Red Hat Security Advisory 2022-8865-01 - An update for python-XStatic-Bootstrap-SCSS is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2. Issues addressed include a cross site scripting vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack 16.1.9 (python-XStatic-Bootstrap-SCSS) security update  
Advisory ID:       RHSA-2022:8865-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8865  
Issue date:        2022-12-07  
CVE Names:         CVE-2019-8331  
====================================================================  
1. Summary:

An update for python-XStatic-Bootstrap-SCSS is now available for Red Hat  
OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.1 - noarch

3. Description:

Bootstrap style library packaged for setuptools (easy_install) / pip.

Security Fix(es):

* XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1686454 - CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute

6. Package List:

Red Hat OpenStack Platform 16.1:

Source:  
python-XStatic-Bootstrap-SCSS-3.4.1.0-2.el8ost.src.rpm

noarch:  
python3-XStatic-Bootstrap-SCSS-3.4.1.0-2.el8ost.noarch.rpm  
xstatic-bootstrap-scss-common-3.4.1.0-2.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-8331  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpdtzjgjWX9erEAQi+PQ//WgtiRPFZgWZEJYXEuv1aa6qZ1aeDOuHp  
5r8DVEov/APq+k0y1Hu9KQts7ruvUSwWtXwiCmldhEGcTdrs53PnuuykZqG2hKcT  
IzRj7Cat55yIs6hWFNUT6Whj+6LUEZd3kLfz9xqaYhNTJrIEtUAKxXoPjjd97DAQ  
j1OpfOGJKvdQyJ469RBOWbVeWaKCnFbJSkotlbW3OkhA4Qm8hbxvf8DCC1ysqXr3  
eN9lLabMpO69iHX9EUzGaSe73s+Yh/bT+Z/kN9fksAPC5uFRbEKwLS3Z0uONQbXm  
dtWbSiZRTLNZj3oSZg4FYIz8GJEFIZhPG7nP/pIoN0Pm2z0cwxbk+KxCdphsI05N  
k0vJst5aMX4AxvR1tocBDK5uwAQtfGgaitw/xIVw+63NtRMpmwqpva645i9pOpzC  
Fr9aCGJRZfpDt2AtMaKweCnuUBsPu3RaJWy786qGOAZ8W7WOqJL51nzJrUqCpvSB  
JVTEUYrwoCImeodmtl9OtpmTDUp7GKhrpdf0Jvugmau7H+J++SwA5CQE8BWw/JTm  
gs04sOX7ObmjqSBew6b1UbBMqqqMLSpBlAP6UoPYeQWjcK8ZMtiNVf2XhDb+KLc2  
0T4WGH0a6iT3v9NVromgDjFEXcKrw3mZ9QdUkzCSzAQDpO48Unw+Lf9IXPQCHRRA  
zJike7DwksY=ICYc  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8865-01

Red Hat Security Advisory 2022-8864-01 - UltraJSON is an ultra fast JSON encoder and decoder. Issues addressed include a double free vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack Platform 16.1.9 (python-ujson) security update  
Advisory ID:       RHSA-2022:8864-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8864  
Issue date:        2022-12-07  
CVE Names:         CVE-2022-31116 CVE-2022-31117  
====================================================================  
1. Summary:

An update for python-ujson is now available for Red Hat OpenStack Platform  
16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.1 - ppc64le, x86_64

3. Description:

UltraJSON is an ultra fast JSON encoder and decoder

Security Fix(es):

* improper decoding of escaped surrogate characters may lead to string  
corruption key confusion or value overwriting (CVE-2022-31116)

* Potential double free of buffer during string decoding (CVE-2022-31117)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2104739 - CVE-2022-31117 python-ujson: Potential double free of buffer during string decoding  
2104740 - CVE-2022-31116 python-ujson: improper decoding of escaped surrogate characters may lead to string corruption, key confusion or value overwriting

6. Package List:

Red Hat OpenStack Platform 16.1:

Source:  
python-ujson-2.0.3-3.el8ost.src.rpm

ppc64le:  
python-ujson-debugsource-2.0.3-3.el8ost.ppc64le.rpm  
python3-ujson-2.0.3-3.el8ost.ppc64le.rpm  
python3-ujson-debuginfo-2.0.3-3.el8ost.ppc64le.rpm

x86_64:  
python-ujson-debugsource-2.0.3-3.el8ost.x86_64.rpm  
python3-ujson-2.0.3-3.el8ost.x86_64.rpm  
python3-ujson-debuginfo-2.0.3-3.el8ost.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-31116  
https://access.redhat.com/security/cve/CVE-2022-31117  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpmNzjgjWX9erEAQhZfQ/+IhYH6eqe+ywktC+Y63UbIW62u+lB3vlZ  
XUHQnxrfTfdrFs5NzaAWRpEq09NAa+BTqaveN4s9UwL7GHkBCjVcUaefV6jW1ZNf  
kee52203dPdPfQhkC048p+g9tfb4rIZmGkh/bK13z/T7cD5GhEDbI1600hYGP2YB  
YhmyzU3J+dGhm7RzgSCmpvXTE7A0Aw0glXq3gGHTG9za2970TeS64QFo/x7IrI54  
ZjuL8O6zZS/nQbx7PpE60i/unjlMHqlAs1VjF5a4JsMrvE+cGr2DW2OL6Bs8a7yH  
hVSLDIsG/hqUrmIlk0uvhzf1YX+sRRBvfI1883Pv26/NMXBAcie/yTn/VFRnnCzq  
dsEzWG1BPc14x+ZTvDNd/UtJvEJQ01p8du9x6iOLXtdZI5GvvmSAqRime9TsObFc  
GYVmPfhMIaA+Gqw9GUDk1eunRMPwtSxO5fnwaXZQ8Mpmdst/bYMFqe5KQvWINbqW  
uTC7pvv18H0PI2kNfJMYbImSCGCOaT3SW6mC+RNtKdIVJN4xzlwNkH9Q/P37/CdU  
lQDPal/FJgIDT7JDOuYJPF9Ln4DpGc+EjL9DekKpDQytQxVH7DONgAeZMmi99r4l  
unWj9QI6H/Nar0UHEyv4UExvJrInVl17McZ+V6gAvzM86ePqkf6xiESzoXGwAQBa  
ZQt1OY6ucVg¦iB  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8864-01

Red Hat Security Advisory 2022-8851-01 - An update for rabbitmq-server is now available for Red Hat OpenStack Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4. Issues addressed include cross site scripting and improper neutralization vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Low: Red Hat OpenStack Platform 16.2.4 (rabbitmq-server) security update  
Advisory ID:       RHSA-2022:8851-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8851  
Issue date:        2022-12-07  
CVE Names:         CVE-2021-32718 CVE-2021-32719  
====================================================================  
1. Summary:

An update for rabbitmq-server is now available for Red Hat OpenStack  
Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4.

Red Hat Product Security has rated this update as having a security impact  
of Low. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.2 - ppc64le, x86_64

3. Description:

RabbitMQ is an implementation of AMQP, the emerging standard for high  
performance enterprise messaging. The RabbitMQ server is a robust and  
scalable implementation of an AMQP broker. # We want to install into  
/usr/lib, even on 64-bit platforms

Security Fix(es):

* improper neutralization of script-related HTML tags in a web page (basic  
XSS) in management UI (CVE-2021-32718)

* improper neutralization of script-related HTML tags in a web page (basic  
XSS) in federation management plugin (CVE-2021-32719)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1977002 - CVE-2021-32718 rabbitmq-server: improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI  
1977008 - CVE-2021-32719 rabbitmq-server: improper neutralization of script-related HTML tags in a web page (basic XSS) in federation management plugin

6. Package List:

Red Hat OpenStack Platform 16.2:

Source:  
rabbitmq-server-3.8.16-3.el8ost.src.rpm

ppc64le:  
rabbitmq-server-3.8.16-3.el8ost.ppc64le.rpm

x86_64:  
rabbitmq-server-3.8.16-3.el8ost.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-32718  
https://access.redhat.com/security/cve/CVE-2021-32719  
https://access.redhat.com/security/updates/classification/#low

