You are here
Home > Preporuke > Sigurnosni nedostatak programskog paketa osinfo-db i programske biblioteke libosinfo

Sigurnosni nedostatak programskog paketa osinfo-db i programske biblioteke libosinfo

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Low: osinfo-db and libosinfo security and bug fix update
Advisory ID: RHSA-2019:3387-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2019:3387
Issue date: 2019-11-05
CVE Names: CVE-2019-13313
=====================================================================

1. Summary:

An update for osinfo-db, osinfo-db-tools, libosinfo, and gnome-boxes is now
available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) – aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

The osinfo-db package contains a database that provides information about
operating systems and hypervisor platforms to facilitate the automated
configuration and provisioning of new virtual machines.

The libosinfo packages provide a library that allows virtualization
provisioning tools to determine the optimal device settings for a
combination of hypervisor and operating system.

Security Fix(es):

* Libosinfo: osinfo-install-script option leaks password via command line
argument (CVE-2019-13313)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.1 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1685364 – Add win2019 to libosinfo
1689817 – virt-manager cannot detect operating system name for rhel8.0.0 tree automatically
1699988 – Rebase to the latest upstream release
1699989 – Rebase to the latest upstream release
1699990 – Rebase to the latest upstream release
1703480 – RHEL-8.0.x is not detected as RHEL-8.0
1713130 – gnome-boxes does not show RHEL-8 logo in Source Selection
1713245 – Add rhel-8.1 and rhel-7.7 entries
1727766 – CVE-2019-13313 Libosinfo: osinfo-install-script option leaks password via command line argument
1739897 – RHEL8.1 ppc64le iso is recognized as x86_64 by Boxes (Source Selection)

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
gnome-boxes-3.28.5-7.el8.src.rpm
libosinfo-1.5.0-3.el8.src.rpm
osinfo-db-20190611-1.el8.src.rpm
osinfo-db-tools-1.5.0-4.el8.src.rpm

aarch64:
libosinfo-1.5.0-3.el8.aarch64.rpm
libosinfo-debuginfo-1.5.0-3.el8.aarch64.rpm
libosinfo-debugsource-1.5.0-3.el8.aarch64.rpm
osinfo-db-tools-1.5.0-4.el8.aarch64.rpm
osinfo-db-tools-debuginfo-1.5.0-4.el8.aarch64.rpm
osinfo-db-tools-debugsource-1.5.0-4.el8.aarch64.rpm

noarch:
osinfo-db-20190611-1.el8.noarch.rpm

ppc64le:
libosinfo-1.5.0-3.el8.ppc64le.rpm
libosinfo-debuginfo-1.5.0-3.el8.ppc64le.rpm
libosinfo-debugsource-1.5.0-3.el8.ppc64le.rpm
osinfo-db-tools-1.5.0-4.el8.ppc64le.rpm
osinfo-db-tools-debuginfo-1.5.0-4.el8.ppc64le.rpm
osinfo-db-tools-debugsource-1.5.0-4.el8.ppc64le.rpm

s390x:
libosinfo-1.5.0-3.el8.s390x.rpm
libosinfo-debuginfo-1.5.0-3.el8.s390x.rpm
libosinfo-debugsource-1.5.0-3.el8.s390x.rpm
osinfo-db-tools-1.5.0-4.el8.s390x.rpm
osinfo-db-tools-debuginfo-1.5.0-4.el8.s390x.rpm
osinfo-db-tools-debugsource-1.5.0-4.el8.s390x.rpm

x86_64:
gnome-boxes-3.28.5-7.el8.x86_64.rpm
gnome-boxes-debuginfo-3.28.5-7.el8.x86_64.rpm
gnome-boxes-debugsource-3.28.5-7.el8.x86_64.rpm
libosinfo-1.5.0-3.el8.i686.rpm
libosinfo-1.5.0-3.el8.x86_64.rpm
libosinfo-debuginfo-1.5.0-3.el8.i686.rpm
libosinfo-debuginfo-1.5.0-3.el8.x86_64.rpm
libosinfo-debugsource-1.5.0-3.el8.i686.rpm
libosinfo-debugsource-1.5.0-3.el8.x86_64.rpm
osinfo-db-tools-1.5.0-4.el8.x86_64.rpm
osinfo-db-tools-debuginfo-1.5.0-4.el8.x86_64.rpm
osinfo-db-tools-debugsource-1.5.0-4.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-13313
https://access.redhat.com/security/updates/classification/#low
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXcHq5dzjgjWX9erEAQh0hg/+P8wzRr250/uu08KTiidhlpGoW71J4H8n
ASfwbAoZor9/8Y7ocyNtDMXoZjeSgXmuMyDeFxvD2oG1pWSJJWGM5jA3zkf1BFMj
9YpvBh5Gs/xN+9YQzxWFY/SOLKsBiGa12pok1zJxnMIkYJKyzg0XYforwctBPW2c
Fn5pKUWGzZdvbDWv6UhtTr50A7Sq2Pp9AfGE98PSxwHTEZCb/aOQ+S/NnC/k2ruT
fZfZlEaSxLxfDz6VRzOl/tIicoYHFR/wHAWJeatfG1PMbQE2jncTNcQueVseGwP7
q3GSTt5nPbMvdw44+AowuP5f+sGsgBerXW3YxhFvyW0xFgogfGxUOlOzTffyTkQP
QeSgyGp87z7JIYg8y+ki8qrS8qOczLCD8ulV0ygD9/pGiZDYG5UR2Y+rY6sbDsHJ
ViEpwIL5tnoYOySzGxR05z0TJr9rqKzxvGa/i1EhVSmOSms0eE497cWVXDHT/piY
llxbU2pAY1kD6qTuThF1In5OtTmVLgESiehPfkhWceeDrt5s1J7BhQwDBzjzAwyX
EBlkUGQQTd5QSMA1Kp5kVuOzcHnunJOzByJwJBYBVhUNL2L6MIYvvjuqYU1jkRcF
/Tu/jqzGCtz7nwQa3zE3lO9z3QMUMDkLvXm4Jpu4wuSIh5qkALLYXM57R8rIeE+W
NsJzc3JlgUc=
=2/Xj
—–END PGP SIGNATURE—–


RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Top
More in Preporuke
Sigurnosni nedostaci jezgre operacijskog sustava

Otkriveni su sigurnosni nedostaci jezgre operacijskog sustava RHEL. Otkriveni nedostaci potencijalnim udaljenim napadačima omogućuju izazivanje DoS stanja, izvršavanje proizvoljnog programskog...

Close