Hope to see you there.
https://www.nycbug.org/index?action=view&id=10693
Patrick McEvoy
_______________________________________________
announce mailing list
announce@lists.nycbug.org
https://lists.nycbug.org:8443/mailman/listinfo/announce
Wednesday, January 10, 2024
[USN-6575-1] Twisted vulnerabilities
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmWesTQACgkQZWnYVadE
vpP2ew//SBM/KQhxCK1Kj9tQeL3joyLVEsLoivV89kPmltgFWzuoybRNjdzgO+us
dZtlsClIIaH5MPB/rchrmrNhNGS4NyuvbUHiDHkwF0s9Vq78qTUfj02uoMP5teRS
01CTC7ETSNnpmn4b7domm3XRdH+78EQElvn6esuqal4wg9T71czIigeSU3w5z4bL
EtigkvRs2+dbeuy3DNApj7h4++SarJmrdvjVO+3/bVkMiOtNRlBWXwjzwF9pnNU2
c85j1LkgPq3QrQzdV3XYKKuKFzyUhbYtD9SLNHFCsiUEZgAl0VrTmO5mVgShojHM
KIbySImTU19+tykxSIwoZQvn/ZEBr0rrVXuW1zSLxDsxd+WupOCfZmG/nPWrVqz+
3mpmo1ipxo9CZMs7zZoBNV2YSrV0shlzaNbNiGwUXELqVIpOJvmXtSZcZhjImHQm
bMJhA5oVosYvXtwB1GDOORTQdG2dOMFGfnBs+CW7dJhDWhNNRViSCh0zQrOj6+3P
KI78Ed3eGsQ03MGb0dnx+1GSw8shHGO2Do3PIrHyPu4ttu3IIiY8a9jxkNfS8fZv
Lc4XxFDGGvoLRADr/Mr6gAhC65g8VIeFwwIYiv9bODfaIj5J6O4EkTjWSuFIdRmI
dlLIh9u0UR8tsBzplucYiaE1CYzrzKCnSSpVBOM9L+e6g1VzuFs=
=pIur
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6575-1
January 10, 2024
twisted vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Twisted.
Software Description:
- twisted: Event-based framework for internet applications
Details:
It was discovered that Twisted incorrectly escaped host headers in certain
404 responses. A remote attacker could possibly use this issue to perform
HTML and script injection attacks. This issue only affected Ubuntu 20.04
LTS and Ubuntu 22.04 LTS. (CVE-2022-39348)
It was discovered that Twisted incorrectly handled response order when
processing multiple HTTP requests. A remote attacker could possibly use
this issue to delay responses and manipulate the responses of second
requests. (CVE-2023-46137)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
python3-twisted 22.4.0-4ubuntu0.23.10.1
Ubuntu 23.04:
python3-twisted 22.4.0-4ubuntu0.23.04.1
Ubuntu 22.04 LTS:
python3-twisted 22.1.0-2ubuntu2.4
Ubuntu 20.04 LTS:
python3-twisted 18.9.0-11ubuntu0.20.04.3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6575-1
CVE-2022-39348, CVE-2023-46137
Package Information:
https://launchpad.net/ubuntu/+source/twisted/22.4.0-4ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/twisted/22.4.0-4ubuntu0.23.04.1
https://launchpad.net/ubuntu/+source/twisted/22.1.0-2ubuntu2.4
https://launchpad.net/ubuntu/+source/twisted/18.9.0-11ubuntu0.20.04.3
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmWesTQACgkQZWnYVadE
vpP2ew//SBM/KQhxCK1Kj9tQeL3joyLVEsLoivV89kPmltgFWzuoybRNjdzgO+us
dZtlsClIIaH5MPB/rchrmrNhNGS4NyuvbUHiDHkwF0s9Vq78qTUfj02uoMP5teRS
01CTC7ETSNnpmn4b7domm3XRdH+78EQElvn6esuqal4wg9T71czIigeSU3w5z4bL
EtigkvRs2+dbeuy3DNApj7h4++SarJmrdvjVO+3/bVkMiOtNRlBWXwjzwF9pnNU2
c85j1LkgPq3QrQzdV3XYKKuKFzyUhbYtD9SLNHFCsiUEZgAl0VrTmO5mVgShojHM
KIbySImTU19+tykxSIwoZQvn/ZEBr0rrVXuW1zSLxDsxd+WupOCfZmG/nPWrVqz+
3mpmo1ipxo9CZMs7zZoBNV2YSrV0shlzaNbNiGwUXELqVIpOJvmXtSZcZhjImHQm
bMJhA5oVosYvXtwB1GDOORTQdG2dOMFGfnBs+CW7dJhDWhNNRViSCh0zQrOj6+3P
KI78Ed3eGsQ03MGb0dnx+1GSw8shHGO2Do3PIrHyPu4ttu3IIiY8a9jxkNfS8fZv
Lc4XxFDGGvoLRADr/Mr6gAhC65g8VIeFwwIYiv9bODfaIj5J6O4EkTjWSuFIdRmI
dlLIh9u0UR8tsBzplucYiaE1CYzrzKCnSSpVBOM9L+e6g1VzuFs=
=pIur
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6575-1
January 10, 2024
twisted vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Twisted.
Software Description:
- twisted: Event-based framework for internet applications
Details:
It was discovered that Twisted incorrectly escaped host headers in certain
404 responses. A remote attacker could possibly use this issue to perform
HTML and script injection attacks. This issue only affected Ubuntu 20.04
LTS and Ubuntu 22.04 LTS. (CVE-2022-39348)
It was discovered that Twisted incorrectly handled response order when
processing multiple HTTP requests. A remote attacker could possibly use
this issue to delay responses and manipulate the responses of second
requests. (CVE-2023-46137)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
python3-twisted 22.4.0-4ubuntu0.23.10.1
Ubuntu 23.04:
python3-twisted 22.4.0-4ubuntu0.23.04.1
Ubuntu 22.04 LTS:
python3-twisted 22.1.0-2ubuntu2.4
Ubuntu 20.04 LTS:
python3-twisted 18.9.0-11ubuntu0.20.04.3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6575-1
CVE-2022-39348, CVE-2023-46137
Package Information:
https://launchpad.net/ubuntu/+source/twisted/22.4.0-4ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/twisted/22.4.0-4ubuntu0.23.04.1
https://launchpad.net/ubuntu/+source/twisted/22.1.0-2ubuntu2.4
https://launchpad.net/ubuntu/+source/twisted/18.9.0-11ubuntu0.20.04.3
[USN-6541-2] GNU C Library regression
-----BEGIN PGP SIGNATURE-----
wsB5BAABCAAjFiEEGq96SdAIJY1vInRLbzAtCH6LqTYFAmWeolgFAwAAAAAACgkQbzAtCH6LqTbO
lAf/V8+uSsf7n6NRkRX+ggnpBqjYyuhCBHu5OSy7fmoLKyI6YA8AvAIzwJHDArjWaPVxHuG5WRxA
VGWZwKICawQRqY2j+f6+dVZcmfnRm+Rhh3ELnHGn0A/N6AwdD5t2CZn4Y7sBVL/TeNNiMNhhK3ZM
XKaoJBD7aAqKplvqvYPt/7zJ4YSiGRqQLqX0skTGNzzoW50bTPrcnypPfKmvtKmfjC/CK009slz0
ti/an3EIUAEZSaNqKZSASbQwFszejNAKFMmW4n5KX5mq1SqNR9brnqNIVxOrwG3vJvFICDlDUsXs
/UybGWBNYd5IwH0qy2jEpsTe370DXAF0f+QAkU13ZQ==
=j+qK
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6541-2
January 10, 2024
glibc regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
USN-6541-1 introduced a regression in the GNU C Library.
Software Description:
- glibc: GNU C Library
Details:
USN-6541-1 fixed vulnerabilities in the GNU C Library. Unfortunately,
changes made to allow proper application of the fix for CVE-2023-4806 in
Ubuntu 22.04 LTS introduced an issue in the NSCD service IPv6 processing
functionalities. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the GNU C Library was not properly handling certain
memory operations. An attacker could possibly use this issue to cause a
denial of service (application crash). (CVE-2023-4806, CVE-2023-4813)
It was discovered that the GNU C library was not properly implementing a
fix for CVE-2023-4806 in certain cases, which could lead to a memory leak.
An attacker could possibly use this issue to cause a denial of service
(application crash). This issue only affected Ubuntu 22.04 LTS and Ubuntu
23.04. (CVE-2023-5156)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
libc-bin 2.35-0ubuntu3.6
libc6 2.35-0ubuntu3.6
nscd 2.35-0ubuntu3.6
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6541-2
https://ubuntu.com/security/notices/USN-6541-1
https://launchpad.net/bugs/2047155
Package Information:
https://launchpad.net/ubuntu/+source/glibc/2.35-0ubuntu3.6
wsB5BAABCAAjFiEEGq96SdAIJY1vInRLbzAtCH6LqTYFAmWeolgFAwAAAAAACgkQbzAtCH6LqTbO
lAf/V8+uSsf7n6NRkRX+ggnpBqjYyuhCBHu5OSy7fmoLKyI6YA8AvAIzwJHDArjWaPVxHuG5WRxA
VGWZwKICawQRqY2j+f6+dVZcmfnRm+Rhh3ELnHGn0A/N6AwdD5t2CZn4Y7sBVL/TeNNiMNhhK3ZM
XKaoJBD7aAqKplvqvYPt/7zJ4YSiGRqQLqX0skTGNzzoW50bTPrcnypPfKmvtKmfjC/CK009slz0
ti/an3EIUAEZSaNqKZSASbQwFszejNAKFMmW4n5KX5mq1SqNR9brnqNIVxOrwG3vJvFICDlDUsXs
/UybGWBNYd5IwH0qy2jEpsTe370DXAF0f+QAkU13ZQ==
=j+qK
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6541-2
January 10, 2024
glibc regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
USN-6541-1 introduced a regression in the GNU C Library.
Software Description:
- glibc: GNU C Library
Details:
USN-6541-1 fixed vulnerabilities in the GNU C Library. Unfortunately,
changes made to allow proper application of the fix for CVE-2023-4806 in
Ubuntu 22.04 LTS introduced an issue in the NSCD service IPv6 processing
functionalities. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the GNU C Library was not properly handling certain
memory operations. An attacker could possibly use this issue to cause a
denial of service (application crash). (CVE-2023-4806, CVE-2023-4813)
It was discovered that the GNU C library was not properly implementing a
fix for CVE-2023-4806 in certain cases, which could lead to a memory leak.
An attacker could possibly use this issue to cause a denial of service
(application crash). This issue only affected Ubuntu 22.04 LTS and Ubuntu
23.04. (CVE-2023-5156)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
libc-bin 2.35-0ubuntu3.6
libc6 2.35-0ubuntu3.6
nscd 2.35-0ubuntu3.6
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6541-2
https://ubuntu.com/security/notices/USN-6541-1
https://launchpad.net/bugs/2047155
Package Information:
https://launchpad.net/ubuntu/+source/glibc/2.35-0ubuntu3.6
F40 Change Proposal: Java 21 (System-Wide)
Wiki ->https://fedoraproject.org/wiki/Changes/Java21
**This is a *proposed* Change for Fedora Linux.**
This document represents a *proposed* Change. As part of the [Changes
process](https://docs.fedoraproject.org/en-US/program_management/changes_policy/),
proposals are publicly announced in order to receive community
feedback. This proposal will only be implemented if approved by the
Fedora Engineering Steering Committee.
== Summary ==
Update the system JDK in Fedora from java-17-openjdk to java-21-openjdk.
== Owner ==
* Name: [[User:pmikova| Petra Alice Mikova]]
* Email: <pmikova@redhat.com>
* Product: java and java stack
* Responsible WG: java-sig (java and java-maint)(which no longer exists)
* rcm ticket: https://pagure.io/releng/issue/11859
* named side tag ticket: TBD
=== Expected schedule ===
* During January 2024, we will create a new package, java-21-openjdk,
which will be a clone of java-latest-openjdk, which contains STS
versions of OpenJDK (currently 21) and will move to JDK 22 in
February/March.
* December 2023 I will do mass rebuild in copr
** all maintainers will be informed about the results
* January 2023 I will do second mass rebuild in copr
** all maintainers will be informed about the results
* February 2023 mass rebuild in rawhide - side tag
** FTBFS bugs will be filed
* February 2023 the sidetag will be merged
* Change Checkpoint: 100% Code Complete Deadline TBD
** hard deadline for feature completed
== Detailed Description ==
Fedora currently ships:
* java-1.8.0-openjdk (LTS)
* java-11-openjdk (LTS)
* java-17-openjdk (LTS), system JDK
* java-latest-openjdk (currently JDK21)
* java-21-openjdk will be cloned from java-latest-openjdk
Therefore, every package honoring the packaging rules and requiring
java via java-headless or java-devel is built in koji using
java-17-openjdk-devel and pulling java-17-openjdk during runtime (see
[https://fedoraproject.org/wiki/Java java] ). Also,
javapackaging-tools are using java-11-openjdk as hardcoded runtime
(see [https://fedoraproject.org/wiki/Changes/Decouple_system_java_setting_from_java_command_setting
changes]).
We were intentionally delaying jdk11 on-boarding for stability
reasons. But there is reason for this approach with 21 (for recall,
see https://fedoraproject.org/wiki/Changes/Java11)
Major incompatibility is again (as we were bumping 8->11)
encapsulation. What was hidden is now even more hidden and few more
parts were hidden. Luckily, most of the projects, when shifted to 11,
did it properly. Still few projects may hit usage of some newly
restricted APIs.
== Feedback ==
== Benefit to Fedora ==
JDK21 was released a while ago, but compatibility with JDK 17 is good
enough and it is a stable release. Although we can expect some group
of packages to use jdk8 forever, and some other (much smaller) group
of packages stay on jdk11 for a while, the java stack should be able
to use the JDK 21. Both JDK 8 and JDK 11 will remain part of Fedora as
long as they are supported upstream, and there is a target audience in
our OS.
== Scope ==
=== To keep the java-17-openjdk (and lower versions of JDK), but to
remove its java/javac versionless provides, make java-21-openjdk the
provider of java, javac and other versionless provides, and keep
java-latest-openjdk as rolling package for STS JDKs) ===
* will guarantee fedora to be pure JDK21 distro.
* will allow maintainers of JDK21 (or higher) incompatible packages to
keep using JDK 17, JDK 11 and JDK 8
** if any package depends on a package built by JDK 21, JDK 17, JDK 11
and JDK 8 may not be able to pick up that dependency.
** this may lead to quite a lot of bundling or compat packages, but
that may be acceptable
** people developing JDK8 and JDK11 applications will very likely stay
with fedora
** we are bumping the system JDK every time a new JDK LTS comes up and
it proved itself as a good practice
While quite a lot of users will rejoice, there may be cases where
application is very hard to migrate to JDK11, so the contingency plan
should be taken very serious.
==== Bytecode version ====
* It appeared, that several applications have to be built by jdk8,
while they work fine with jdk11
* It lead to manual work on aligned libraries on 1.8 byte code
version. see https://pagure.io/java-maint-sig/issue/7
* Other approaches how to avoid this in next update (jdk17, aprox f36,
minimal bytecode 7) were mentioned here:
https://src.fedoraproject.org/rpms/javapackages-tools/pull-request/3#comment-50266
==== Workflow ====
* announce as by
https://docs.fedoraproject.org/en-US/program_management/changes_policy/#_essential_communication
* tune java-latest-openjdk package (for all live Fedoras)
* clone java-21-openjdk package (for all live Fedoras)
* several rounds of mass rebuilds ( see
https://fedoraproject.org/w/index.php?title=Changes/Java21#Expected_schedule)
** from copr
** over side tag
** to koji
==== Change owners ====
* Feature will be implemented in
[https://fedoraproject.org/wiki/Changes/Java21#side_tag side tag]
** --target '''f40-java21''' is tag of choice
** In its mass rebuild, approximately XYZ packages were built, and ABC
failed. FTBFS bugs filled, most of them needs manual fix later
* the JDK 17 and JDK 21 packages will be changed for this side tag
* the mass rebuild of java stack will start
** if necessary, several rounds of them
* Failures will be gathered by me and few other volunteers
** Most common issues and theirs fixes will be published
** Package maintainers will be notified in case of failure via
[https://bugzilla.redhat.com/ bugzilla]
* Depending on the fail rate, importance of failed packages and effort
to fix them
** the side tag will be merged to Fedora
** or the [https://fedoraproject.org/wiki/Changes/Java21#Contingency_Plan
contingency] plan will be activated
==== Other developers ====
* should fix their packages
** this usually means to update to newer version, which supports jdk21
* or to retire them if they appear non-fixable
* or to base them on JDK11 without much warranty (as they will need to
compat most of dependency chain)
==== Other ====
* Proposal owners:
** based on above, adapt jdk11 and jdk17 package provides
** If necessary tune the build environment
* Other developers:
** based on selected approach to tune the main build tools
*** jpackage-tools and maven will affected
** based on selected approach to tune the rpmbuild/macros
** many java package maintainers will maybe need to adapt theirs packages
*** FTBFS bugs connected with this proposal, maybe with pagure ticket
to allow discussion.
*** Solutions to most common errors should be gathered and published
* Release engineering: TICKET_TBD (a check of an impact with Release
Engineering is needed)
** mass rebuild will be required for this change
* Policies and guidelines: how to deal with build failures, eventually
how to use some jdk17 specific build features will be provided
* Trademark approval: N/A (not needed for this Change)
== Upgrade/compatibility impact ==
Once the change is implemented properly, the update should be flawless
and seamless
== How To Test ==
* only JDK 21 should remain the only system JDK after installing base
javastack on clean system
* the JDK 8, JDK 11, JDK 17, JDK 21 and java-latest-openjd can
co-exist on one system
* JDK 21 will be selected by default and will run most of the base java stack
== User Experience ==
* Standard user should be still be able to use java stack without even
noticing the change.
* Standard developer should still be able develop any java application
comfortably
* Standard packager will not suffer to much, and should be able to
pack any java application for fedora
== Dependencies ==
Around 2000 packages will need attendance
$ repoquery -q --whatrequires java-headless |wc -l
736
$ repoquery -q --whatrequires java | wc -l
41
$ repoquery -q --whatrequires java-devel | wc -l
13
$ repoquery -q --whatrequires java-1.8.0-openjdk-headless |wc -l
653
$ repoquery -q --whatrequires java-1.8.0-openjdk | wc -l
8
$ repoquery -q --whatrequires java-1.8.0-openjdk-devel | wc -l
4
$ repoquery -q --whatrequires java-11-openjdk-headless |wc -l
663
$ repoquery -q --whatrequires java-11-openjdk | wc -l
8
$ repoquery -q --whatrequires java-11-openjdk-devel | wc -l
5
$ repoquery -q --whatrequires java-17-openjdk-headless |wc -l
757
$ repoquery -q --whatrequires java-17-openjdk |wc -l
55
$ repoquery -q --whatrequires java-17-openjdk-devel |wc -l
20
with src repos on, build time depndnecies:
set +x ;echo "dont forget to enable all (correct fedora,
fedotra-testing, fedora modules) SOURCE repos (sections in .repo
files)!" ; for x in ant maven-local maven mvn xmvn java-headless java
java-devel java-1.8.0-openjdk-headless java-1.8.0-openjdk
java-1.8.0-openjdk-devel java-11-openjdk-headless java-11-openjdk
java-11-openjdk-devel ; do for y in "" "--arch src" ;do set -x ;
repoquery $y -q --whatrequires $x |wc -l ; set +x ; done; done
dont forget to enable all (correct fedora, fedotra-testing, fedora
modules) SOURCE repos (sections in .repo files)
+ repoquery --arch src -q --whatrequires ant
152
+ repoquery --arch src -q --whatrequires maven-local
401
+ repoquery --arch src -q --whatrequires maven
4
+ repoquery --arch src -q --whatrequires mvn
0
+ repoquery --arch src -q --whatrequires xmvn
0
+ repoquery --arch src -q --whatrequires java-headless
5
+ repoquery --arch src -q --whatrequires java
0
+ repoquery --arch src -q --whatrequires java-devel
207
+ repoquery --arch src -q --whatrequires java-1.8.0-openjdk-headless
6
+ repoquery --arch src -q --whatrequires java-1.8.0-openjdk
0
+ repoquery --arch src -q --whatrequires java-1.8.0-openjdk-devel
19
+ repoquery --arch src -q --whatrequires java-11-openjdk-headless
0
+ repoquery --arch src -q --whatrequires java-11-openjdk
0
+ repoquery --arch src -q --whatrequires java-11-openjdk-devel
15
Packages needing major work will be
* java-17-openjdk
* java-21-openjdk
* javapackages-tools
* maybe maven base
== Contingency Plan ==
* If the mass rebuild, after the changes are applied, breaks too many
packages, or some crucial component will be unfixable, JDK 17 must be
restored back to the position of system JDK.
* Contingency mechanism: Return jdk8 as system jdk and mass rebuild
again. Note, that this may be very hard, because during build of
packages by jdk8, by jdk11 built dependencies will be picekd up, so
build will fail. Maybe several iterations of mass rebuild will be
needed.
* Contingency deadline: Announce release blocking deliverables Tue
2022-02-01 Tue 2022-02-01 0 (8days before branching, 22 before
beta freeze)
* Blocks release? Yes
* Blocks product? N/A
* In general, going back will be, in my opinion, impossible. Once the
decision is taken, java stack should be fixed, and where it can not be
fixed, it has to migrate to compat packages, or bundled-dependencies
packages, or be orphaned.
=== side tag ===
https://fedoraproject.org/wiki/Package_update_HOWTO#Creating_a_side-tag
* for these changes, Fedora has technology known as side tag
* I do not have experience with it, but it is making the contingency
plan much smoother
* it is an approach, which will be used first
== Documentation ==
* oracle 21 release notes:
https://www.oracle.com/java/technologies/javase/21-relnote-issues.html
* openjdk21 jeps: https://openjdk.java.net/projects/jdk/21/
https://openjdk.java.net/projects/jdk/20/
https://openjdk.java.net/projects/jdk/19/
https://openjdk.java.net/projects/jdk/18/
* oracle migration guide
https://docs.oracle.com/en/java/javase/21/migrate/index.html
=== common issues packagers can face and gathered solutions ===
Contacts: ask on devel@lists.fedoraproject.org or
java-devel@lists.fedoraproject.org or directly to me
pmikova@redhat.com
Threads of "F40 system wide change, java-21-openjdk as a system JDK"
Major database can be browsing of closed bugs of blockers of
https://bugzilla.redhat.com/show_bug.cgi?id=TODO ; unluckily, when it
was analysed, it was not summarised up (that would actually double the
work)
==== My package can not work with JDK 21 ====
No program can say, that it does not support JDK 21, because any
javac/java application can be remade to work with JDK 21 - see
https://jvanek.fedorapeople.org/devconf/2017/portingjavaInternalToJdk9/portingOfItwToJdk9-II.pdf
(really all except package split over modules, which is impossible)
Now above mentioned approaches are indeed *hacked*, and I discourage
everybody to do so. The upstream should be moved to jdk21, and not
much excuses are around to support to not to do so. If you package is
really bound to JDK 17, you can move to the version-full requires:
BuildRequires: java-17-openjdk(-devel)
and
Requires: java-17-openjdk(-headless).
In addition, '''if you work with maven/ant or similar builders, you
must set export JAVA_HOME=/usr/lib/jvm/java-11
-openjdk before calling
it.''' javapackage-tools and comp are made to accept it.
However there is a trap - the packages you are depending on. Once
some of your dependencies will be compiled
with --target > 8, you are doomed, and you have to bundle it or create
its compat version. By doing
so you can easily end up in dependency hell.
Please, try to avoid this as much as possible!
===== Intermediate step build with java-17-openjdk-devel and run with
java (that means any sytem java, eg java-21-openjdk) =====
Some projects support JDK21 for runtime, but not for compile time.
Buildrequires: java-17-openjdk-devel
...
Requires: java(-headless)
...
%build
...
export JAVA_HOME=/usr/lib/jvm/java-17-openjdk
...
Should work for a while. See the "My package can not work with jdk11" section
==== My package is not in your copr! ====
If your package is not listed in the copr rebuild repo, I can see two causes
* You have very indirect BR on java.
** Solution
** Email me (pmikova@redhat.com) or ping me (pmikova), I will gladly
add you package(s)
* You have exact requires on java-11-openjdk(-devel)
** Solution
** Unless you have good reason, you are actually breaking packaging
guidelines. Switch to java-devel. Once done, again let me know and I
will gladly add your package
** If you can't, then you most likely can not bump to jdk17, and you
will live with jdk11 until it dies,
==== Wrong source/target version ====
maven
[ERROR] Source option 1.3 is no longer supported. Use 7 or later.
[ERROR] Target option 1.3 is no longer supported. Use 1.7 or later.
ant
-do-compile:
[mkdir] Created dir: /builddir/build/BUILD/jpanoramamaker-5/build/empty
[javac] Compiling 45 source files to
/builddir/build/BUILD/jpanoramamaker-5/build/classes
[javac] warning: [options] bootstrap class path not set in
conjunction with -source 5
[javac] error: Source option 5 is no longer supported. Use 7 or later.
[javac] error: Target option 1.5 is no longer supported. Use 1.7 or later.
BUILD FAILED
* Solution
** Your javac is run with wrong source/tag parameters.
[https://duckduckgo.com/?t=ffsb&q=javac+source+target&ia=web net
search will give you quick answer]
** Fixes are:
*** [https://src.fedoraproject.org/rpms/CardManager/blob/2d6e0f1e3d23d864c1ed0b20f6076fa4c9a15c21/f/bumpJdk.patch
example patch for netbeans generated ant]
== Release Notes ==
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
**This is a *proposed* Change for Fedora Linux.**
This document represents a *proposed* Change. As part of the [Changes
process](https://docs.fedoraproject.org/en-US/program_management/changes_policy/),
proposals are publicly announced in order to receive community
feedback. This proposal will only be implemented if approved by the
Fedora Engineering Steering Committee.
== Summary ==
Update the system JDK in Fedora from java-17-openjdk to java-21-openjdk.
== Owner ==
* Name: [[User:pmikova| Petra Alice Mikova]]
* Email: <pmikova@redhat.com>
* Product: java and java stack
* Responsible WG: java-sig (java and java-maint)(which no longer exists)
* rcm ticket: https://pagure.io/releng/issue/11859
* named side tag ticket: TBD
=== Expected schedule ===
* During January 2024, we will create a new package, java-21-openjdk,
which will be a clone of java-latest-openjdk, which contains STS
versions of OpenJDK (currently 21) and will move to JDK 22 in
February/March.
* December 2023 I will do mass rebuild in copr
** all maintainers will be informed about the results
* January 2023 I will do second mass rebuild in copr
** all maintainers will be informed about the results
* February 2023 mass rebuild in rawhide - side tag
** FTBFS bugs will be filed
* February 2023 the sidetag will be merged
* Change Checkpoint: 100% Code Complete Deadline TBD
** hard deadline for feature completed
== Detailed Description ==
Fedora currently ships:
* java-1.8.0-openjdk (LTS)
* java-11-openjdk (LTS)
* java-17-openjdk (LTS), system JDK
* java-latest-openjdk (currently JDK21)
* java-21-openjdk will be cloned from java-latest-openjdk
Therefore, every package honoring the packaging rules and requiring
java via java-headless or java-devel is built in koji using
java-17-openjdk-devel and pulling java-17-openjdk during runtime (see
[https://fedoraproject.org/wiki/Java java] ). Also,
javapackaging-tools are using java-11-openjdk as hardcoded runtime
(see [https://fedoraproject.org/wiki/Changes/Decouple_system_java_setting_from_java_command_setting
changes]).
We were intentionally delaying jdk11 on-boarding for stability
reasons. But there is reason for this approach with 21 (for recall,
see https://fedoraproject.org/wiki/Changes/Java11)
Major incompatibility is again (as we were bumping 8->11)
encapsulation. What was hidden is now even more hidden and few more
parts were hidden. Luckily, most of the projects, when shifted to 11,
did it properly. Still few projects may hit usage of some newly
restricted APIs.
== Feedback ==
== Benefit to Fedora ==
JDK21 was released a while ago, but compatibility with JDK 17 is good
enough and it is a stable release. Although we can expect some group
of packages to use jdk8 forever, and some other (much smaller) group
of packages stay on jdk11 for a while, the java stack should be able
to use the JDK 21. Both JDK 8 and JDK 11 will remain part of Fedora as
long as they are supported upstream, and there is a target audience in
our OS.
== Scope ==
=== To keep the java-17-openjdk (and lower versions of JDK), but to
remove its java/javac versionless provides, make java-21-openjdk the
provider of java, javac and other versionless provides, and keep
java-latest-openjdk as rolling package for STS JDKs) ===
* will guarantee fedora to be pure JDK21 distro.
* will allow maintainers of JDK21 (or higher) incompatible packages to
keep using JDK 17, JDK 11 and JDK 8
** if any package depends on a package built by JDK 21, JDK 17, JDK 11
and JDK 8 may not be able to pick up that dependency.
** this may lead to quite a lot of bundling or compat packages, but
that may be acceptable
** people developing JDK8 and JDK11 applications will very likely stay
with fedora
** we are bumping the system JDK every time a new JDK LTS comes up and
it proved itself as a good practice
While quite a lot of users will rejoice, there may be cases where
application is very hard to migrate to JDK11, so the contingency plan
should be taken very serious.
==== Bytecode version ====
* It appeared, that several applications have to be built by jdk8,
while they work fine with jdk11
* It lead to manual work on aligned libraries on 1.8 byte code
version. see https://pagure.io/java-maint-sig/issue/7
* Other approaches how to avoid this in next update (jdk17, aprox f36,
minimal bytecode 7) were mentioned here:
https://src.fedoraproject.org/rpms/javapackages-tools/pull-request/3#comment-50266
==== Workflow ====
* announce as by
https://docs.fedoraproject.org/en-US/program_management/changes_policy/#_essential_communication
* tune java-latest-openjdk package (for all live Fedoras)
* clone java-21-openjdk package (for all live Fedoras)
* several rounds of mass rebuilds ( see
https://fedoraproject.org/w/index.php?title=Changes/Java21#Expected_schedule)
** from copr
** over side tag
** to koji
==== Change owners ====
* Feature will be implemented in
[https://fedoraproject.org/wiki/Changes/Java21#side_tag side tag]
** --target '''f40-java21''' is tag of choice
** In its mass rebuild, approximately XYZ packages were built, and ABC
failed. FTBFS bugs filled, most of them needs manual fix later
* the JDK 17 and JDK 21 packages will be changed for this side tag
* the mass rebuild of java stack will start
** if necessary, several rounds of them
* Failures will be gathered by me and few other volunteers
** Most common issues and theirs fixes will be published
** Package maintainers will be notified in case of failure via
[https://bugzilla.redhat.com/ bugzilla]
* Depending on the fail rate, importance of failed packages and effort
to fix them
** the side tag will be merged to Fedora
** or the [https://fedoraproject.org/wiki/Changes/Java21#Contingency_Plan
contingency] plan will be activated
==== Other developers ====
* should fix their packages
** this usually means to update to newer version, which supports jdk21
* or to retire them if they appear non-fixable
* or to base them on JDK11 without much warranty (as they will need to
compat most of dependency chain)
==== Other ====
* Proposal owners:
** based on above, adapt jdk11 and jdk17 package provides
** If necessary tune the build environment
* Other developers:
** based on selected approach to tune the main build tools
*** jpackage-tools and maven will affected
** based on selected approach to tune the rpmbuild/macros
** many java package maintainers will maybe need to adapt theirs packages
*** FTBFS bugs connected with this proposal, maybe with pagure ticket
to allow discussion.
*** Solutions to most common errors should be gathered and published
* Release engineering: TICKET_TBD (a check of an impact with Release
Engineering is needed)
** mass rebuild will be required for this change
* Policies and guidelines: how to deal with build failures, eventually
how to use some jdk17 specific build features will be provided
* Trademark approval: N/A (not needed for this Change)
== Upgrade/compatibility impact ==
Once the change is implemented properly, the update should be flawless
and seamless
== How To Test ==
* only JDK 21 should remain the only system JDK after installing base
javastack on clean system
* the JDK 8, JDK 11, JDK 17, JDK 21 and java-latest-openjd can
co-exist on one system
* JDK 21 will be selected by default and will run most of the base java stack
== User Experience ==
* Standard user should be still be able to use java stack without even
noticing the change.
* Standard developer should still be able develop any java application
comfortably
* Standard packager will not suffer to much, and should be able to
pack any java application for fedora
== Dependencies ==
Around 2000 packages will need attendance
$ repoquery -q --whatrequires java-headless |wc -l
736
$ repoquery -q --whatrequires java | wc -l
41
$ repoquery -q --whatrequires java-devel | wc -l
13
$ repoquery -q --whatrequires java-1.8.0-openjdk-headless |wc -l
653
$ repoquery -q --whatrequires java-1.8.0-openjdk | wc -l
8
$ repoquery -q --whatrequires java-1.8.0-openjdk-devel | wc -l
4
$ repoquery -q --whatrequires java-11-openjdk-headless |wc -l
663
$ repoquery -q --whatrequires java-11-openjdk | wc -l
8
$ repoquery -q --whatrequires java-11-openjdk-devel | wc -l
5
$ repoquery -q --whatrequires java-17-openjdk-headless |wc -l
757
$ repoquery -q --whatrequires java-17-openjdk |wc -l
55
$ repoquery -q --whatrequires java-17-openjdk-devel |wc -l
20
with src repos on, build time depndnecies:
set +x ;echo "dont forget to enable all (correct fedora,
fedotra-testing, fedora modules) SOURCE repos (sections in .repo
files)!" ; for x in ant maven-local maven mvn xmvn java-headless java
java-devel java-1.8.0-openjdk-headless java-1.8.0-openjdk
java-1.8.0-openjdk-devel java-11-openjdk-headless java-11-openjdk
java-11-openjdk-devel ; do for y in "" "--arch src" ;do set -x ;
repoquery $y -q --whatrequires $x |wc -l ; set +x ; done; done
dont forget to enable all (correct fedora, fedotra-testing, fedora
modules) SOURCE repos (sections in .repo files)
+ repoquery --arch src -q --whatrequires ant
152
+ repoquery --arch src -q --whatrequires maven-local
401
+ repoquery --arch src -q --whatrequires maven
4
+ repoquery --arch src -q --whatrequires mvn
0
+ repoquery --arch src -q --whatrequires xmvn
0
+ repoquery --arch src -q --whatrequires java-headless
5
+ repoquery --arch src -q --whatrequires java
0
+ repoquery --arch src -q --whatrequires java-devel
207
+ repoquery --arch src -q --whatrequires java-1.8.0-openjdk-headless
6
+ repoquery --arch src -q --whatrequires java-1.8.0-openjdk
0
+ repoquery --arch src -q --whatrequires java-1.8.0-openjdk-devel
19
+ repoquery --arch src -q --whatrequires java-11-openjdk-headless
0
+ repoquery --arch src -q --whatrequires java-11-openjdk
0
+ repoquery --arch src -q --whatrequires java-11-openjdk-devel
15
Packages needing major work will be
* java-17-openjdk
* java-21-openjdk
* javapackages-tools
* maybe maven base
== Contingency Plan ==
* If the mass rebuild, after the changes are applied, breaks too many
packages, or some crucial component will be unfixable, JDK 17 must be
restored back to the position of system JDK.
* Contingency mechanism: Return jdk8 as system jdk and mass rebuild
again. Note, that this may be very hard, because during build of
packages by jdk8, by jdk11 built dependencies will be picekd up, so
build will fail. Maybe several iterations of mass rebuild will be
needed.
* Contingency deadline: Announce release blocking deliverables Tue
2022-02-01 Tue 2022-02-01 0 (8days before branching, 22 before
beta freeze)
* Blocks release? Yes
* Blocks product? N/A
* In general, going back will be, in my opinion, impossible. Once the
decision is taken, java stack should be fixed, and where it can not be
fixed, it has to migrate to compat packages, or bundled-dependencies
packages, or be orphaned.
=== side tag ===
https://fedoraproject.org/wiki/Package_update_HOWTO#Creating_a_side-tag
* for these changes, Fedora has technology known as side tag
* I do not have experience with it, but it is making the contingency
plan much smoother
* it is an approach, which will be used first
== Documentation ==
* oracle 21 release notes:
https://www.oracle.com/java/technologies/javase/21-relnote-issues.html
* openjdk21 jeps: https://openjdk.java.net/projects/jdk/21/
https://openjdk.java.net/projects/jdk/20/
https://openjdk.java.net/projects/jdk/19/
https://openjdk.java.net/projects/jdk/18/
* oracle migration guide
https://docs.oracle.com/en/java/javase/21/migrate/index.html
=== common issues packagers can face and gathered solutions ===
Contacts: ask on devel@lists.fedoraproject.org or
java-devel@lists.fedoraproject.org or directly to me
pmikova@redhat.com
Threads of "F40 system wide change, java-21-openjdk as a system JDK"
Major database can be browsing of closed bugs of blockers of
https://bugzilla.redhat.com/show_bug.cgi?id=TODO ; unluckily, when it
was analysed, it was not summarised up (that would actually double the
work)
==== My package can not work with JDK 21 ====
No program can say, that it does not support JDK 21, because any
javac/java application can be remade to work with JDK 21 - see
https://jvanek.fedorapeople.org/devconf/2017/portingjavaInternalToJdk9/portingOfItwToJdk9-II.pdf
(really all except package split over modules, which is impossible)
Now above mentioned approaches are indeed *hacked*, and I discourage
everybody to do so. The upstream should be moved to jdk21, and not
much excuses are around to support to not to do so. If you package is
really bound to JDK 17, you can move to the version-full requires:
BuildRequires: java-17-openjdk(-devel)
and
Requires: java-17-openjdk(-headless).
In addition, '''if you work with maven/ant or similar builders, you
must set export JAVA_HOME=/usr/lib/jvm/java-11
-openjdk before calling
it.''' javapackage-tools and comp are made to accept it.
However there is a trap - the packages you are depending on. Once
some of your dependencies will be compiled
with --target > 8, you are doomed, and you have to bundle it or create
its compat version. By doing
so you can easily end up in dependency hell.
Please, try to avoid this as much as possible!
===== Intermediate step build with java-17-openjdk-devel and run with
java (that means any sytem java, eg java-21-openjdk) =====
Some projects support JDK21 for runtime, but not for compile time.
Buildrequires: java-17-openjdk-devel
...
Requires: java(-headless)
...
%build
...
export JAVA_HOME=/usr/lib/jvm/java-17-openjdk
...
Should work for a while. See the "My package can not work with jdk11" section
==== My package is not in your copr! ====
If your package is not listed in the copr rebuild repo, I can see two causes
* You have very indirect BR on java.
** Solution
** Email me (pmikova@redhat.com) or ping me (pmikova), I will gladly
add you package(s)
* You have exact requires on java-11-openjdk(-devel)
** Solution
** Unless you have good reason, you are actually breaking packaging
guidelines. Switch to java-devel. Once done, again let me know and I
will gladly add your package
** If you can't, then you most likely can not bump to jdk17, and you
will live with jdk11 until it dies,
==== Wrong source/target version ====
maven
[ERROR] Source option 1.3 is no longer supported. Use 7 or later.
[ERROR] Target option 1.3 is no longer supported. Use 1.7 or later.
ant
-do-compile:
[mkdir] Created dir: /builddir/build/BUILD/jpanoramamaker-5/build/empty
[javac] Compiling 45 source files to
/builddir/build/BUILD/jpanoramamaker-5/build/classes
[javac] warning: [options] bootstrap class path not set in
conjunction with -source 5
[javac] error: Source option 5 is no longer supported. Use 7 or later.
[javac] error: Target option 1.5 is no longer supported. Use 1.7 or later.
BUILD FAILED
* Solution
** Your javac is run with wrong source/tag parameters.
[https://duckduckgo.com/?t=ffsb&q=javac+source+target&ia=web net
search will give you quick answer]
** Fixes are:
*** [https://src.fedoraproject.org/rpms/CardManager/blob/2d6e0f1e3d23d864c1ed0b20f6076fa4c9a15c21/f/bumpJdk.patch
example patch for netbeans generated ant]
== Release Notes ==
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Tuesday, January 9, 2024
[USN-6570-1] PostgreSQL vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsD5BAABCAAjFiEEcxdv4gCCE8W9nrt5a1+PL+d1/EgFAmWdnxAFAwAAAAAACgkQa1+PL+d1/EgL
5Qv+Mvc1GA3iRV7s6Z6H+WDXXuMImOsKVtplZpwnCjEaB6jYbtnl1YA0+zilNkwR1+rpaHWr9bM5
zS7+E5EfhLqJ3u8umLySVRhyOneGFsy6UBHb9q9UFCk6WmdOyt6aYS4vtuidcHxTqJF0QtLlcIvu
YJUbefuuc9Ze+Ozk7b7mqCebB+kRkoulwjMNvA7QsZelnc6J62MsLWukWQjYQdh6OkOa5h9nlCNR
BXt2igCGFfRw+brhKFjWnuYsRP4gpu/IE1H5AOuA1Rs5rWF0JiTW5rhJPr7s2pw1GcIr0pgdT7QC
lW9rAVsY7uVEDIL8b/nGpi3XEr3BUAcIwPnro1E81Pm1PoNaomxyQ95iskEkzr7XqLE0Aza/7Wzv
WHn1mz/85KOWBFh17hvWd1y/b2DTBICIiRB7g4qInw4bN/wGCt46hgVgNmcYdbMtsMb3ej9YHKRc
Etw496XtivouKZvvv3xv/PKl+92zMBkZRA3dRI07xdfgvE7RhBZUsq26IuVs
=q/OR
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6570-1
January 09, 2024
postgresql-9.5 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in PostgreSQL.
Software Description:
- postgresql-9.5: Object-relational SQL database
Details:
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
postgresql-9.5 9.5.25-0ubuntu0.16.04.1+esm6
postgresql-client-9.5 9.5.25-0ubuntu0.16.04.1+esm6
After a standard system update you need to restart PostgreSQL to make
all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6570-1
CVE-2023-5869, CVE-2023-5870
wsD5BAABCAAjFiEEcxdv4gCCE8W9nrt5a1+PL+d1/EgFAmWdnxAFAwAAAAAACgkQa1+PL+d1/EgL
5Qv+Mvc1GA3iRV7s6Z6H+WDXXuMImOsKVtplZpwnCjEaB6jYbtnl1YA0+zilNkwR1+rpaHWr9bM5
zS7+E5EfhLqJ3u8umLySVRhyOneGFsy6UBHb9q9UFCk6WmdOyt6aYS4vtuidcHxTqJF0QtLlcIvu
YJUbefuuc9Ze+Ozk7b7mqCebB+kRkoulwjMNvA7QsZelnc6J62MsLWukWQjYQdh6OkOa5h9nlCNR
BXt2igCGFfRw+brhKFjWnuYsRP4gpu/IE1H5AOuA1Rs5rWF0JiTW5rhJPr7s2pw1GcIr0pgdT7QC
lW9rAVsY7uVEDIL8b/nGpi3XEr3BUAcIwPnro1E81Pm1PoNaomxyQ95iskEkzr7XqLE0Aza/7Wzv
WHn1mz/85KOWBFh17hvWd1y/b2DTBICIiRB7g4qInw4bN/wGCt46hgVgNmcYdbMtsMb3ej9YHKRc
Etw496XtivouKZvvv3xv/PKl+92zMBkZRA3dRI07xdfgvE7RhBZUsq26IuVs
=q/OR
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6570-1
January 09, 2024
postgresql-9.5 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in PostgreSQL.
Software Description:
- postgresql-9.5: Object-relational SQL database
Details:
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
postgresql-9.5 9.5.25-0ubuntu0.16.04.1+esm6
postgresql-client-9.5 9.5.25-0ubuntu0.16.04.1+esm6
After a standard system update you need to restart PostgreSQL to make
all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6570-1
CVE-2023-5869, CVE-2023-5870
[USN-6548-4] Linux kernel (GKE) vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmWdm48FAwAAAAAACgkQZ0GeRcM5nt2O
PAf/eSkZTHp6VPgUhitvTY1tiF1v9Wa3fNDR7s2Kli8hoU3DGXrxy8ZlMuQWFjdGdNQY7ZCKtfkO
hmGHtT1/gEQKZfZFtLWw0EJdID5dqUfolA7Tqku76mW/QfYUC3cPjjaEZ9dXk3f7hTTC8jxRA7GE
fMWxcezi7TJAEM+Mn3mgJpfIv6Q7sGmlPkDV0SyprVFYSL+0CvL18WpKD2+lHilsXOgM69sSUGcp
Wa2d4RcsrUIxgKS5ggDKBISiDmei9DHM3jcHEwB+4hYC6VVCQvjbvj/tqMylgB4DByPVdz8V4WRC
H1WAL6k/tXorQ45sz5auhb5h4AzC3kwXmHBrKHqdSQ==
=GUaj
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6548-4
January 09, 2024
linux-gkeop vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-gkeop: Linux kernel for Google Container Engine (GKE) systems
Details:
It was discovered that Spectre-BHB mitigations were missing for Ampere
processors. A local attacker could potentially use this to expose sensitive
information. (CVE-2023-3006)
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate some attributes passed from userspace. A local
attacker could use this to cause a denial of service (system crash) or
possibly expose sensitive information (kernel memory). (CVE-2023-39189)
Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did
not properly validate u32 packets content, leading to an out-of-bounds read
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-39192)
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate SCTP data, leading to an out-of-bounds read
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-39193)
Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in
the Linux kernel did not properly handle state filters, leading to an out-
of-bounds read vulnerability. A privileged local attacker could use this to
cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2023-39194)
Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did
not properly handle socket buffers (skb) when performing IP routing in
certain circumstances, leading to a null pointer dereference vulnerability.
A privileged attacker could use this to cause a denial of service (system
crash). (CVE-2023-42754)
Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel
did not properly handle queue initialization failures in certain
situations, leading to a use-after-free vulnerability. A remote attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-5178)
Budimir Markovic discovered that the perf subsystem in the Linux kernel did
not properly handle event groups, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-5717)
It was discovered that the TLS subsystem in the Linux kernel did not
properly perform cryptographic operations in some situations, leading to a
null pointer dereference vulnerability. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2023-6176)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.4.0-1083-gkeop 5.4.0-1083.87
linux-image-gkeop 5.4.0.1083.81
linux-image-gkeop-5.4 5.4.0.1083.81
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6548-4
https://ubuntu.com/security/notices/USN-6548-1
CVE-2023-3006, CVE-2023-37453, CVE-2023-39189, CVE-2023-39192,
CVE-2023-39193, CVE-2023-39194, CVE-2023-42754, CVE-2023-5178,
CVE-2023-5717, CVE-2023-6176
Package Information:
https://launchpad.net/ubuntu/+source/linux-gkeop/5.4.0-1083.87
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmWdm48FAwAAAAAACgkQZ0GeRcM5nt2O
PAf/eSkZTHp6VPgUhitvTY1tiF1v9Wa3fNDR7s2Kli8hoU3DGXrxy8ZlMuQWFjdGdNQY7ZCKtfkO
hmGHtT1/gEQKZfZFtLWw0EJdID5dqUfolA7Tqku76mW/QfYUC3cPjjaEZ9dXk3f7hTTC8jxRA7GE
fMWxcezi7TJAEM+Mn3mgJpfIv6Q7sGmlPkDV0SyprVFYSL+0CvL18WpKD2+lHilsXOgM69sSUGcp
Wa2d4RcsrUIxgKS5ggDKBISiDmei9DHM3jcHEwB+4hYC6VVCQvjbvj/tqMylgB4DByPVdz8V4WRC
H1WAL6k/tXorQ45sz5auhb5h4AzC3kwXmHBrKHqdSQ==
=GUaj
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6548-4
January 09, 2024
linux-gkeop vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-gkeop: Linux kernel for Google Container Engine (GKE) systems
Details:
It was discovered that Spectre-BHB mitigations were missing for Ampere
processors. A local attacker could potentially use this to expose sensitive
information. (CVE-2023-3006)
It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate some attributes passed from userspace. A local
attacker could use this to cause a denial of service (system crash) or
possibly expose sensitive information (kernel memory). (CVE-2023-39189)
Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did
not properly validate u32 packets content, leading to an out-of-bounds read
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-39192)
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate SCTP data, leading to an out-of-bounds read
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-39193)
Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in
the Linux kernel did not properly handle state filters, leading to an out-
of-bounds read vulnerability. A privileged local attacker could use this to
cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2023-39194)
Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did
not properly handle socket buffers (skb) when performing IP routing in
certain circumstances, leading to a null pointer dereference vulnerability.