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5Fpc9zjgjWX9erEAQh6TA//SBk6DFowl0p6bJNt+PFGZPB8ZIrl0HPI  
azUxSF3o/b29uqTe1XNVS83lN+2dsTUp0rERs34Kd7kbkOvqHyGj9TDjnvyVt1QH  
HD6yXG9iCit7cYNCYNDwea+Wt6yczY0BrmednQfukXfnV8DjNZ2btwQqsASdNrD6  
fcuYlQB3eQVVD/L1GCjmCP+nHbwD7A5egqlxXNJlw0WhtSvIa7YdQ4T+MUN5w30I  
kuJWc3wPEKj7+NbKlyZ2ErCz6DrMm5BDjAHhOviXnY2S0Ya9pwzIDrCUk3KDxNtU  
SKO44qVkZOQkevGHtyUfHbXM1Zm41BWHg/caQuQMO4gIw9Aw02MMOoOpJwXLRURn  
cMb0pOtuvTgIyfpjGT8xJb51cWb71Xw9Za+VUQNMRS+Xp00yTR2lH74ILKhv1/fj  
8SdiGYmwJ3bYBBHvM+mCnhDiH6w7s9E9JjTsTLqZYdtx/4AGUULowC1q64h+TfEs  
cEdnv0kV8sNVMf71Iz0d2yzDj5DE7ZHhXEUy0CWop/ja/i/vr+B0zGb1T8nEZml4  
xYofh90zY4tHdH3vquUBTQg1BgEiJXXLo0vVKC6IzfS84kOpogJrVdsIsWURB2Xq  
bd4AwKt9lCdQVrAWfnynQEyRJ/MIaEieFK7xzCEzORb8DtTjYTONn8UsuHx9PeYB  
6ofOgrgazRA=/s43  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8851-01

Red Hat Security Advisory 2022-8862-01 - An update for puppet is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack Platform 16.1.9 (puppet) security update  
Advisory ID:       RHSA-2022:8862-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8862  
Issue date:        2022-12-07  
CVE Names:         CVE-2021-27025  
====================================================================  
1. Summary:

An update for puppet is now available for Red Hat OpenStack Platform 16.1.9  
(Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.1 - noarch

3. Description:

A network tool for managing many disparate systems

Security Fix(es):

* silent configuration failure in agent (CVE-2021-27025)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2023853 - CVE-2021-27025 puppet: silent configuration failure in agent

6. Package List:

Red Hat OpenStack Platform 16.1:

Source:  
puppet-5.5.10-14.el8ost.src.rpm

noarch:  
puppet-5.5.10-14.el8ost.noarch.rpm  
puppet-headless-5.5.10-14.el8ost.noarch.rpm  
puppet-server-5.5.10-14.el8ost.noarch.rpm

Red Hat OpenStack Platform 16.1:

Source:  
puppet-5.5.10-14.el8ost.src.rpm

noarch:  
puppet-5.5.10-14.el8ost.noarch.rpm  
puppet-headless-5.5.10-14.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-27025  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpW9zjgjWX9erEAQhZgw/+LWeBglQQMIA8d7qyG9qsGkadGedCSD29  
e0vpGbNqQ6P5fzrrVJWJJi8OXTx1BXaxv1iC5ebW9yAKF8xMcqoPT3bOG/P/iCrQ  
Hf+L6LHfIkaEZNiwi3q9ruqJrplIhx4FUkBSKWjrLdfCVCnnhKZ/8jYhpXcGoSuo  
TMaBdkfQmC6EPtGWJfzg+RIHmRfGxoA45oXwpzVOdv/nmQWOBt82vmFoPIshNbb7  
LnewdD6O1/zrWcuYodVpFZjBq4eek5wEDp9f9UmrOe82SiZd/llENzFCjdAwJZn0  
Z9BYWPGS9GaEw/yy5gYGZvA0LSN/CMi2K78nXL6ILDfJmkDIBxy2QEg4ffImrh0w  
oZX5EHNARwYCIboJ12aKEPm9aUIOUImuz/lIR8Sihfcpwh+8bE3YbVBjxxYTABow  
8ff4w8rkGnX4iLDqLHZ3AjYAmUaS2dFN7fwwJIVn5YvgiJY41GOKuV+pAvAOIfsH  
/ZsC8bJvX5P5SgAW+sJOmmHTqKjTZLp/lEDGiOvyO86oDW5FUhkAkPumyMb3oqmj  
3jdFIC/2nsipmhO9ipm+SowKpfxhzgQQQoiGfrpzhunx8dbt3lubYIkvCjRXAYGN  
fiOXemZM//Okz1Yz6BWYjYEW604bUnKl1eefytpADLyNmoPGIosQXLE4SZOqDjQi  
r4H4E0kaqxU=Y5qh  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8862-01

Red Hat Security Advisory 2022-8853-01 - An update for python-django20 is now available for Red Hat OpenStack Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4. Issues addressed include cross site scripting and denial of service vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack Platform 16.2.4 (python-django20) security update  
Advisory ID:       RHSA-2022:8853-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8853  
Issue date:        2022-12-07  
CVE Names:         CVE-2022-22818 CVE-2022-23833  
====================================================================  
1. Summary:

An update for python-django20 is now available for Red Hat OpenStack  
Platform 16.2.4 (Train) for Red Hat Enterprise Linux (RHEL) 8.4.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.2 - noarch

3. Description:

Security Fix(es):

* Possible XSS via '{% debug %}' template tag (CVE-2022-22818)

* Denial of service possibility in file uploads (CVE-2022-23833)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2048775 - CVE-2022-22818 django: Possible XSS via '{% debug %}' template tag  
2048778 - CVE-2022-23833 django: Denial-of-service possibility in file uploads

6. Package List:

Red Hat OpenStack Platform 16.2:

Source:  
python-django20-2.0.13-18.el8ost.src.rpm

noarch:  
python3-django20-2.0.13-18.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-22818  
https://access.redhat.com/security/cve/CVE-2022-23833  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpY9zjgjWX9erEAQj1thAApODPOfrstOl0YkXLW8QcfS6do+Yx3SzB  
e0FtoGW3L1rRLjSXj4vNNK6Xa81zgx+BMns7uMpntqvScBGOpB8bbRdJOwizQcVc  
bJDpIZTccCg2L6J1G2XaFyMsHR82OmPc3AZtXpmx9hg81AQJ6R2nhpTYWUJA4Lkm  
OUZRlkOP1CP9CaJawGct4lNWo3ZJZ69XgJ78+ltkLBn1IXWtfrn8bDFtiGnZ7N7Y  
Qa50Ggqq+cYL2mHW0fDUsdgbgNYpmrfF1qlF/0B9HASQC1xx0fxc0S125vmU8yja  
ILOC+bwpDOBSnDKv/IKnAKt5Zb80ojUC519s8SPVHrZF/71DlZid0ly+pL9YWNAL  
hpziugB224Fp3GYEWlvzzoBz/C0XDFV/A3nSUnJ8CuP7QisxI1Jt068jvTlDdPjI  
Sv4uJE7u/eG/ME9SY74rfevznkrh0iLDOdAvPgS/4ScD4RoTZPFnH7/sn3d92mGC  
77yF0ZCxJe1iNCaCvHPRGuQ1aCfxEUhLRSAPO4wdd5TTMPGc2fFcYIYlgyoqQ2Z0  
KjKfL5cX4lUCDWKZ1fSbr2BxeNBpOt/udM3bRLRjEJsEVGh15CC7b/J+fyXuL1tq  
nBxhqzqTo3+ZtZTsGSchsZa/0kUNNJ9okGT2sm++YVKyuKRIU9KbVUiMLh6sRdMF  
wLUsVkAfhUQ=aJ8/  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8853-01

Red Hat Security Advisory 2022-8867-01 - An update for rabbitmq-server is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2. Issues addressed include cross site scripting and improper neutralization vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Low: Red Hat OpenStack Platform 16.1.9 (rabbitmq-server) security update  
Advisory ID:       RHSA-2022:8867-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8867  
Issue date:        2022-12-07  
CVE Names:         CVE-2021-32718  
====================================================================  
1. Summary:

An update for rabbitmq-server is now available for Red Hat OpenStack  
Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact  
of Low. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.1 - ppc64le, x86_64

3. Description:

RabbitMQ is an implementation of AMQP, the emerging standard for high  
performance enterprise messaging. The RabbitMQ server is a robust and  
scalable implementation of an AMQP broker. # We want to install into  
/usr/lib, even on 64-bit platforms

Security Fix(es):

* improper neutralization of script-related HTML tags in a web page (basic  
XSS) in management UI (CVE-2021-32718)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1977002 - CVE-2021-32718 rabbitmq-server: improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI

6. Package List:

Red Hat OpenStack Platform 16.1:

Source:  
rabbitmq-server-3.7.23-9.el8ost.src.rpm

ppc64le:  
rabbitmq-server-3.7.23-9.el8ost.ppc64le.rpm

x86_64:  
rabbitmq-server-3.7.23-9.el8ost.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-32718  
https://access.redhat.com/security/updates/classification/#low

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpaNzjgjWX9erEAQhFhw//cMHoe2JOTRgroiI4kKMBHO4nbWv0jxkR  
I2IM6gBNHg3/hxsu3LQsaGVM70lqjrbS+H55ukDmGfhXz2xHU+2qpfCIDcm0gxhW  
KOFaYvSlps8CjpjciIXVhy0LDcOnk9ipqx2ogLLv3DQjQAF5MdtuqtOf/wQuMRnh  
mUlY0u9XYiaXv7HHc1CRx1LkbLSHROTwe8Kl/om3p6velOF0tSr5cpjBjuUIuznh  
p5KOAZBsswQQZuwTrqYfyjCX8STX9mPrOQsddY+nxdd6L0XZ0vSmWcm94mMEA0PO  
xBl+2vNKEt2AB4UB2PEi0o7aVZrImix9JKEEhQREHX3qkP2RDsDlOkl8cZpAW9/K  
Gr3MXO8zSKJhC6E+5lnx0uIQHWyLTbnK4hixespaXCcclIRarsshv7+KbeFTYjTd  
Lw5ZdQdAeW3Pudr7a40HeMHlfRUcgwZKuvFur5wFVIeahxCVL/gL1ddirUiXDjZW  
+D5EsorMY+9fhn3iHlPUHpxl+JY3QM94qBm30KSB4qaBdhg1EcFB3Yv1Ojp/l1+k  
268RSc71eErmWl4dNo3tEgPLX6fZ8hJlKkefu8gg+mmauXgns2tM9/gQT2UFfLv0  
JFpLLwmOnSCbTDv2ZposZyROTK9cEs8jpHGFaoK+4M8aN2VmUxC2UCzEGb7UQyyl  
7pym91Xe0jQ=ueW9  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8867-01

Red Hat Security Advisory 2022-8847-01 - An update for protobuf is now available for Red Hat OpenStack Platform 16.2.4 (Train).

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack Platform 16.2.4 (protobuf) security update  
Advisory ID:       RHSA-2022:8847-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8847  
Issue date:        2022-12-07  
CVE Names:         CVE-2021-22570   
=====================================================================

1. Summary:

An update for protobuf is now available for Red Hat OpenStack Platform  
16.2.4 (Train).  
Red Hat Product Security has rated this update as having a security impact  
of Moderate.  
A Common Vulnerability Scoring System (CVSS) base score, which gives a  
detailed severity rating,  
is available for each vulnerability from the CVE link(s) in the References  
section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.2 - noarch

3. Description:

Protocol Buffers are a way of encoding structured data in an efficient  
yet extensible format. Google uses Protocol Buffers for almost all of  
its internal RPC protocols and file formats.

Protocol buffers are a flexible, efficient, automated mechanism for  
serializing structured data – think XML, but smaller, faster, and  
simpler. You define how you want your data to be structured once, then  
you can use special generated source code to easily write and read  
your structured data to and from a variety of data streams and using a  
variety of languages. You can even update your data structure without  
breaking deployed programs that are compiled against the old format. This  
package contains Protocol Buffers compiler for all programming  
languages and C++ headers and Static libraries for Protocol Buffers built  
with optimize_for = LITE_RUNTIME.

