Skip to content

Commit c8e0682

Browse files
dongsuparkdongsupark
authored
Merge pull request #2488 from flatcar/buildbot/monthly-glsa-metadata-updates-2024-12-01
Monthly GLSA metadata 2024-12-01
2 parents f76f6db + f55d67e commit c8e0682

12 files changed

+374
-17
lines changed

‎sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
-----BEGIN PGP SIGNED MESSAGE-----
22
Hash: SHA512
33

4-
MANIFEST Manifest.files.gz 590436 BLAKE2B 15aabc4185729e136cdcfaf5f8f985f8037a950c2674b40f4a60d6db55b6e66ddf62465183eec797a8745737731f08c9f5b7997b3092ca23932abe139760e3a2 SHA512 d4bc062a4c9898005fcd53314c2db40baaef3e5725ab92e762d55ae3747dcb34a1602299c2aa4bdf60a06b6f322e89ee0b897eafffb10de6e5392274ab828bc5
5-
TIMESTAMP 2024-11-01T06:40:36Z
4+
MANIFEST Manifest.files.gz 591718 BLAKE2B cd53ee1575b57b03315f3e2b15f89a06fbc6711259ee7a82e1ca6f8970d8fdd183ea1f95f313b15f9f7f905c2c8641fa9ae9f0d8a12e8fedc6851ee3f7c15bbd SHA512 1cf337d112115a521c08a9fa208a2c60a1ef9651426b5a20b7ff05709eda7e21b384c627f1dedd2abb84476daf5fadea280b479585390abd903daec89814b24f
5+
TIMESTAMP 2024-12-01T06:40:23Z
66
-----BEGIN PGP SIGNATURE-----
77

8-
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmckd+RfFIAAAAAALgAo
8+
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmdMBNdfFIAAAAAALgAo
99
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
1010
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
11-
klAv1g//cwbcCZg8/G48F/uV4ZD8IQCCiBnCHZO0rj2oufMpVzWlBV3WqIR2B1Cq
12-
YoFg5S6GmXBTdYFgpTLHlHR4WzEH5qTaEzI8jXRovvHSQmWfeewUJZJe9h1v77C8
13-
ez4Voj4nW1065mpgfuzYsOhC27pkxPI2OjD+YxgsGiZrJb/68OeTGGH5Xj10Bgv8
14-
sLeVeC7QiVmbiG2a0wP+qm+gAgpyULYRF+568feHfSu5LotUQ1SYWcBoRQFQSdgP
15-
/LqkhQH/+MVUWoDaOBjPWu6MHLUy+Ut7URiKpCD/l/9xrBjoyo9Ey5HFUym2b1sW
16-
/4tQ6vd4TC9h7M5kT67hobmgQIfMNp3lz/zCOpr9ygD6kRBpP8GzTf+NKfrpUy1z
17-
ToT61J7W3Vzxk6kNjV5Yci6JrLBejFSHtp/2RN2KMms/4upff7xSx3CA36jj/pJB
18-
Haep3fkPtghjXdLbRHdoNvZCMB8NxYhrkxzjweyuOO91gQquivrYM5NqjGevSZ0O
19-
2/PM9G7SqvxMSsrxcvv/gcZI8CGZozUmYbmfK3K/2V7radzVCHc1G/c0l7w0z0JL
20-
MNI4vjCSN/hQa82Fz8I9fAuiUUeEl4LygT8KKqbi51bcHGMRaTcQ+V1w6fOjstvy
21-
WteXEDDV5cKhj3lkSUFR/GySEsa0s7ADtvHmVU4u3fPNjMfPYLM=
22-
=S2X5
11+
klANZw/+KSWqV2sDOVWslomj90wmI4kWrUE4ZC46YZtvjGz4Faf9D8i9RzkuV9nB
12+
Lt6HhwNbrTFYYyFv0wAYLBUbNzQUDKl0KwOXs7SjRD+hV2lNRakA/dM1FbHsN0wF
13+
qUd+S3Slmis3NGaIQ5UstxqdG5wjZ04q6BnjdrA5Yaqxj+S8bS04D3HUr5jhKU8A
14+
vR9e7h6fkiABZW52mXVcBvqkSTmqrZcxGss3LpTiWU1VDcbFoVXcjsNQKYUEj9dt
15+
IgWaVX/LwVj3yPSI2TPF2PO8lenyiroADclFwXPHHyuDm6qxXb0v0nie3h4PuG5O
16+
yFVWmpLPkgdO2oCnJhh1W2sh+vu5iV4xnfoxT5U0BMp24s2wt2oKzPieJUhslk4s
17+
lINvCPAVF8VFwgvop3rdwvwQWE7yZCAZuKxD0Y6m8WORExR/MB33Qmc0gm7b6ksC
18+
yFG7AjN6y0qUd2yL1vpl9lvy4Rv0izZnVmuhd0+Jsq/8lgzY8+oiiZMzTxEc8Y/e
19+
8BcxWkB64/Sta0U+GYEYypxS2nPtPAb7BvPu1f2dyBEqO+vDRN5M+0LuhfucKDTo
20+
fuNw7Ri6zyv4thIvUJI7f54AHcGvAGmxQ+ObXHoHrBHtKacSXG6VF/P48rAwX165
21+
WblhbkW1T4kqLrUiFl/pt9BHP2zCXFkphVMrw4GJyp6KquSqfFA=
22+
=l52K
2323
-----END PGP SIGNATURE-----

‎sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz

1.25 KB
Binary file not shown.

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-01.xml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202411-01">
4+
<title>Neat VNC: Authentication Bypass</title>
5+
<synopsis>A vulnerability has been discovered in Neat VNC, which can lead to authentication bypass.</synopsis>
6+
<product type="ebuild">neatvnc</product>
7+
<announced>2024-11-06</announced>
8+
<revised count="1">2024-11-06</revised>
9+
<bug>937140</bug>
10+
<access>remote</access>
11+
<affected>
12+
<package name="gui-libs/neatvnc" auto="yes" arch="*">
13+
<unaffected range="ge">0.8.1</unaffected>
14+
<vulnerable range="lt">0.8.1</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>Neat VNC is a liberally licensed VNC server library that&#39;s intended to be fast and neat.</p>
19+
</background>
20+
<description>
21+
<p>Neat VNC allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as &#34;Type 1 - None&#34;, which is accepted even if it is not offered by the server, as originally demonstrated using a long password.</p>
22+
</description>
23+
<impact type="high">
24+
<p>A remote attacker can opt not to use any authentication method and access the VNC server.</p>
25+
</impact>
26+
<workaround>
27+
<p>There is no known workaround at this time.</p>
28+
</workaround>
29+
<resolution>
30+
<p>All Neat VNC users should upgrade to the latest version:</p>
31+
32+
<code>
33+
# emerge --sync
34+
# emerge --ask --oneshot --verbose ">=gui-libs/neatvnc-0.8.1"
35+
</code>
36+
</resolution>
37+
<references>
38+
</references>
39+
<metadata tag="requester" timestamp="2024-11-06T10:04:44.010327Z">graaff</metadata>
40+
<metadata tag="submitter" timestamp="2024-11-06T10:04:44.016422Z">graaff</metadata>
41+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-02.xml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202411-02">
4+
<title>Flatpak: Sandbox Escape</title>
5+
<synopsis>A vulnerability has been discovered in Flatpak, which can lead to a sandbox escape.</synopsis>
6+
<product type="ebuild">flatpak</product>
7+
<announced>2024-11-06</announced>
8+
<revised count="1">2024-11-06</revised>
9+
<bug>937936</bug>
10+
<access>remote</access>
11+
<affected>
12+
<package name="sys-apps/flatpak" auto="yes" arch="*">
13+
<unaffected range="ge">1.4.10</unaffected>
14+
<vulnerable range="lt">1.4.10</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>Flatpak is a Linux application sandboxing and distribution framework.</p>
19+
</background>
20+
<description>
21+
<p>A vulnerability has been discovered in Flatpak. Please review the CVE identifier referenced below for details.</p>
22+
</description>
23+
<impact type="high">
24+
<p>A malicious or compromised Flatpak app using persistent directories could
25+
read and write files in locations it would not normally have access to.</p>
26+
</impact>
27+
<workaround>
28+
<p>There is no known workaround at this time.</p>
29+
</workaround>
30+
<resolution>
31+
<p>All Flatpak users should upgrade to the latest version:</p>
32+
33+
<code>
34+
# emerge --sync
35+
# emerge --ask --oneshot --verbose ">=sys-apps/flatpak-1.4.10"
36+
</code>
37+
</resolution>
38+
<references>
39+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-42472">CVE-2024-42472</uri>
40+
</references>
41+
<metadata tag="requester" timestamp="2024-11-06T12:12:48.512741Z">graaff</metadata>
42+
<metadata tag="submitter" timestamp="2024-11-06T12:12:48.515088Z">graaff</metadata>
43+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-03.xml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202411-03">
4+
<title>Ubiquiti UniFi: Privilege Escalation</title>
5+
<synopsis>A vulnerability has been discovered in Ubiquiti UniFi, which can lead to local privilege escalation.</synopsis>
6+
<product type="ebuild">unifi</product>
7+
<announced>2024-11-06</announced>
8+
<revised count="1">2024-11-06</revised>
9+
<bug>941922</bug>
10+
<access>local</access>
11+
<affected>
12+
<package name="net-wireless/unifi" auto="yes" arch="*">
13+
<unaffected range="ge">8.5.6</unaffected>
14+
<vulnerable range="lt">8.5.6</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>Ubiquiti UniFi is a Management Controller for Ubiquiti Networks UniFi APs.</p>
19+
</background>
20+
<description>
21+
<p>A vulnerability has been discovered in Ubiquiti UniFi. Please review the CVE identifier referenced below for details.</p>
22+
</description>
23+
<impact type="high">
24+
<p>The vulnerability allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server.</p>
25+
</impact>
26+
<workaround>
27+
<p>There is no known workaround at this time.</p>
28+
</workaround>
29+
<resolution>
30+
<p>All Ubiquiti UniFi users should upgrade to the latest version:</p>
31+
32+
<code>
33+
# emerge --sync
34+
# emerge --ask --oneshot --verbose ">=net-wireless/unifi-8.5.6"
35+
</code>
36+
</resolution>
37+
<references>
38+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-42028">CVE-2024-42028</uri>
39+
</references>
40+
<metadata tag="requester" timestamp="2024-11-06T12:57:53.228208Z">graaff</metadata>
41+
<metadata tag="submitter" timestamp="2024-11-06T12:57:53.232043Z">graaff</metadata>