A privileged attacker could use this to cause a denial of service (system
crash). (CVE-2023-42754)
Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel
did not properly handle queue initialization failures in certain
situations, leading to a use-after-free vulnerability. A remote attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-5178)
Budimir Markovic discovered that the perf subsystem in the Linux kernel did
not properly handle event groups, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-5717)
It was discovered that the TLS subsystem in the Linux kernel did not
properly perform cryptographic operations in some situations, leading to a
null pointer dereference vulnerability. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2023-6176)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.4.0-1083-gkeop 5.4.0-1083.87
linux-image-gkeop 5.4.0.1083.81
linux-image-gkeop-5.4 5.4.0.1083.81
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6548-4
https://ubuntu.com/security/notices/USN-6548-1
CVE-2023-3006, CVE-2023-37453, CVE-2023-39189, CVE-2023-39192,
CVE-2023-39193, CVE-2023-39194, CVE-2023-42754, CVE-2023-5178,
CVE-2023-5717, CVE-2023-6176
Package Information:
https://launchpad.net/ubuntu/+source/linux-gkeop/5.4.0-1083.87
[USN-6572-1] Linux kernel (Azure) vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmWdm6MFAwAAAAAACgkQZ0GeRcM5nt2P
Zgf+PPmkGAbTH8ulPSL2QQAYyXh8xP5tUpJDmsejOuSO2lNfmRuN6OayogLqpXe2ghlw6U2yEKI9
bzq1k6ayTyKoxTGyrANES13dEe9WgshEEGgNsFgDEvpDikp6fFYvAoYgMaFLGCAk59rLjDAvC52i
irxD0XXnl6Enx5mJgUtW9VrACh3EUHtqfqeplHHswVAHI8IhgpI+Wl15pbUEh/g/xPzoZgNuf56x
9bdNBKapV16dE445EWJ6DSXQaoqpWw56JT/ljRR6NU7bjQLGUByqTgjs0v2Ef1dzmEAH94uE0syg
3BuPn2YwKwI/xGkCVRkIi167b7tSWEaNSROy+BX6Mg==
=6gH7
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6572-1
January 09, 2024
linux-azure vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
Yu Hao discovered that the UBI driver in the Linux kernel did not properly
check for MTD with zero erasesize during device attachment. A local
privileged attacker could use this to cause a denial of service (system
crash). (CVE-2023-31085)
Bien Pham discovered that the netfiler subsystem in the Linux kernel
contained a race condition, leading to a use-after-free vulnerability. A
local user could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-4244)
Maxim Levitsky discovered that the KVM nested virtualization (SVM)
implementation for AMD processors in the Linux kernel did not properly
handle x2AVIC MSRs. An attacker in a guest VM could use this to cause a
denial of service (host kernel crash). (CVE-2023-5090)
It was discovered that the SMB network file sharing protocol implementation
in the Linux kernel did not properly handle certain error conditions,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2023-5345)
Murray McAllister discovered that the VMware Virtual GPU DRM driver in the
Linux kernel did not properly handle memory objects when storing surfaces,
leading to a use-after-free vulnerability. A local attacker in a guest VM
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-5633)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
linux-image-6.5.0-1009-azure 6.5.0-1009.9
linux-image-6.5.0-1009-azure-fde 6.5.0-1009.9
linux-image-azure 6.5.0.1009.11
linux-image-azure-fde 6.5.0.1009.11
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6572-1
CVE-2023-31085, CVE-2023-4244, CVE-2023-5090, CVE-2023-5345,
CVE-2023-5633
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/6.5.0-1009.9
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmWdm6MFAwAAAAAACgkQZ0GeRcM5nt2P
Zgf+PPmkGAbTH8ulPSL2QQAYyXh8xP5tUpJDmsejOuSO2lNfmRuN6OayogLqpXe2ghlw6U2yEKI9
bzq1k6ayTyKoxTGyrANES13dEe9WgshEEGgNsFgDEvpDikp6fFYvAoYgMaFLGCAk59rLjDAvC52i
irxD0XXnl6Enx5mJgUtW9VrACh3EUHtqfqeplHHswVAHI8IhgpI+Wl15pbUEh/g/xPzoZgNuf56x
9bdNBKapV16dE445EWJ6DSXQaoqpWw56JT/ljRR6NU7bjQLGUByqTgjs0v2Ef1dzmEAH94uE0syg
3BuPn2YwKwI/xGkCVRkIi167b7tSWEaNSROy+BX6Mg==
=6gH7
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6572-1
January 09, 2024
linux-azure vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
Yu Hao discovered that the UBI driver in the Linux kernel did not properly
check for MTD with zero erasesize during device attachment. A local
privileged attacker could use this to cause a denial of service (system
crash). (CVE-2023-31085)
Bien Pham discovered that the netfiler subsystem in the Linux kernel
contained a race condition, leading to a use-after-free vulnerability. A
local user could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-4244)
Maxim Levitsky discovered that the KVM nested virtualization (SVM)
implementation for AMD processors in the Linux kernel did not properly
handle x2AVIC MSRs. An attacker in a guest VM could use this to cause a
denial of service (host kernel crash). (CVE-2023-5090)
It was discovered that the SMB network file sharing protocol implementation
in the Linux kernel did not properly handle certain error conditions,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2023-5345)
Murray McAllister discovered that the VMware Virtual GPU DRM driver in the
Linux kernel did not properly handle memory objects when storing surfaces,
leading to a use-after-free vulnerability. A local attacker in a guest VM
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-5633)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
linux-image-6.5.0-1009-azure 6.5.0-1009.9
linux-image-6.5.0-1009-azure-fde 6.5.0-1009.9
linux-image-azure 6.5.0.1009.11
linux-image-azure-fde 6.5.0.1009.11
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6572-1
CVE-2023-31085, CVE-2023-4244, CVE-2023-5090, CVE-2023-5345,
CVE-2023-5633
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/6.5.0-1009.9
[USN-6573-1] Linux kernel (Azure) vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmWdm6oFAwAAAAAACgkQZ0GeRcM5nt25
PQf9F3ZYR2f2HogE0/yvCfGDeHPl5jNIRb3DXx8vNIVrdso4o3fCbe61Gy4FBxROpYi8qUtapIPQ
nmqNBx9OOdhZ+ZEdSb8zCbodiRLf6C7IFrGCijbGUOx0uDg2iiEEkGGMe0z6HjTnUb/I/pK4GNB6
vuPXe+YQAsWtbd6eO+xha1+Fb7jtCLUNmv0lcEV9PjaRawen/le7zQyzhoZynaUFeMqZamSwuwzn
wATbhj/QLPl25gwGS+ZNeG/usvqqC4MezawgOo8P/Ns8aN6jtZBibPeU8SHpycjp1igG7wDdQ6gB
y70tar/9dDJrUR+KKt995zhuntxhTlmiqzpS9ZHziQ==
=y9V3
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6573-1
January 09, 2024
linux-azure vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate some attributes passed from userspace. A local
attacker could use this to cause a denial of service (system crash) or
possibly expose sensitive information (kernel memory). (CVE-2023-39189)
Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did
not properly handle socket buffers (skb) when performing IP routing in
certain circumstances, leading to a null pointer dereference vulnerability.
A privileged attacker could use this to cause a denial of service (system
crash). (CVE-2023-42754)
Yikebaer Aizezi discovered that the ext4 file system implementation in the
Linux kernel contained a use-after-free vulnerability when handling inode
extent metadata. An attacker could use this to construct a malicious ext4
file system image that, when mounted, could cause a denial of service
(system crash). (CVE-2023-45898)
Jason Wang discovered that the virtio ring implementation in the Linux
kernel did not properly handle iov buffers in some situations. A local
attacker in a guest VM could use this to cause a denial of service (host
system crash). (CVE-2023-5158)
Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel
did not properly handle queue initialization failures in certain
situations, leading to a use-after-free vulnerability. A remote attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-5178)
Budimir Markovic discovered that the perf subsystem in the Linux kernel did
not properly handle event groups, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-5717)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
linux-image-6.5.0-1010-azure 6.5.0-1010.10
linux-image-6.5.0-1010-azure-fde 6.5.0-1010.10
linux-image-azure 6.5.0.1010.12
linux-image-azure-fde 6.5.0.1010.12
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6573-1
CVE-2023-39189, CVE-2023-42754, CVE-2023-45898, CVE-2023-5158,
CVE-2023-5178, CVE-2023-5717
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/6.5.0-1010.10
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmWdm6oFAwAAAAAACgkQZ0GeRcM5nt25
PQf9F3ZYR2f2HogE0/yvCfGDeHPl5jNIRb3DXx8vNIVrdso4o3fCbe61Gy4FBxROpYi8qUtapIPQ
nmqNBx9OOdhZ+ZEdSb8zCbodiRLf6C7IFrGCijbGUOx0uDg2iiEEkGGMe0z6HjTnUb/I/pK4GNB6
vuPXe+YQAsWtbd6eO+xha1+Fb7jtCLUNmv0lcEV9PjaRawen/le7zQyzhoZynaUFeMqZamSwuwzn
wATbhj/QLPl25gwGS+ZNeG/usvqqC4MezawgOo8P/Ns8aN6jtZBibPeU8SHpycjp1igG7wDdQ6gB
y70tar/9dDJrUR+KKt995zhuntxhTlmiqzpS9ZHziQ==
=y9V3
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6573-1
January 09, 2024
linux-azure vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate some attributes passed from userspace. A local
attacker could use this to cause a denial of service (system crash) or
possibly expose sensitive information (kernel memory). (CVE-2023-39189)
Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did
not properly handle socket buffers (skb) when performing IP routing in
certain circumstances, leading to a null pointer dereference vulnerability.
A privileged attacker could use this to cause a denial of service (system
crash). (CVE-2023-42754)
Yikebaer Aizezi discovered that the ext4 file system implementation in the
Linux kernel contained a use-after-free vulnerability when handling inode
extent metadata. An attacker could use this to construct a malicious ext4
file system image that, when mounted, could cause a denial of service
(system crash). (CVE-2023-45898)
Jason Wang discovered that the virtio ring implementation in the Linux
kernel did not properly handle iov buffers in some situations. A local
attacker in a guest VM could use this to cause a denial of service (host
system crash). (CVE-2023-5158)
Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel
did not properly handle queue initialization failures in certain
situations, leading to a use-after-free vulnerability. A remote attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-5178)
Budimir Markovic discovered that the perf subsystem in the Linux kernel did
not properly handle event groups, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-5717)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
linux-image-6.5.0-1010-azure 6.5.0-1010.10
linux-image-6.5.0-1010-azure-fde 6.5.0-1010.10
linux-image-azure 6.5.0.1010.12
linux-image-azure-fde 6.5.0.1010.12
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6573-1
CVE-2023-39189, CVE-2023-42754, CVE-2023-45898, CVE-2023-5158,
CVE-2023-5178, CVE-2023-5717
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/6.5.0-1010.10
[USN-6571-1] Monit vulnerability
-----BEGIN PGP SIGNATURE-----
wsB5BAABCAAjFiEE5rkwSLC9ntq84w397Dtram9gyMMFAmWdfOIFAwAAAAAACgkQ7Dtram9gyMMP
/Af/ela87Mn31fTArVocM55vhyDlLYdpPgAGE+yHQ50yA0NP0aqX0qbYHuOP1T5ZNBKu7dT6gEhk
TJhRx91rLPCSiCXegqJ/lTV9Bfq3+5FtI2dmaNs8QvcYAzFCtgUInk61rruW4B8y/QxynZch9lee
BQBDm4yPSqj26642mbq2H2H6CF/TrPA6MvkmbcElOzcq/pnTI0SJ/u+cr1J3ps6TLbsrJvJkkChh
6HxxlaCquiCluQhOgNX0Lj4IAVQFim4VdTcefKnu9QZq13CGCJfC7MNozgw8CXlbUYfgBgYFFfig
9R23mu/BiZN2fmB1odpHo0rOkqgD18FfehQtAZH/LQ==
=VJaE
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6571-1
January 09, 2024
monit vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS (Available with Ubuntu Pro)
- Ubuntu 20.04 LTS (Available with Ubuntu Pro)
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Monit could be made to bypass authentication checks for disabled accounts.
Software Description:
- monit: utility for monitoring and managing daemons or similar programs
Details:
Youssef Rebahi-Gilbert discovered that Monit did not properly process
credentials for disabled accounts. An attacker could possibly use this
issue to login to the platform with an expired account and a valid
password.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS (Available with Ubuntu Pro):
monit 1:5.31.0-1ubuntu0.1~esm1
Ubuntu 20.04 LTS (Available with Ubuntu Pro):
monit 1:5.26.0-4ubuntu0.1~esm1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
monit 1:5.25.1-1ubuntu0.1~esm2
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
monit 1:5.16-2ubuntu0.2+esm2
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
monit 1:5.6-2ubuntu0.1+esm3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6571-1
CVE-2022-26563
wsB5BAABCAAjFiEE5rkwSLC9ntq84w397Dtram9gyMMFAmWdfOIFAwAAAAAACgkQ7Dtram9gyMMP
/Af/ela87Mn31fTArVocM55vhyDlLYdpPgAGE+yHQ50yA0NP0aqX0qbYHuOP1T5ZNBKu7dT6gEhk
TJhRx91rLPCSiCXegqJ/lTV9Bfq3+5FtI2dmaNs8QvcYAzFCtgUInk61rruW4B8y/QxynZch9lee
BQBDm4yPSqj26642mbq2H2H6CF/TrPA6MvkmbcElOzcq/pnTI0SJ/u+cr1J3ps6TLbsrJvJkkChh
6HxxlaCquiCluQhOgNX0Lj4IAVQFim4VdTcefKnu9QZq13CGCJfC7MNozgw8CXlbUYfgBgYFFfig
9R23mu/BiZN2fmB1odpHo0rOkqgD18FfehQtAZH/LQ==
=VJaE
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6571-1
January 09, 2024
monit vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS (Available with Ubuntu Pro)
- Ubuntu 20.04 LTS (Available with Ubuntu Pro)
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Monit could be made to bypass authentication checks for disabled accounts.
Software Description:
- monit: utility for monitoring and managing daemons or similar programs
Details:
Youssef Rebahi-Gilbert discovered that Monit did not properly process
credentials for disabled accounts. An attacker could possibly use this
issue to login to the platform with an expired account and a valid
password.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS (Available with Ubuntu Pro):
monit 1:5.31.0-1ubuntu0.1~esm1
Ubuntu 20.04 LTS (Available with Ubuntu Pro):
monit 1:5.26.0-4ubuntu0.1~esm1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
monit 1:5.25.1-1ubuntu0.1~esm2
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
monit 1:5.16-2ubuntu0.2+esm2
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
monit 1:5.6-2ubuntu0.1+esm3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6571-1
CVE-2022-26563
[arch-announce] Making dbus-broker our default D-Bus daemon
We are making `dbus-broker` our default implementation of D-Bus, for
improved performance, reliability and integration with systemd.
For the foreseeable future we will still support the use of `dbus-daemon`,
the previous implementation. Pacman will ask you whether to install
`dbus-broker-units` or `dbus-daemon-units`. We recommend picking the
default.
For a more detailed rationale, please see our [RFC 25][1].
[1]: https://gitlab.archlinux.org/archlinux/rfcs/-/blob/master/rfcs/0025-dbus-broker-default.rst
URL: https://archlinux.org/news/making-dbus-broker-our-default-d-bus-daemon/
improved performance, reliability and integration with systemd.
For the foreseeable future we will still support the use of `dbus-daemon`,
the previous implementation. Pacman will ask you whether to install
`dbus-broker-units` or `dbus-daemon-units`. We recommend picking the
default.
For a more detailed rationale, please see our [RFC 25][1].
[1]: https://gitlab.archlinux.org/archlinux/rfcs/-/blob/master/rfcs/0025-dbus-broker-default.rst
URL: https://archlinux.org/news/making-dbus-broker-our-default-d-bus-daemon/
[USN-6038-2] Go vulnerabilities
-----BEGIN PGP PUBLIC KEY BLOCK-----
xsFNBGT1vF8BEAC2w6Af0VgaEvUzWv6T0qj98y+DqoSm76w3SdXg1rTgR/pX3a9c
tlfnoCZcyeSf+ttUnkha9vyzFfhz0u5IFDehqadQyfBCxemeEA+b1KBhSMGpiuRd
KMwOggQObp7oGdjImQRDT2CfQOWg1KsVk2o4lIuYZNcg8BWSyVlKxXEJ+hKmeDmO
P53rzY7l/gSHaeJ2bpYY5dCw0OLVLb/3QdrPthvYg4zvGzgvVwEKGsocADboqFYk
GuffEuYe1DYOCXbAx6Q59ZP/V7IlIFE9kiUpOAAAf6r/qkVBm3Zj4DtTuTMipsdJ
A6cQvvuMx9Qm37u7fOhosdNczZ2Zt38bLu9Gz2oL9mG0YBCe8Qfgf+pXLc6BKOLB
dwymVtV43cz7vlDOhRojWpsVxggV1FecjJ+cdP4FWAusE11ST60pY/W+y61MLzfs
qy3O3MIoQjXBaEGGTtPiEpVeZL+1v8aJuB5sJLAj56OmgSpcc7NqBHwUgjoeMA4y
87utHUSr4II/Ay1H4xOEZoCE+vIC61G32TwTco3WMhtISSOnRZHsc6GRuBeVr5fq
xEvmmo8lG+u5IgDpakbC/OpDxzemCiYJWCiUgF7X7VnlLLBVyxUMv9P1edursuk1
E2W5sl7RYIiPos23YU/Q66rER/egPX6YmsAr38FcqGYh9ZOauSfmKQ0pDwARAQAB
zVVEYXZpZCBGZXJuYW5kZXogR29uemFsZXogKFNpZ24gKyBlbmNyeXB0IGtleSkg
PGRhdmlkLmZlcm5hbmRlemdvbnphbGV6QGNhbm9uaWNhbC5jb20+wsGUBBMBCgA+
FiEELi4vmPVwZWdpuqdqlvdwxzm8Ws4FAmT1vF8CGwMFCQICKQAFCwkIBwIGFQoJ
CAsCBBYCAwECHgECF4AACgkQlvdwxzm8Ws5bUBAAkWPMosnc2/qqCyLSxkO5ACoT
p527SNCSJU0oQqHghxa7dLQr4NrjMsiNIR3GzVl+IeOR3BvIIwGl3VwQ110dAegX
kQ7jSq6k5bMT9UWJ5O6ju47cxQ1QzYwp5xD1rel8CPouvHHoqIGF0IWB74/BDPRK
7HPsip0P/mQFDaqm/lfxJXE9ZX/nsrqfzQpPMMyChXQbkMYr3Nw5j5AiOwHIZX2c
NksAiziNhzqjK5zPRYLIAwMuFgSyAOoBQamclRbPSNEV5A4D+jOflFy4II636ZEh
gs8+e8ggMb4tCofgolHLOzgzOReClVed6jegQI3rU/YFiyA8oC5pEnTk3qnc6Uzd
Fsrmh8nj2sSElcIf6HL2AITyzbja6MHSbNa5yoVqePQNZySYn+odOHA5TETR8U1p
KGs5oNQvMvWIW+o8t8m+di/a3vwzl9M4HnwCAM513qnv5Bqt/qucedCSFNQvf0Xs
f+2YxWckYC6w0QjJyvR22zYrhd4K87rr6HTu+qeonnivU1ePSc6SMEbvHS8uWgh0
nN+qCxkh4UzqBL2qnkRxB3VGF1peLGPjefmIkGt236B9/xkEcSOD7ZHz9xa00jQx
3tDLTHnelsLvk8gnIaBku0cnMtCo5DUyOH04pKif7uhbPLkNbEy4zyD9ga2hoX5R
gkeELpyDEi6bhMs66z/OwU0EZPW8XwEQAM/loHx2tM4KYXFBrQmsaFlOHFHTrj80
hMWDM4KEXo9+ufaXZnoJFAjo4Dmh+MT4Xcfs1ooowoWlik6nDQ6DwYtk237YwK/f
s4H/SbZ/p3uwdN+vCcXcQm5lUf927iVALCE9jJBwZrfr5EA808elZZzQSCT05lMm
lnHICso+l1qjysReXb6mzFqGGvgRtU9HnvkFKW8dx4W/++VVSJP7tf2aKVcpyWj4
GrS8I+4S6RYDMlUGNky1/fZWZsuJPv0Prv6NqhS/8QbwpI3b0RwK//ZF7ur8KIHE
+fiA8weqxHGQG0pAOZNgCjc5YF9sz4ooMZMhQHKVRknNVcGng6HORaZJkKtZKRHd
kCDo0DrQLiKmlKo8DkZozv9YFVxyoYESAfcxLhnKiaRT/RE6QLt85VUItPl8lEQh
1erCt74VG5UoIW+sE5Lz/xAjwPMK5XUwIZJJHEp/RVRqMzyxoqM0vIexS+CfFn0X
0Ayew3oEL4oguF4NJRb609I25tKFQU/b+AiTvA2DkiZ1hH5yk6kgg4VS21czCDJB
5UoZ8FgGdSP/PN8DQZ50X0A1x2VO83Pje5FhlEUKVs2eKbb48989RNCcYNwHy2lY
Ch3o4HzfS+Zhf2lgljoNJrj/rsSGanMFCmLcLZqQWaNN3I3suuDBr8IZJJiKP/SE
OyoV3lWFnQGhABEBAAHCwXwEGAEKACYWIQQuLi+Y9XBlZ2m6p2qW93DHObxazgUC
ZPW8XwIbDAUJAgIpAAAKCRCW93DHObxazqt5D/938SB3G2m5LzR5aYgBpn3C5arg
O3QO0JHsmzXXzCRZ0f8hPVZPNiuii3UwTX4v4eDcgi8MZnaEmxG0vQosal28Yd6f
jJdwNUv74K68N7xB5kAlwC/jONbAeSmod3EwUq8vKINseV/IzBux/uX3CBwvDpGi
a6v/h0EzuF5HQjguvu7/JSuVxP6y0aJ4gECmOJQMtppSlFBXzD5U6E2X6v6zHvqY
tkgwn00Y9J+V60+vncxAGfSJtcLOceAY2rEmj1bl8rhRCTcacImyh0HKfIST+v9o
Jx+opSyHo1RjhwcbmSoc3U5CGZx+y05H/WceQgett5qOZAGUDZhprTt+j/+scrAR
zZf0zzlpkao8UoergBMYc8iTmJ54/iQSxrk1WjS7OecP45oV7fwBNkQZeZuPITnD
0VP/RPpjd4Qz6eDWaccZPCrS785I0Onylygn5aOktDPU3eOmEhrHMuG+JSjfVqbi
m7jVqPFjWg3Loprmpwa1CGd2039Pa/jWfwh0bxsosSdf09kVj+UvlH4Y85Ve57LU
q9U+cpekCs/VZdL277tiMA2uFvQDSepwmQdBUYxkJSffVfK/cJhzZdY0FjsiVySl
kLVKxp9HzWMCMKaIqdXE+4STZz8/FAE8e3yuEbsXs/pmEtR0MZa8pBwmOvN5CSvG
u/zTgENjjv+UNmNeRA==
=IEGB
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE4I1aChuaH07AdH+adlTpHiRAJW0FAmWdXEsACgkQdlTpHiRA
JW0rbhAAtAtZz51JaUW6gCOnFRS+RgBZGgAPM0X9TQ/N5BaxRTD6w5c01KwgdgIe
FIzBaRZNes3YcgZiA8+RLxzpUeWaA62GkNWPmOiYsJpCHxTG7PHRMS+C09NM5+tv
yqMsKg1ZJ8klZmYACIGroYjyB4gWC0gl/XWeQrhXXB/AzDtbm4olJfb1kQ+/dwxY
IZ/WoM+Xi40U1TNOaQLBK5VZoTuX2Tr4dqGImgkaOQToOqgFz127AI3efoVo6UnD
WmXDH2l/BL/uk/UDH3jCtaOkvCd4xtgJK5bkYHYWnd83leXnUXprFjckAFTelYDO
qgbERC5Ng8EEb5pzfurgETuJ9ipQ0z/Vyn9/QNDLz0RfpqFR9psRRetsuOLIYBv3
jOXJi5OMzEeG32btUaK4Hpt6EshUesWJGHyjMoFdOwkdLIFGvaoQ6NGT8Q4CENUP
Y631boBt23x14pfC/GIyIcFeeqBqgprueX3nyalQ18cmLD8D8Sm5tubc7ysAZegz
7GS/4lo7DLOGD1dwwFKFxPGpYuRuh846M/1RQKDT3+f6QJVt2Vc4SHYBF+O9rvvr
9FnsuxIXKU5uZle55HdBolGs4FqV8VPtFx7OOU/2XTZuULHk+ox67DuhqiLNwrTK
VV+k9tpVUSQN1qLxVecmZIIn/MnzgV1kw+Jm+lnTN116HnC63y4=
=gS9V
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6038-2
January 09, 2024
golang-1.13, golang-1.16 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in Go.
Software Description:
- golang-1.13: Go programming language compiler
- golang-1.16: Go programming language compiler
Details:
USN-6038-1 fixed several vulnerabilities in Go 1.18. This update provides
the corresponding updates for Go 1.13 and Go 1.16.
CVE-2022-29526 and CVE-2022-30630 only affected Go 1.16.
Original advisory details:
It was discovered that the Go net/http module incorrectly handled
Transfer-Encoding headers in the HTTP/1 client. A remote attacker could
possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-1705)
It was discovered that Go did not properly manage memory under certain
circumstances. An attacker could possibly use this issue to cause a panic
resulting into a denial of service. (CVE-2022-1962, CVE-2022-27664,
CVE-2022-28131, CVE-2022-30630, CVE-2022-30631, CVE-2022-30632,
CVE-2022-30633, CVE-2022-30635, CVE-2022-32189, CVE-2022-41715,
CVE-2022-41717, CVE-2023-24534, CVE-2023-24537)
It was discovered that Go did not properly implemented the maximum size of
file headers in Reader.Read. An attacker could possibly use this issue to
cause a panic resulting into a denial of service. (CVE-2022-2879)
It was discovered that the Go net/http module incorrectly handled query
parameters in requests forwarded by ReverseProxy. A remote attacker could
possibly use this issue to perform an HTTP Query Parameter Smuggling
attack.
(CVE-2022-2880)
It was discovered that Go did not properly manage the permissions for
Faccessat function. A attacker could possibly use this issue to expose
sensitive information. (CVE-2022-29526)
It was discovered that Go did not properly generate the values for
ticket_age_add in session tickets. An attacker could possibly use this
issue to observe TLS handshakes to correlate successive connections by
comparing ticket ages during session resumption. (CVE-2022-30629)
It was discovered that Go did not properly manage client IP addresses in
net/http. An attacker could possibly use this issue to cause ReverseProxy
to set the client IP as the value of the X-Forwarded-For header.
(CVE-2022-32148)
It was discovered that Go did not properly validate backticks (`) as
Javascript string delimiters, and do not escape them as expected. An
attacker could possibly use this issue to inject arbitrary Javascript code
into the Go template. (CVE-2023-24538)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
golang-1.13 1.13.8-1ubuntu2.22.04.2
golang-1.13-go 1.13.8-1ubuntu2.22.04.2
golang-1.13-src 1.13.8-1ubuntu2.22.04.2
Ubuntu 20.04 LTS:
golang-1.13 1.13.8-1ubuntu1.2
golang-1.13-go 1.13.8-1ubuntu1.2
golang-1.13-src 1.13.8-1ubuntu1.2
golang-1.16 1.16.2-0ubuntu1~20.04.1
golang-1.16-go 1.16.2-0ubuntu1~20.04.1
golang-1.16-src 1.16.2-0ubuntu1~20.04.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
golang-1.13 1.13.8-1ubuntu1~18.04.4+esm1
golang-1.13-go 1.13.8-1ubuntu1~18.04.4+esm1
golang-1.13-src 1.13.8-1ubuntu1~18.04.4+esm1
golang-1.16 1.16.2-0ubuntu1~18.04.2+esm1
golang-1.16-go 1.16.2-0ubuntu1~18.04.2+esm1
golang-1.16-src 1.16.2-0ubuntu1~18.04.2+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
golang-1.13 1.13.8-1ubuntu1~16.04.3+esm3
golang-1.13-go 1.13.8-1ubuntu1~16.04.3+esm3
golang-1.13-src 1.13.8-1ubuntu1~16.04.3+esm3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6038-2
https://ubuntu.com/security/notices/USN-6038-1
CVE-2022-1705, CVE-2022-27664, CVE-2022-28131, CVE-2022-2879,
CVE-2022-2880, CVE-2022-29526, CVE-2022-30629, CVE-2022-30630,
CVE-2022-30631, CVE-2022-30632, CVE-2022-30633, CVE-2022-30635,
CVE-2022-32148, CVE-2022-32189, CVE-2022-41717, CVE-2023-24534,
CVE-2023-24537, CVE-2023-24538
Package Information:
https://launchpad.net/ubuntu/+source/golang-1.13/1.13.8-1ubuntu2.22.04.2
https://launchpad.net/ubuntu/+source/golang-1.13/1.13.8-1ubuntu1.2
https://launchpad.net/ubuntu/+source/golang-1.16/1.16.2-0ubuntu1~20.04.1
xsFNBGT1vF8BEAC2w6Af0VgaEvUzWv6T0qj98y+DqoSm76w3SdXg1rTgR/pX3a9c
tlfnoCZcyeSf+ttUnkha9vyzFfhz0u5IFDehqadQyfBCxemeEA+b1KBhSMGpiuRd
KMwOggQObp7oGdjImQRDT2CfQOWg1KsVk2o4lIuYZNcg8BWSyVlKxXEJ+hKmeDmO
P53rzY7l/gSHaeJ2bpYY5dCw0OLVLb/3QdrPthvYg4zvGzgvVwEKGsocADboqFYk
GuffEuYe1DYOCXbAx6Q59ZP/V7IlIFE9kiUpOAAAf6r/qkVBm3Zj4DtTuTMipsdJ
A6cQvvuMx9Qm37u7fOhosdNczZ2Zt38bLu9Gz2oL9mG0YBCe8Qfgf+pXLc6BKOLB
dwymVtV43cz7vlDOhRojWpsVxggV1FecjJ+cdP4FWAusE11ST60pY/W+y61MLzfs
qy3O3MIoQjXBaEGGTtPiEpVeZL+1v8aJuB5sJLAj56OmgSpcc7NqBHwUgjoeMA4y
87utHUSr4II/Ay1H4xOEZoCE+vIC61G32TwTco3WMhtISSOnRZHsc6GRuBeVr5fq
xEvmmo8lG+u5IgDpakbC/OpDxzemCiYJWCiUgF7X7VnlLLBVyxUMv9P1edursuk1
E2W5sl7RYIiPos23YU/Q66rER/egPX6YmsAr38FcqGYh9ZOauSfmKQ0pDwARAQAB
zVVEYXZpZCBGZXJuYW5kZXogR29uemFsZXogKFNpZ24gKyBlbmNyeXB0IGtleSkg
PGRhdmlkLmZlcm5hbmRlemdvbnphbGV6QGNhbm9uaWNhbC5jb20+wsGUBBMBCgA+
FiEELi4vmPVwZWdpuqdqlvdwxzm8Ws4FAmT1vF8CGwMFCQICKQAFCwkIBwIGFQoJ
CAsCBBYCAwECHgECF4AACgkQlvdwxzm8Ws5bUBAAkWPMosnc2/qqCyLSxkO5ACoT
p527SNCSJU0oQqHghxa7dLQr4NrjMsiNIR3GzVl+IeOR3BvIIwGl3VwQ110dAegX
kQ7jSq6k5bMT9UWJ5O6ju47cxQ1QzYwp5xD1rel8CPouvHHoqIGF0IWB74/BDPRK
7HPsip0P/mQFDaqm/lfxJXE9ZX/nsrqfzQpPMMyChXQbkMYr3Nw5j5AiOwHIZX2c
NksAiziNhzqjK5zPRYLIAwMuFgSyAOoBQamclRbPSNEV5A4D+jOflFy4II636ZEh
gs8+e8ggMb4tCofgolHLOzgzOReClVed6jegQI3rU/YFiyA8oC5pEnTk3qnc6Uzd
Fsrmh8nj2sSElcIf6HL2AITyzbja6MHSbNa5yoVqePQNZySYn+odOHA5TETR8U1p
KGs5oNQvMvWIW+o8t8m+di/a3vwzl9M4HnwCAM513qnv5Bqt/qucedCSFNQvf0Xs
f+2YxWckYC6w0QjJyvR22zYrhd4K87rr6HTu+qeonnivU1ePSc6SMEbvHS8uWgh0
nN+qCxkh4UzqBL2qnkRxB3VGF1peLGPjefmIkGt236B9/xkEcSOD7ZHz9xa00jQx
3tDLTHnelsLvk8gnIaBku0cnMtCo5DUyOH04pKif7uhbPLkNbEy4zyD9ga2hoX5R
gkeELpyDEi6bhMs66z/OwU0EZPW8XwEQAM/loHx2tM4KYXFBrQmsaFlOHFHTrj80
hMWDM4KEXo9+ufaXZnoJFAjo4Dmh+MT4Xcfs1ooowoWlik6nDQ6DwYtk237YwK/f
s4H/SbZ/p3uwdN+vCcXcQm5lUf927iVALCE9jJBwZrfr5EA808elZZzQSCT05lMm
lnHICso+l1qjysReXb6mzFqGGvgRtU9HnvkFKW8dx4W/++VVSJP7tf2aKVcpyWj4
GrS8I+4S6RYDMlUGNky1/fZWZsuJPv0Prv6NqhS/8QbwpI3b0RwK//ZF7ur8KIHE
+fiA8weqxHGQG0pAOZNgCjc5YF9sz4ooMZMhQHKVRknNVcGng6HORaZJkKtZKRHd
kCDo0DrQLiKmlKo8DkZozv9YFVxyoYESAfcxLhnKiaRT/RE6QLt85VUItPl8lEQh
1erCt74VG5UoIW+sE5Lz/xAjwPMK5XUwIZJJHEp/RVRqMzyxoqM0vIexS+CfFn0X
0Ayew3oEL4oguF4NJRb609I25tKFQU/b+AiTvA2DkiZ1hH5yk6kgg4VS21czCDJB
5UoZ8FgGdSP/PN8DQZ50X0A1x2VO83Pje5FhlEUKVs2eKbb48989RNCcYNwHy2lY
Ch3o4HzfS+Zhf2lgljoNJrj/rsSGanMFCmLcLZqQWaNN3I3suuDBr8IZJJiKP/SE
OyoV3lWFnQGhABEBAAHCwXwEGAEKACYWIQQuLi+Y9XBlZ2m6p2qW93DHObxazgUC
ZPW8XwIbDAUJAgIpAAAKCRCW93DHObxazqt5D/938SB3G2m5LzR5aYgBpn3C5arg
O3QO0JHsmzXXzCRZ0f8hPVZPNiuii3UwTX4v4eDcgi8MZnaEmxG0vQosal28Yd6f
jJdwNUv74K68N7xB5kAlwC/jONbAeSmod3EwUq8vKINseV/IzBux/uX3CBwvDpGi
a6v/h0EzuF5HQjguvu7/JSuVxP6y0aJ4gECmOJQMtppSlFBXzD5U6E2X6v6zHvqY
tkgwn00Y9J+V60+vncxAGfSJtcLOceAY2rEmj1bl8rhRCTcacImyh0HKfIST+v9o
Jx+opSyHo1RjhwcbmSoc3U5CGZx+y05H/WceQgett5qOZAGUDZhprTt+j/+scrAR
zZf0zzlpkao8UoergBMYc8iTmJ54/iQSxrk1WjS7OecP45oV7fwBNkQZeZuPITnD
0VP/RPpjd4Qz6eDWaccZPCrS785I0Onylygn5aOktDPU3eOmEhrHMuG+JSjfVqbi
m7jVqPFjWg3Loprmpwa1CGd2039Pa/jWfwh0bxsosSdf09kVj+UvlH4Y85Ve57LU
q9U+cpekCs/VZdL277tiMA2uFvQDSepwmQdBUYxkJSffVfK/cJhzZdY0FjsiVySl
kLVKxp9HzWMCMKaIqdXE+4STZz8/FAE8e3yuEbsXs/pmEtR0MZa8pBwmOvN5CSvG
u/zTgENjjv+UNmNeRA==
=IEGB
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE4I1aChuaH07AdH+adlTpHiRAJW0FAmWdXEsACgkQdlTpHiRA
JW0rbhAAtAtZz51JaUW6gCOnFRS+RgBZGgAPM0X9TQ/N5BaxRTD6w5c01KwgdgIe
FIzBaRZNes3YcgZiA8+RLxzpUeWaA62GkNWPmOiYsJpCHxTG7PHRMS+C09NM5+tv
yqMsKg1ZJ8klZmYACIGroYjyB4gWC0gl/XWeQrhXXB/AzDtbm4olJfb1kQ+/dwxY
IZ/WoM+Xi40U1TNOaQLBK5VZoTuX2Tr4dqGImgkaOQToOqgFz127AI3efoVo6UnD
WmXDH2l/BL/uk/UDH3jCtaOkvCd4xtgJK5bkYHYWnd83leXnUXprFjckAFTelYDO
qgbERC5Ng8EEb5pzfurgETuJ9ipQ0z/Vyn9/QNDLz0RfpqFR9psRRetsuOLIYBv3
jOXJi5OMzEeG32btUaK4Hpt6EshUesWJGHyjMoFdOwkdLIFGvaoQ6NGT8Q4CENUP
Y631boBt23x14pfC/GIyIcFeeqBqgprueX3nyalQ18cmLD8D8Sm5tubc7ysAZegz
7GS/4lo7DLOGD1dwwFKFxPGpYuRuh846M/1RQKDT3+f6QJVt2Vc4SHYBF+O9rvvr
9FnsuxIXKU5uZle55HdBolGs4FqV8VPtFx7OOU/2XTZuULHk+ox67DuhqiLNwrTK
VV+k9tpVUSQN1qLxVecmZIIn/MnzgV1kw+Jm+lnTN116HnC63y4=
=gS9V
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6038-2
January 09, 2024
golang-1.13, golang-1.16 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in Go.
Software Description:
- golang-1.13: Go programming language compiler
- golang-1.16: Go programming language compiler
Details:
USN-6038-1 fixed several vulnerabilities in Go 1.18. This update provides
the corresponding updates for Go 1.13 and Go 1.16.
CVE-2022-29526 and CVE-2022-30630 only affected Go 1.16.
Original advisory details:
It was discovered that the Go net/http module incorrectly handled
Transfer-Encoding headers in the HTTP/1 client. A remote attacker could
possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-1705)
It was discovered that Go did not properly manage memory under certain
circumstances. An attacker could possibly use this issue to cause a panic
resulting into a denial of service. (CVE-2022-1962, CVE-2022-27664,
CVE-2022-28131, CVE-2022-30630, CVE-2022-30631, CVE-2022-30632,
CVE-2022-30633, CVE-2022-30635, CVE-2022-32189, CVE-2022-41715,
CVE-2022-41717, CVE-2023-24534, CVE-2023-24537)
It was discovered that Go did not properly implemented the maximum size of
file headers in Reader.Read. An attacker could possibly use this issue to
cause a panic resulting into a denial of service. (CVE-2022-2879)
It was discovered that the Go net/http module incorrectly handled query
parameters in requests forwarded by ReverseProxy. A remote attacker could
possibly use this issue to perform an HTTP Query Parameter Smuggling
attack.
(CVE-2022-2880)
It was discovered that Go did not properly manage the permissions for
Faccessat function. A attacker could possibly use this issue to expose
sensitive information. (CVE-2022-29526)
It was discovered that Go did not properly generate the values for
ticket_age_add in session tickets. An attacker could possibly use this
issue to observe TLS handshakes to correlate successive connections by
comparing ticket ages during session resumption. (CVE-2022-30629)
It was discovered that Go did not properly manage client IP addresses in
net/http. An attacker could possibly use this issue to cause ReverseProxy
to set the client IP as the value of the X-Forwarded-For header.
(CVE-2022-32148)
It was discovered that Go did not properly validate backticks (`) as
Javascript string delimiters, and do not escape them as expected. An
attacker could possibly use this issue to inject arbitrary Javascript code
into the Go template. (CVE-2023-24538)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
golang-1.13 1.13.8-1ubuntu2.22.04.2
golang-1.13-go 1.13.8-1ubuntu2.22.04.2
golang-1.13-src 1.13.8-1ubuntu2.22.04.2
Ubuntu 20.04 LTS:
golang-1.13 1.13.8-1ubuntu1.2
golang-1.13-go 1.13.8-1ubuntu1.2
golang-1.13-src 1.13.8-1ubuntu1.2
golang-1.16 1.16.2-0ubuntu1~20.04.1
golang-1.16-go 1.16.2-0ubuntu1~20.04.1
golang-1.16-src 1.16.2-0ubuntu1~20.04.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
golang-1.13 1.13.8-1ubuntu1~18.04.4+esm1
golang-1.13-go 1.13.8-1ubuntu1~18.04.4+esm1
golang-1.13-src 1.13.8-1ubuntu1~18.04.4+esm1
golang-1.16 1.16.2-0ubuntu1~18.04.2+esm1
golang-1.16-go 1.16.2-0ubuntu1~18.04.2+esm1
golang-1.16-src 1.16.2-0ubuntu1~18.04.2+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
golang-1.13 1.13.8-1ubuntu1~16.04.3+esm3
golang-1.13-go 1.13.8-1ubuntu1~16.04.3+esm3
golang-1.13-src 1.13.8-1ubuntu1~16.04.3+esm3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6038-2
https://ubuntu.com/security/notices/USN-6038-1
CVE-2022-1705, CVE-2022-27664, CVE-2022-28131, CVE-2022-2879,
CVE-2022-2880, CVE-2022-29526, CVE-2022-30629, CVE-2022-30630,
CVE-2022-30631, CVE-2022-30632, CVE-2022-30633, CVE-2022-30635,
CVE-2022-32148, CVE-2022-32189, CVE-2022-41717, CVE-2023-24534,
CVE-2023-24537, CVE-2023-24538
Package Information:
https://launchpad.net/ubuntu/+source/golang-1.13/1.13.8-1ubuntu2.22.04.2
https://launchpad.net/ubuntu/+source/golang-1.13/1.13.8-1ubuntu1.2
https://launchpad.net/ubuntu/+source/golang-1.16/1.16.2-0ubuntu1~20.04.1
Monday, January 8, 2024
[USN-6568-1] ClamAV update
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmWcUUkACgkQZWnYVadE
vpP6sA//Q8jdGEeboBT6n747ePrb0+Z8YGjVMp8LWhUs3YeDzSAyjb8MP+s9rZmG
l9jP0XPgHFnjI7WdRd2veOaMDgydwumyBN3yRJ9KF0Xan2sMh+U02AJbhSViMUz3
rpHH1gJhI6WJXX0V2Yn5HwbZpWuQ2QjHftGVcxbb12AQe+JXQUgtWqxipXxoezjz
bzPDRg+1eb/VP9y2iLuo9Pd2jVg25VY0z1lu5ggVIsVZFHa55M3T4lYpHZ/55EfC
4yjBF2fozkWm9zbqcKKtukx8xNfWHcZ871BMXo6MB28QNoK4ddwQQlQy2QNu8nk6
DW0dF7O0k08T+d8BtFiZzVDC9TahvXe/aF5Oz5NpUYc/1bg2Vns7n77CBo+ubgD0
Es1uFVhliC6OPSOlRvt2VKjJ3LxY42faQ6pDfth933QOX1Xl4kt/Z03C4vUST7dH
7pj0lwEEIPMdiTqDKOFE0bOtEnyHSwTyc0ZyBdG+OImOhqE36X4PcvQTTavycQAN
qmpQq81PpJhT0aU1Fv/LwWV37mrkJYN9PbJJTnYND3/skdTGFjGlCPqMlBaSRdXc
s55FnBxTUk3Z79rXRrOTAXoNEBEqVtMeHyzFoQVbd0IZZrn7ShbecaMEFxq+GNtq
z7EO1Z2rS8tg2SxA7fx2JRKYlKIJlgdfF0xFE1fr8zy5arw99y0=
=5GlP
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6568-1
January 08, 2024
clamav update
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
ClamAV was updated to remain compatible with signature database downloads.
Software Description:
- clamav: Anti-virus utility for Unix
Details:
The ClamAV package was updated to a new upstream version to remain
compatible with signature database downloads.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
clamav 1.0.4+dfsg-0ubuntu0.23.10.1
Ubuntu 23.04:
clamav 0.103.11+dfsg-0ubuntu0.23.04.1
Ubuntu 22.04 LTS:
clamav 0.103.11+dfsg-0ubuntu0.22.04.1
Ubuntu 20.04 LTS:
clamav 0.103.11+dfsg-0ubuntu0.20.04.1
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
https://ubuntu.com/security/notices/USN-6568-1
https://launchpad.net/bugs/2046581
Package Information:
https://launchpad.net/ubuntu/+source/clamav/1.0.4+dfsg-0ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/clamav/0.103.11+dfsg-0ubuntu0.23.04.1
https://launchpad.net/ubuntu/+source/clamav/0.103.11+dfsg-0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/clamav/0.103.11+dfsg-0ubuntu0.20.04.1
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmWcUUkACgkQZWnYVadE
vpP6sA//Q8jdGEeboBT6n747ePrb0+Z8YGjVMp8LWhUs3YeDzSAyjb8MP+s9rZmG
l9jP0XPgHFnjI7WdRd2veOaMDgydwumyBN3yRJ9KF0Xan2sMh+U02AJbhSViMUz3
rpHH1gJhI6WJXX0V2Yn5HwbZpWuQ2QjHftGVcxbb12AQe+JXQUgtWqxipXxoezjz
bzPDRg+1eb/VP9y2iLuo9Pd2jVg25VY0z1lu5ggVIsVZFHa55M3T4lYpHZ/55EfC
4yjBF2fozkWm9zbqcKKtukx8xNfWHcZ871BMXo6MB28QNoK4ddwQQlQy2QNu8nk6
DW0dF7O0k08T+d8BtFiZzVDC9TahvXe/aF5Oz5NpUYc/1bg2Vns7n77CBo+ubgD0
Es1uFVhliC6OPSOlRvt2VKjJ3LxY42faQ6pDfth933QOX1Xl4kt/Z03C4vUST7dH
7pj0lwEEIPMdiTqDKOFE0bOtEnyHSwTyc0ZyBdG+OImOhqE36X4PcvQTTavycQAN
qmpQq81PpJhT0aU1Fv/LwWV37mrkJYN9PbJJTnYND3/skdTGFjGlCPqMlBaSRdXc
s55FnBxTUk3Z79rXRrOTAXoNEBEqVtMeHyzFoQVbd0IZZrn7ShbecaMEFxq+GNtq
z7EO1Z2rS8tg2SxA7fx2JRKYlKIJlgdfF0xFE1fr8zy5arw99y0=
=5GlP
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6568-1
January 08, 2024
clamav update
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
ClamAV was updated to remain compatible with signature database downloads.
Software Description:
- clamav: Anti-virus utility for Unix
Details:
The ClamAV package was updated to a new upstream version to remain
compatible with signature database downloads.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
clamav 1.0.4+dfsg-0ubuntu0.23.10.1
Ubuntu 23.04:
clamav 0.103.11+dfsg-0ubuntu0.23.04.1
Ubuntu 22.04 LTS:
clamav 0.103.11+dfsg-0ubuntu0.22.04.1
Ubuntu 20.04 LTS:
clamav 0.103.11+dfsg-0ubuntu0.20.04.1
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
https://ubuntu.com/security/notices/USN-6568-1
https://launchpad.net/bugs/2046581
Package Information:
https://launchpad.net/ubuntu/+source/clamav/1.0.4+dfsg-0ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/clamav/0.103.11+dfsg-0ubuntu0.23.04.1
https://launchpad.net/ubuntu/+source/clamav/0.103.11+dfsg-0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/clamav/0.103.11+dfsg-0ubuntu0.20.04.1
Subscribe to:
Posts (Atom)