Rocky Linux ha publicado múltiples actualizaciones de seguridad que solucionan vulnerabilidades relacionadas con productos Red Hat. Todas las aquí incluidas corresponden con vulnerabilidades de severidad alta.

• python: urllib.parse url blocklisting bypass (CVE-2023-24329)
• cups-filters: remote code execution in cups-filters, beh CUPS backend (CVE-2023-24805)
• dotnet: .NET Kestrel: Denial of Service processing X509 Certificates (CVE-2023-29331)
• dotnet: vulnerability exists in NuGet where a potential race condition can lead to a symlink attack (CVE-2023-29337)
• dotnet: Elevation of privilege - TarFile.ExtractToDirectory ignores extraction directory argument (CVE-2023-32032)
• dotnet: Remote Code Execution - Source generators issue can lead to a crash due to unmanaged heap corruption (CVE-2023-33128)
• dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML (CVE-2023-24936)
• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)
• c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
• c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)
• c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)
• cups: Information leak through Cups-Get-Document operation (CVE-2023-32360)
• dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method (CVE-2023-33170)
• Mozilla: Click-jacking certificate exceptions through rendering lag (CVE-2023-34414)
• Mozilla: Memory safety bugs fixed in Firefox 114 and Firefox ESR 102.12 (CVE-2023-34416)
• Mozilla: Use-after-free in WebRTC certificate generation (CVE-2023-37201)
• Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-37202)
• Mozilla: Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13 (CVE-2023-37211)
• Mozilla: Fullscreen notification obscured (CVE-2023-37207)
• Mozilla: Lack of warning when opening Diagcab files (CVE-2023-37208)
• c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)
• c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
• c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
• c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)
• c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

Se ven afectados varios subproductos de Rocky Linux 9 y Rocky Linux 8:

• python
• cups-filters
• dotnet
• c-ares
• cups
• Mozilla

Todas las vulnerabilidades tienen disponible una actualización que corrige todos los fallos. Se recomienda actualizar todos los dispositivos a las últimas versiones disponibles.

Para más información, cualquier otra incidencia o problema de seguridad, puede ponerse en contacto a través de nuestra dirección de correo csirt@seresco.es