42+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-04.xml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202411-04">
4+
<title>EditorConfig core C library: arbitrary stack write</title>
5+
<synopsis>A vulnerability has been discovered in EditorConfig Core C library, which may lead to arbitrary code execution.</synopsis>
6+
<product type="ebuild">editorconfig-core-c</product>
7+
<announced>2024-11-06</announced>
8+
<revised count="1">2024-11-06</revised>
9+
<bug>905308</bug>
10+
<access>local and remote</access>
11+
<affected>
12+
<package name="app-text/editorconfig-core-c" auto="yes" arch="*">
13+
<unaffected range="ge">0.12.6</unaffected>
14+
<vulnerable range="lt">0.12.6</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>EditorConfig core library written in C (for use by plugins supporting EditorConfig parsing)</p>
19+
</background>
20+
<description>
21+
<p>A vulnerability has been discovered in EditorConfig Core C library. Please review the CVE identifier referenced below for details.</p>
22+
</description>
23+
<impact type="normal">
24+
<p>Please review the referenced CVE identifier for details.</p>
25+
</impact>
26+
<workaround>
27+
<p>There is no known workaround at this time.</p>
28+
</workaround>
29+
<resolution>
30+
<p>All EditorConfig core C library users should upgrade to the latest version:</p>
31+
32+
<code>
33+
# emerge --sync
34+
# emerge --ask --oneshot --verbose ">=app-text/editorconfig-core-c-0.12.6"
35+
</code>
36+
</resolution>
37+
<references>
38+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-0341">CVE-2023-0341</uri>
39+
</references>
40+
<metadata tag="requester" timestamp="2024-11-06T13:45:42.462581Z">graaff</metadata>
41+
<metadata tag="submitter" timestamp="2024-11-06T13:45:42.465707Z">graaff</metadata>
42+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-05.xml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202411-05">
4+
<title>libgit2: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in libgit2, the worst of which could lead to arbitrary code execution.</synopsis>
6+
<product type="ebuild">libgit2</product>
7+
<announced>2024-11-06</announced>
8+
<revised count="1">2024-11-06</revised>
9+
<bug>891525</bug>
10+
<bug>923971</bug>
11+
<access>remote</access>
12+
<affected>
13+
<package name="dev-libs/libgit2" auto="yes" arch="*">
14+
<unaffected range="ge">1.7.2</unaffected>
15+
<vulnerable range="lt">1.7.2</vulnerable>
16+
</package>
17+
</affected>
18+
<background>
19+
<p>libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language that supports C bindings.</p>
20+
</background>
21+
<description>
22+
<p>Multiple vulnerabilities have been discovered in libgit2. Please review the CVE identifiers referenced below for details.</p>
23+
</description>
24+
<impact type="high">
25+
<p>Please review the referenced CVE identifiers for details.</p>
26+
</impact>
27+
<workaround>
28+
<p>There is no known workaround at this time.</p>
29+
</workaround>
30+
<resolution>
31+
<p>All libgit2 users should upgrade to the latest version:</p>
32+
33+
<code>
34+
# emerge --sync
35+
# emerge --ask --oneshot --verbose ">=dev-libs/libgit2-1.7.2"
36+
</code>
37+
</resolution>
38+
<references>
39+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-22742">CVE-2023-22742</uri>
40+
</references>
41+
<metadata tag="requester" timestamp="2024-11-06T14:15:55.911812Z">graaff</metadata>
42+
<metadata tag="submitter" timestamp="2024-11-06T14:15:55.915992Z">graaff</metadata>
43+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-07.xml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202411-07">
4+
<title>Pillow: Arbitrary code execution</title>
5+
<synopsis>A vulnerability has been discovered in Pillow, which may lead to arbitrary code execution.</synopsis>
6+
<product type="ebuild">pillow</product>
7+
<announced>2024-11-17</announced>
8+
<revised count="1">2024-11-17</revised>
9+
<bug>928391</bug>
10+
<access>local and remote</access>
11+
<affected>
12+
<package name="dev-python/pillow" auto="yes" arch="*">
13+
<unaffected range="ge">10.3.0</unaffected>
14+
<vulnerable range="lt">10.3.0</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>The friendly PIL fork.</p>
19+
</background>
20+
<description>
21+
<p>A vulnerability has been discovered in Pillow. Please review the CVE identifier referenced below for details.</p>
22+
</description>
23+
<impact type="high">
24+
<p>Please review the referenced CVE identifier for details.</p>
25+
</impact>
26+
<workaround>
27+
<p>There is no known workaround at this time.</p>
28+
</workaround>
29+
<resolution>
30+
<p>All Pillow users should upgrade to the latest version:</p>
31+
32+
<code>
33+
# emerge --sync
34+
# emerge --ask --oneshot --verbose ">=dev-python/pillow-10.3.0"
35+
</code>
36+
</resolution>
37+
<references>
38+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-28219">CVE-2024-28219</uri>
39+
</references>
40+
<metadata tag="requester" timestamp="2024-11-17T09:47:11.089899Z">graaff</metadata>
41+
<metadata tag="submitter" timestamp="2024-11-17T09:47:11.092222Z">graaff</metadata>
42+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202411-08.xml