Security Fix(es):

* Incorrect parsing of nullchar in the proto symbol leads to Nullptr  
dereference (CVE-2021-22570)

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:  
https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2049429 - CVE-2021-22570 protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference

6. Package List:

Red Hat OpenStack Platform 16.2:

Source:  
protobuf-3.6.1-6.el8ost.src.rpm

noarch:  
python3-protobuf-3.6.1-6.el8ost.noarch.rpm

Red Hat OpenStack Platform 16.2:

Source:  
protobuf-3.6.1-6.el8ost.src.rpm

noarch:  
python3-protobuf-3.6.1-6.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-22570  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpWNzjgjWX9erEAQj74hAAn8C33fY+jEtfS5EsOVSEbyw1OPxyfEfz  
kvBFwTG+R+9rd/pvLUr6+pKsPyASiBiO3ddm9GY++IePXxjwMn7bvOe4H9QqgP23  
5DhDrdWW8Oqv+wrOV7BAs13nCIGZTSof3NJ17SjUk6Wxex/Ne71Y0GEDhzqv3hXR  
WuGJ8tMWBftny9EdnQgLh4O0TC5Y1FBcIXL+ftwaKPCrs3QF+GwXmKYsiq4h0KGi  
98jDfKpP7EMF1ZojBzhIjc60wQUIbLiJKLx8bcsG13bPvxGiRyxRYHueHCJoWhcN  
amNRVdj+xUWYPPolRw5i1pZmPjIlbjwaL299MGeK1SfJ51eQYYzlKHBLKk2OfnE6  
AsONiGJKWICU6tx7ZcrW3p4skgNvGVd6WKAANWv7KWOdQy3OQ3m9ivG0qCxp3EyA  
nTjiWoX1+crMAcvtnqZ/Z9op9TLqL0eyhcgCpOIMZKFVy9NoKMmR7qpsx5lBBVTr  
82paMUhkzqNrHREeswMhxq3Q0zD3fZrjCR1Pl/+rYKVfjkX0ht2KFBjDEGUqH+uG  
N+z5H9kL3lP9W/lCwiIMbgUnvoqmrLFBqq5uXJSle6vmPF5ZthoQaUEsQUtqxKVM  
i7jmBmPOoOGYu1iLlu47fYUSgRMI+JjeXDz8bOOg42FJSYMcvfuzNGkEcTX0A9Me  
+GEDO6GfPBQ=  
=DSkQ  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8847-01

Red Hat Security Advisory 2022-8856-01 - An update for python-django-horizon is now available for Red Hat OpenStack Platform 16.2.4 (Train) on Red Hat Enterprise Linux (RHEL) 8.4.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Low: Red Hat OpenStack Platform 16.2.4 (python-django-horizon) security update  
Advisory ID:       RHSA-2022:8856-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8856  
Issue date:        2022-12-07  
CVE Names:         CVE-2022-1655  
====================================================================  
1. Summary:

An update for python-django-horizon is now available for Red Hat OpenStack  
Platform 16.2.4 (Train) on Red Hat Enterprise Linux (RHEL) 8.4.

Red Hat Product Security has rated this update as having a security impact  
of Low. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.2 - noarch

3. Description:

Horizon is a Django application for providing Openstack UI components. It  
allows performing site administrator (viewing account resource usage,  
configuring users, accounts, quotas, flavors, etc.) and end user operations  
(start/stop/delete instances, create/restore snapshots, view instance VNC  
console, etc.)

Security Fix(es):

* Horizon session cookies are not flagged HttpOnly (CVE-2022-1655)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1931593 - [RHOSP13] Not able to attach floating IP from horizon  
2075681 - CVE-2022-1655 OpenStack: Horizon session cookies are not flagged HttpOnly  
2076482 - [RHOSP16.2.2] Resize from horizon fails  
2129483 - Unable to update port as member user from Horizon

6. Package List:

Red Hat OpenStack Platform 16.2:

Source:  
python-django-horizon-16.2.3-2.20220926144724.d3d3d18.el8ost.src.rpm

noarch:  
openstack-dashboard-16.2.3-2.20220926144724.d3d3d18.el8ost.noarch.rpm  
python3-django-horizon-16.2.3-2.20220926144724.d3d3d18.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-1655  
https://access.redhat.com/security/updates/classification/#low

