2.6-40.el8.ppc64le.rpm cups-debuginfo-2.2.6-40.el8.ppc64le.rpm cups-debugsource-2.2.6-40.el8.ppc64le.rpm cups-ipptool-debuginfo-2.2.6-40.el8.ppc64le.rpm cups-libs-2.2.6-40.el8.ppc64le.rpm cups-libs-debuginfo-2.2.6-40.el8.ppc64le.rpm cups-lpd-debuginfo-2.2.6-40.el8.ppc64le.rpm s390x: cups-client-debuginfo-2.2.6-40.el8.s390x.rpm cups-debuginfo-2.2.6-40.el8.s390x.rpm cups-debugsource-2.2.6-40.el8.s390x.rpm cups-ipptool-debuginfo-2.2.6-40.el8.s390x.rpm cups-libs-2.2.6-40.el8.s390x.rpm cups-libs-debuginfo-2.2.6-40.el8.s390x.rpm cups-lpd-debuginfo-2.2.6-40.el8.s390x.rpm x86_64: cups-client-debuginfo-2.2.6-40.el8.i686.rpm cups-client-debuginfo-2.2.6-40.el8.x86_64.rpm cups-debuginfo-2.2.6-40.el8.i686.rpm cups-debuginfo-2.2.6-40.el8.x86_64.rpm cups-debugsource-2.2.6-40.el8.i686.rpm cups-debugsource-2.2.6-40.el8.x86_64.rpm cups-ipptool-debuginfo-2.2.6-40.el8.i686.rpm cups-ipptool-debuginfo-2.2.6-40.el8.x86_64.rpm cups-libs-2.2.6-40.el8.i686.rpm cups-libs-2.2.6-40.el8.x86_64.rpm cups-libs-debuginfo-2.2.6-40.el8.i686.rpm cups-libs-debuginfo-2.2.6-40.el8.x86_64.rpm cups-lpd-debuginfo-2.2.6-40.el8.i686.rpm cups-lpd-debuginfo-2.2.6-40.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-10001 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYYrdptzjgjWX9erEAQifnA//fTvcvlIMMRvl8mpYAZuZ9Tv8ZLKYT62j LfH/kVsjq5mJDCPUErwq7XgWN0RfhXaV7dPvB/FbCR1Vh4xtrQEev9JsOkP4g/3z WeuNvlfEtgNcSTSeVJEgIDPi1Dqr4PfNfcy81PWzU0T9K2i17BAIlqVcE7N8Zq71 azP5IT5M7xZU21PbqnDy5ULgb5CVtexslxemufa7kkeRDTl8FjeSq7nWXV4DWAjP 2W9/wzHfGgXtMn4wp/64knWPFROocKiwhj69YTGgPecvdvWHnIkZ9cwWSpAT0LIj SIxRTZoGyusouZZV8gchVS9qtsl4VP1B15QF2C1FK8kiJfEaxeJVH9Kf89QLsX8s ZtVMW4WlqWyBI0kmCL4Yz/bxkBnQuhzgbb+tO4347gpaXpW6zwTu8qp2iYBYHFyX EQFaxYTXaV9kxHgkDNqnw5m5Fi+Q/hz7sZcX8485BbDeqbqqVdi2QdvCsCtPcIgj GTp0dTOwoJc/3o35e6cv4uNdQcqxfgfTBhhkqWOS4jzDRNQL5MOrTKql3D/NJSA3 jb/RahyZkSGxYKTwae4qZKEixeL4hNyU+hYZHUYKb4VxAsn9Y9iOGO43u+LLw4Rp 1e/HKPV+cv741Ph4POP8cgrCe2FZNO4sRU4Ac6bL2uPPDZBhYyQYaHEsB9dFSEzc SCmYx2xwC+4=1Pv7 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Summary: The Migration Toolkit for Containers (MTC) 1.6.3 is now available. Description: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Solution: For details on how to install and use MTC, refer to: https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html 4. Bugs fixed (https://bugzilla.redhat.com/): 2019088 - "MigrationController" CR displays syntax error when unquiescing applications 2021666 - Route name longer than 63 characters causes direct volume migration to fail 2021668 - "MigrationController" CR ignores the "cluster_subdomain" value for direct volume migration routes 2022017 - CVE-2021-3948 mig-controller: incorrect namespaces handling may lead to not authorized usage of Migration Toolkit for Containers (MTC) 2024966 - Manifests not used by Operator Lifecycle Manager must be removed from the MTC 1.6 Operator image 2027196 - "migration-controller" pod goes into "CrashLoopBackoff" state if an invalid registry route is entered on the "Clusters" page of the web console 2027382 - "Copy oc describe/oc logs" window does not close automatically after timeout 2028841 - "rsync-client" container fails during direct volume migration with "Address family not supported by protocol" error 2031793 - "migration-controller" pod goes into "CrashLoopBackOff" state if "MigPlan" CR contains an invalid "includedResources" resource 2039852 - "migration-controller" pod goes into "CrashLoopBackOff" state if "MigPlan" CR contains an invalid "destMigClusterRef" or "srcMigClusterRef" 5. Solution: For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html For Red Hat OpenShift Logging 5.3, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html 4. Bugs fixed (https://bugzilla.redhat.com/): 1963232 - CVE-2021-33194 golang: x/net/html: infinite loop in ParseFragment 5. JIRA issues fixed (https://issues.jboss.org/): LOG-1168 - Disable hostname verification in syslog TLS settings LOG-1235 - Using HTTPS without a secret does not translate into the correct 'scheme' value in Fluentd LOG-1375 - ssl_ca_cert should be optional LOG-1378 - CLO should support sasl_plaintext(Password over http) LOG-1392 - In fluentd config, flush_interval can't be set with flush_mode=immediate LOG-1494 - Syslog output is serializing json incorrectly LOG-1555 - Fluentd logs emit transaction failed: error_class=NoMethodError while forwarding to external syslog server LOG-1575 - Rejected by Elasticsearch and unexpected json-parsing LOG-1735 - Regression introducing flush_at_shutdown LOG-1774 - The collector logs should be excluded in fluent.conf LOG-1776 - fluentd total_limit_size sets value beyond available space LOG-1822 - OpenShift Alerting Rules Style-Guide Compliance LOG-1859 - CLO Should not error and exit early on missing ca-bundle when cluster wide proxy is not enabled LOG-1862 - Unsupported kafka parameters when enabled Kafka SASL LOG-1903 - Fix the Display of ClusterLogging type in OLM LOG-1911 - CLF API changes to Opt-in to multiline error detection LOG-1918 - Alert `FluentdNodeDown` always firing LOG-1939 - Opt-in multiline detection breaks cloudwatch forwarding 6

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

input validation error

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2024-08-14T13:03:58.946000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE