A security vulnerability (CVE-2024-34069) in the python-werkzeug package used by Red Hat OpenStack Platform 16.2 allows a user to execute code on a developer's machine. Werkzeug is a WSGI utility module used in various web applications. Red Hat has issued an important security update to address this issue. Public exploit code is available via Metasploit. The vulnerability is rated as high severity by Red Hat Product Security.
This security update for Tomcat 10.1.33 addresses multiple issues including a critical fix for CVE-2024-52316, which ensures that if Jakarta Authentication fails with an exception, the server responds with a 500 status code. The update also includes numerous improvements and fixes related to WebDAV functionality, servlet API enhancements, logging, caching, and concurrency handling.
A data isolation bypass vulnerability (CVE-2024-44309) has been identified in WebKitGTK, the GTK port of the WebKit rendering engine. This vulnerability affects the webkit2gtk3 package in Red Hat Enterprise Linux 8.4. Red Hat has issued a security advisory and released updated packages to address this issue. The vulnerability is rated as having an important security impact by Red Hat Product Security. No CVSS score is provided in the advisory. No known exploits in the wild have been reported.
A security update for webkit2gtk3 addresses a data isolation bypass vulnerability (CVE-2024-44309) in WebKitGTK, the WebKit port for the GTK platform. This vulnerability has been rated as having an Important security impact by Red Hat. The update is available for Red Hat Enterprise Linux 8 across multiple architectures. The advisory references multiple CVEs related to webkitgtk, including CVE-2024-44309. No CVSS score is provided in the input data. The vendor advisory confirms that a fix is available in version 2.46.3-2.el8_10 of webkit2gtk3 packages.
A security vulnerability (CVE-2024-42353) in WebOb, a Python library used for WSGI request and response handling, involves improper normalization of the Location header during HTTP redirects. This flaw can lead to an open redirect vulnerability. The issue affects Red Hat OpenStack Platform 17.1 and Red Hat Enterprise Linux 9 packages of python-webob. Red Hat has issued a security advisory with an update to address this vulnerability.
Multiple security vulnerabilities have been identified in WebKitGTK, the GTK port of the WebKit web rendering engine, affecting Red Hat Enterprise Linux 9.2 Extended Update Support. These include type confusion and processing of maliciously crafted web content that may lead to arbitrary code execution or unexpected process crashes. The vulnerabilities are addressed in a security update provided by Red Hat.
CVE-2024-9676 is a symlink traversal vulnerability in the containers/storage library used by Podman, buildah, and cri-o. This flaw can lead to denial of service conditions. The vulnerability is identified as CWE-22, which relates to improper handling of symbolic links. No CVSS score or detailed impact metrics are provided. The affected versions explicitly stated are 2.0 and 3.0. There is no information on available patches or fixes, and no known exploitation in the wild has been reported.
A moderate severity security vulnerability (CVE-2024-36039) was identified in the python3.12-PyMySQL package used in Red Hat Enterprise Linux 9. This vulnerability allows SQL injection when the library processes untrusted JSON input. PyMySQL is a pure-Python MySQL client library intended as a drop-in replacement for MySQLdb. Red Hat has released an update to address this issue in their python3.12-PyMySQL package for RHEL 9 and its extended update support versions.
A moderate severity security vulnerability (CVE-2024-34064) was identified in the python-jinja2 package used in Red Hat Enterprise Linux 9. The issue involves Jinja2 accepting keys containing non-attribute characters, which could potentially lead to security concerns. Red Hat has released an update to address this vulnerability as part of the Red Hat Enterprise Linux 9.5 update. The advisory recommends applying the update to affected systems to remediate the issue.
Red Hat OpenShift Container Platform 4.12.67 includes security updates addressing two vulnerabilities: an out-of-bounds write in glibc's iconv component (CVE-2024-2961) that may lead to remote code execution, and an open redirect issue in WebOb's location header normalization (CVE-2024-42353). These issues are fixed in this release, and users are advised to upgrade to the updated packages and container images. The advisory provides instructions for upgrading and references for further details.
SUSE Linux Enterprise 15 SP5 RT kernel received a security update addressing various security bug fixes. Additionally, several non-security bugs were reverted to improve kernel stability. No specific vulnerabilities or exploit details are provided.