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5FpkNzjgjWX9erEAQjvGg/+Nw2oEteeFdLlCPQfeej4MMuugk2GsS7g  
5KzxLM38U1/bV0NniI12A3uYESDVIgmtLDK/7GPiPqgnLHbxlmEZ4WBW5QCCqJFd  
hnS0smQ3jGR4QVsaug6FWo2iIWA9vINKMi0htyu14bs6er5kWsYw4DLq1WMW22cl  
5Z6UC5OXRU0bv10UwTtASOoBrp3Q05rqxLLTOeJFocqIo1o+kv0mKkaOIzyuGSSo  
QdyQogCINszofdeaQOSO48jnx0+QlBDqwfpW4qdWtaWSAunx7q/Pubp/EZOxKP3+  
ylR2K5Q2TjuJvfelX9mXGys62cvCLuPhKKvLBWysS//RhFGBcjQN+Qnf3NYMnVxw  
PqZ/3ZQwnPChvzeGBol/V2AcVcl3eLH0JZ3XXne+rcmGqMAULeE75h8mkAf98hEi  
TEov2AMGKJNTwUCsF+PwuDgA18PZpl/5nn6nfMANqozIlzo8J1UAzb705MTiNarc  
TB7DD1gjty5zBQbIQUo+yc9vFCJhjEqO5UAOl21BvjOCQ9k7wWsc0TafhoB7+poj  
g/EtzuY2iLthHud8G/0RfmVlxBfDA1aRESpkQ5s7jGr3/URFx0v4EaYbcqUJ/xA2  
SsujK2YLPCkTycQDAzGTUvGxrwYRrCtyBRMgo1bF7z9VPvXZsVoCBAI1/2VUNVCb  
YQAJy6x+pKc=ARGz  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8856-01

Red Hat Security Advisory 2022-8854-01 - An update for python-scciclient is now available for Red Hat OpenStack Platform 16.2.4 (Train) director for Red Hat Enterprise Linux (RHEL) 8.4.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: Red Hat OpenStack Platform 16.2.4 (python-scciclient) security update  
Advisory ID:       RHSA-2022:8854-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8854  
Issue date:        2022-12-07  
CVE Names:         CVE-2022-2996  
====================================================================  
1. Summary:

An update for python-scciclient is now available for Red Hat OpenStack  
Platform 16.2.4 (Train) director for Red Hat Enterprise Linux (RHEL) 8.4.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.2 - noarch

3. Description:

Python ServerView Common Command Interface (SCCI) Client Library

Security Fix(es):

* missing server certificate verification (CVE-2022-2996)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2115122 - CVE-2022-2996 python-scciclient: missing server certificate verification

6. Package List:

Red Hat OpenStack Platform 16.2:

Source:  
python-scciclient-0.9.1-2.20220111031440.el8ost.src.rpm

noarch:  
python3-scciclient-0.9.1-2.20220111031440.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-2996  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5Fph9zjgjWX9erEAQhGlg//XkIIDIkqxyEXLzoHxI9P0JXwR4WsRX/l  
ILNw8o2m8ZAdnDE9NOh7F7ub9fcggvNulL2Dnk4S52+SrWZ0kc+FcXeqagkVlo7N  
rMjI0N3mVGL87kivLv5Z48hdKdfVxfsLM4wAwa7VuxpOiVorLVE9udP7svSusA6l  
leasWQMXeUToqwMXhxkD7p5mTJj1MrvhdZ42c2XOSCJqJDHIC4ER+YdJXwS46uOM  
o/OViMFKPeKUfXV0rTO21Y1LGwDgJKEYWdOJ7mYRKateHkdSo4kLXYiXFG5zpP8C  
B8qTpFSaiM0gDvP031Av/rUHjyGN7GFSG3Zt4BlJnia8l4omIH9eaYK9GsMfy8wz  
nFPnOR9r3WiodOo9EezB3T1gc6x/lk8w6SSY4xAOKX5NT7hfVxRgI+kVafD1PTAt  
RCb35fwOgDPVK7lrh1t+AXzKs6R/oTOu79bvOo8TQM3zq78+nQoSXA5oTRgUGe9/  
dl3DI3H843XADCRbRnPHnxKmjvGhfPDuroTXCTcl0egkVWTgf6euoPfL4WUGI67/  
03I1gE9O5JiInE61RnDUH3KIISWpfooAJyRmllGBe7S5GWpUA3gIDULDfT97eOjQ  
MfJ6X3AaPuelA55iH02NSHHiSjdTmSoOOzBtyNUufeOLKZQXyNf8bk+wFDNaTajp  
gT2hSzWqipw¤PZ  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-8854-01

Red Hat Security Advisory 2022-8872-01 - An update for python-django20 is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2. Issues addressed include cross site scripting, denial of service, remote shell upload, and remote SQL injection vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: Red Hat OpenStack Platform 16.1.9 (python-django20) security update  
Advisory ID:       RHSA-2022:8872-01  
Product:           Red Hat OpenStack Platform  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8872  
Issue date:        2022-12-07  
CVE Names:         CVE-2022-22818 CVE-2022-23833 CVE-2022-28346  
====================================================================  
1. Summary:

An update for python-django20 is now available for Red Hat OpenStack  
Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat OpenStack Platform 16.1 - noarch

3. Description:

Security Fix(es):

* SQL injection in QuerySet.annotate() aggregate() and extra()  
(CVE-2022-28346)

* Possible XSS via '{% debug %}' template tag (CVE-2022-22818)

* Denial of service possibility in file uploads (CVE-2022-23833)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2048775 - CVE-2022-22818 django: Possible XSS via '{% debug %}' template tag  
2048778 - CVE-2022-23833 django: Denial-of-service possibility in file uploads  
2072447 - CVE-2022-28346 Django: SQL injection in QuerySet.annotate(),aggregate() and extra()

6. Package List:

Red Hat OpenStack Platform 16.1:

Source:  
python-django20-2.0.13-18.el8ost.src.rpm

noarch:  
python-django20-bash-completion-2.0.13-18.el8ost.noarch.rpm  
python3-django20-2.0.13-18.el8ost.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-22818  
https://access.redhat.com/security/cve/CVE-2022-23833  
https://access.redhat.com/security/cve/CVE-2022-28346  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY5Fpk9zjgjWX9erEAQiGEQ//W5dm128ZvVJ8uqpW5bKiVfGFsHvUIJQx  
xOECFG1058hibEqYVyBaiMNPNrKGPbJy+qWfcOemTai4w+3YUYi8sbcajoT+Qwkd  
4eLPtGDMvjhd1UuEWcbQO+byXnMXhrJhPB59QXPHrU87+juIn52KyDT2/N16eVsM  
+Dkm8W9HvQHFqDE73D7gcEBZVmICCfgjy/Do0DgsCsCXbWg2HiJKGrzwXUc3Wwr3  
6dIfrY+oyGBpmH/3mVHaiW8GLxVHFEfXZ2Vr8o7QcG0ohjWacUGlP8CHd2CuEtK/  
1zHwWxcMHMNUtfNGiblI5iEEQIvXXzY0cXsjUxruSXAKpvUHczZt40Yv5ssOpAvl  
bBnsmDcpaJAdq62Fhm49TCnoCshgV0M2IuLbLiJfuY0Z9MxeQWc9ycXXNLplyAWC  
20MmJVgQrMwhw73dil2l+ZnB73tiV/E3yjzU/JgMXzaHFRyxJL6Ughjx3AdCuWpi  
D2lw0297aziBBXMsndAAd5a1A+UjPFDZnB5ryjDouJKwIe3hnCtmFUjZOHkuWotJ  
1b6b+4JiXC56+Vp++7WK53dEDIyT0/JeFAT/BzIEwjA91WKD89LgKqnPJwiDz7x9  
79lQxzkUuaEo5NqinETte5M8FGpHU6balmdlEjzbd1S2EEumGjCC6wXySTg76tyt  
yfYYQfdjUJM=rRS/  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Source

Packet Storm