Red Hat Enterprise Linux

A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.

Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes

Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.

P11-kit: null dereference via c_derivekey with specific null parameters

A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.

Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

M2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657

Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659

A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.

Libdwarf: crashes randomly on fuzzed object

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

Multiple SQL injection vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by login_up.php3 and certain other files.

Multiple SQL injection vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by file-manager/ and certain other files.

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

Libxml2: libxml2: denial of service via crafted xsd-validated document

Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

Cri-o: pods are able to break out of resource confinement on cgroupv2

Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced

Eap-7: heap exhaustion via deserialization

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not allow the administrator to disable SSLv2 encryption, which could cause less secure channels to be used than desired.

Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime

Python-eventlet: patch regression for cve-2021-21419 in some red hat builds

Poppler: pdfinfo: crash in broken documents when using -dests parameter

Eap-galleon: custom provisioning creates unsecured http-invoker

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

Libssh: libssh: use-after-free via data callbacks on closed channels

Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.

Ocp & fips mode

Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

Libssh: libssh: denial of service via automatic certificate authentication loop

Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create()

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read