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202411-08">
4+
<title>X.Org X server, XWayland: Multiple Vulnerabilities</title>
5+
<synopsis>A vulnerability has been discovered in the Xorg Server and XWayland, the worst of which can result in privilege escalation.</synopsis>
6+
<product type="ebuild">xorg-server,xwayland</product>
7+
<announced>2024-11-17</announced>
8+
<revised count="1">2024-11-17</revised>
9+
<bug>928531</bug>
10+
<bug>942465</bug>
11+
<access>local</access>
12+
<affected>
13+
<package name="x11-base/xorg-server" auto="yes" arch="*">
14+
<unaffected range="ge">21.1.14</unaffected>
15+
<vulnerable range="lt">21.1.14</vulnerable>
16+
</package>
17+
<package name="x11-base/xwayland" auto="yes" arch="*">
18+
<unaffected range="ge">24.1.4</unaffected>
19+
<vulnerable range="lt">24.1.4</vulnerable>
20+
</package>
21+
</affected>
22+
<background>
23+
<p>The X Window System is a graphical windowing system based on a client/server model.</p>
24+
</background>
25+
<description>
26+
<p>Multiple vulnerabilities have been discovered in X.Org X server and XWayland. Please review the CVE identifiers referenced below for details.</p>
27+
</description>
28+
<impact type="high">
29+
<p>Please review the referenced CVE identifiers for details.</p>
30+
</impact>
31+
<workaround>
32+
<p>There is no known workaround at this time.</p>
33+
</workaround>
34+
<resolution>
35+
<p>All X.Org X server users should upgrade to the latest version:</p>
36+
37+
<code>
38+
# emerge --sync
39+
# emerge --ask --oneshot --verbose ">=x11-base/xorg-server-21.1.14"
40+
</code>
41+
42+
<p>All XWayland users should upgrade to the latest version:</p>
43+
44+
<code>
45+
# emerge --sync
46+
# emerge --ask --oneshot --verbose ">=x11-base/xwayland-24.1.4"
47+
</code>
48+
</resolution>
49+
<references>
50+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-9632">CVE-2024-9632</uri>
51+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-31080">CVE-2024-31080</uri>
52+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-31081">CVE-2024-31081</uri>
53+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-31082">CVE-2024-31082</uri>
54+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-31083">CVE-2024-31083</uri>
55+
</references>
56+
<metadata tag="requester" timestamp="2024-11-17T09:49:25.879517Z">graaff</metadata>
57+
<metadata tag="submitter" timestamp="2024-11-17T09:49:25.883830Z">graaff</metadata>
58+
</glsa>

0 commit comments

Comments
 (0)