In the Linux kernel, the following vulnerability has been resolved: iommu: Fix two issues in iommu_copy_struct_from_user() In the review for iommu_copy_struct_to_user() helper, Matt pointed out that a NULL pointer should be rejected prior to dereferencing it: https://lore.kernel.org/all/86881827-8E2D-461C-BDA3-FA8FD14C343C@nvidia.com And Alok pointed out a typo at the same time: https://lore.kernel.org/all/480536af-6830-43ce-a327-adbd13dc3f1d@oracle.com Since both issues were copied from iommu_copy_struct_from_user(), fix them first in the current header.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PoppinsDigital.com WPYog Documents wpyog-documents allows Reflected XSS.This issue affects WPYog Documents: from n/a through <= 1.3.5.
In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() If track_pfn_copy() fails, we already added the dst VMA to the maple tree. As fork() fails, we'll cleanup the maple tree, and stumble over the dst VMA for which we neither performed any reservation nor copied any page tables. Consequently untrack_pfn() will see VM_PAT and try obtaining the PAT information from the page table -- which fails because the page table was not copied. The easiest fix would be to simply clear the VM_PAT flag of the dst VMA if track_pfn_copy() fails. However, the whole thing is about "simply" clearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy() and performed a reservation, but copying the page tables fails, we'll simply clear the VM_PAT flag, not properly undoing the reservation ... which is also wrong. So let's fix it properly: set the VM_PAT flag only if the reservation succeeded (leaving it clear initially), and undo the reservation if anything goes wrong while copying the page tables: clearing the VM_PAT flag after undoing the reservation. Note that any copied page table entries will get zapped when the VMA will get removed later, after copy_page_range() succeeded; as VM_PAT is not set then, we won't try cleaning VM_PAT up once more and untrack_pfn() will be happy. Note that leaving these page tables in place without a reservation is not a problem, as we are aborting fork(); this process will never run. A reproducer can trigger this usually at the first try: https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110 Modules linked in: ... CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:get_pat_info+0xf6/0x110 ... Call Trace: <TASK> ... untrack_pfn+0x52/0x110 unmap_single_vma+0xa6/0xe0 unmap_vmas+0x105/0x1f0 exit_mmap+0xf6/0x460 __mmput+0x4b/0x120 copy_process+0x1bf6/0x2aa0 kernel_clone+0xab/0x440 __do_sys_clone+0x66/0x90 do_syscall_64+0x95/0x180 Likely this case was missed in: d155df53f310 ("x86/mm/pat: clear VM_PAT if copy_p4d_range failed") ... and instead of undoing the reservation we simply cleared the VM_PAT flag. Keep the documentation of these functions in include/linux/pgtable.h, one place is more than sufficient -- we should clean that up for the other functions like track_pfn_remap/untrack_pfn separately.
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
Security Fix(es):
* automation-gateway: Mutation XSS in DOMPurify Due to Improper Template Literal Handling (CVE-2025-26791)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updates and fixes included:
Automation Platform
* Fixed an issue that would prevent some types of resources from getting synced if there was a naming conflict (AAP-41241)
* Fixed an issue where login would fail for users who were members of a team or organization that had a naming conflict (AAP-41240)
* Fixed an issue in the user collection module where running with state: present would cause a stack trace (AAP-40887)
* Fixed an issue preventing the controller admin password to get set for the gateway admin account during upgrades (AAP-40839)
* Fixed an issue that caused updates to SAML authenticators to ignore an updated public certificate provided via UI or API and then fail with the message "The certificate and private key do not match" (AAP-40767)
* Allow services to request cloud.redhat.com settings from gateway using ServiceTokenAuth (AAP-39649)
* Fixed ServiceAuthToken destroy method to allow HTTP delete via ServiceAuth to work properly (AAP-37630)
* automation-gateway has been updated to 2.5.20250312
* python3.11-django-ansible-base has been updated to 2.5.20250312
Automation controller
* Fixed the indirect host counting name to not record the hostname, but from the query result instead (AAP-41033)
* Fixed OpaClient to initialize properly after timeouts and retries (AAP-40997)
* Added service account credentials for Analytics in controller (AAP-40769)
* Added a helper method in the API for fetching the service account token from sso.redhat.com (AAP-39637)
* automation-controller has been updated to 4.6.9
Event-Driven Ansible
* Fixed ansible-rulebook support for third party python libraries (AAP-41341)
* Modified the behavior of the ansible-rulebook and Event-Driven Ansible to help with issues when the activation correctly started was considered unresponsive and scheduled for restarting (AAP-41070)
* Added support for editing and copying of rulebook activations in the API (AAP-40254)
* Rulebook activations' log message field is separated into timestamps and message fields (AAP-39743)
* Fixed a bug where the activation was incorrectly restarted with the error message "Missing container for running activation" (AAP-39545)
