Red Hat Bug Fix Advisory: CloudForms 4.7.13 bug fix and enhancement update

Fixed packages 29

Vulnerabilities 1

• Medium 5.5
  CVE-2019-16892

  Rubyzip denial of service

  In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

  rubyzip ruby-zip ruby-zip Debian Ubuntu RubyGems
  Sep 25, 2019

References

• article
  https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.7/html/release_notes
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1757026
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1767018
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1768457
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1770938
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1771720
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1772641
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1772642
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1772932
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1773577
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1773626
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1773630
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1773631
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1773701
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1774063
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_4047.json
• report
  https://access.redhat.com/security/cve/CVE-2019-16892
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1771298
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-16892
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-16892