* Event streams now connect to PostgreSQL by using the certificates configured at the installation (AAP-39294)
* User is now required to give a user defined name when copying a credential. The new credential name must be unique (AAP-39079)
* Enhanced error messages related to Decision Environments (AAP-38941)
* Decision environment urls are now validated against OCI specification to ensure successful authentication to the container registry when pulling the image (AAP-38822)
* ansible-rulebook has been updated to 1.1.3
* automation-eda-controller has been updated to 1.1.6
Receptor:
* Fixed an issue where receptor was creating too many inotify processes, and where the user would encounter a too many open files error (AAP-22605)
* receptor has been updated to 1.5.3
Container-based Ansible Automation Platform
* Corrected the URL in the postinstall code for automation hub to use the gateway proxy URL (AAP-41306)
* Deprecated the variables eda_main_url and hub_main_url in favor of the gateway proxy URL (AAP-41306)
* Receptor mesh connections are now created between all automation controller nodes (AAP-41102)
* Fixed receptor configuration related to the container group instances type (AAP-40431)
* Fixed behavior that would hide the errors during EDA status validation (AAP-40021)
* Ensure the polkit RPM package is installed in order to enable user lingering (AAP-39860)
* containerized installer setup has been updated to 2.5-11
RPM-based Ansible Automation Platform
* Fixed an issue where SELinux relabeling didn't happen when fcontext rules were changed (AAP-40489)
* Fixed an issue where the credentials for execution environments and decision environments hosted in automation hub were incorrectly configured (AAP-40419)
* Fixed an issue where projects failed to sync due to incorrectly configured credentials for ansible collections hosted in automation hub (AAP-40418)
* Managed CA will now correctly assign eligible groups during discovery during installation, backup
### Summary
The Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions.
### Impact
If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections.
-----
Patch: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.54. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2024:10813
Security Fix(es):
* waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request (CVE-2024-49768)
* waitress: Waitress has a denial of service leading to high CPU usage/resource exhaustion (CVE-2024-49769)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating_a_cluster/updating-cluster-cli.html
Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments.
Security Fix(es):
* mosquitto: sending specific sequences of packets may trigger memory leak
(CVE-2024-8376)
* micromatch: vulnerable to Regular Expression Denial of Service (CVE-2024-4067)
urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891)
* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)
* python-django: Potential denial-of-service in django.utils.html.urlize() (CVE-2024-38875)
* python-django: Username enumeration through timing difference for users with unusable passwords (CVE-2024-39329)
* python-django: Potential directory-traversal in django.core.files.storage.Storage.save() (CVE-2024-39330)
* python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant() (CVE-2024-39614)
* github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp (CVE-2024-5569)
* puppet-foreman: An authentication bypass vulnerability exists in Foreman (CVE-2024-7012)
* python-django: Potential SQL injection in QuerySet.values() and values_list() (CVE-2024-42005)
* grpc: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the backend (CVE-2024-7246)
* puppet-pulpcore: An authentication bypass vulnerability exists in pulpcore (CVE-2024-7923)
* foreman: Read-only access to entire DB from templates (CVE-2024-8553)
Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.16.19. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2024:8418
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html
Security Fix(es):
* openshift-console: OAuth2 insufficient state parameter entropy
(CVE-2024-6508)
* golang-protobuf: encoding/protojson, internal/encoding/json: infinite
loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
(CVE-2024-24786)
* openstack-ironic: Lack of checksum validation on images (CVE-2024-47211)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
A security exception crash was identified in the Checkstyle tool within the JavaLanguageParser.expr method, reported by OSS-Fuzz. The crash involves UTF-8 encoding operations in the Java base module. No CVSS score or detailed impact information is provided.
A security exception crash occurs in the Checkstyle JavaLanguageParser component, specifically in the expr method, as reported by OSS-Fuzz. The crash involves Java's HeapCharBuffer initialization and CharBuffer wrapping. No CVSS score is available, but the issue is rated medium severity.
### Impact
A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.
### Patches
The function has been refined to reject such strings without the associated resource consumption in version 3.7.
### Workarounds
Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
### References
* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb
