Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 7 ELS rhel_els:7 | tuned | 0:2.11.0-13.el7_9 |
| Red Hat · RHEL 7 ELS rhel_els:7 | tuned-gtk | 0:2.11.0-13.el7_9 |
| Red Hat · RHEL 7 ELS rhel_els:7 | tuned-profiles-atomic | 0:2.11.0-13.el7_9 |
| Red Hat · RHEL 7 ELS rhel_els:7 | tuned-profiles-compat | 0:2.11.0-13.el7_9 |
| Red Hat · RHEL 7 ELS rhel_els:7 | tuned-profiles-cpu-partitioning | 0:2.11.0-13.el7_9 |
| Red Hat · RHEL 7 ELS rhel_els:7 | tuned-profiles-mssql | 0:2.11.0-13.el7_9 |
| Red Hat · RHEL 7 ELS rhel_els:7 | tuned-profiles-oracle | 0:2.11.0-13.el7_9 |
| Red Hat · RHEL 7 ELS rhel_els:7 | tuned-utils | 0:2.11.0-13.el7_9 |
| Red Hat · RHEL 7 ELS rhel_els:7 | tuned-utils-systemtap | 0:2.11.0-13.el7_9 |
| Red Hat · Rhel Extras Rt Els 7 rhel_extras_rt_els:7 | tuned-profiles-realtime | 0:2.11.0-13.el7_9 |
| Red Hat · Rhel Extras Sap Els 7 rhel_extras_sap_els:7 | tuned-profiles-sap | 0:2.11.0-13.el7_9 |
| Red Hat · Rhel Extras Sap Hana Els 7 rhel_extras_sap_hana_els:7 | tuned-profiles-sap-hana | 0:2.11.0-13.el7_9 |
Vulnerabilities 1
-
Medium 5.5
Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method
A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mi…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2324541
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10381.json
-
report
https://access.redhat.com/security/cve/CVE-2024-52337
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-52337
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-52337
-
article
https://github.com/redhat-performance/tuned/releases/tag/v2.24.1
-
article
https://security.opensuse.org/2024/11/26/tuned-instance-create.html
-
article
https://www.openwall.com/lists/oss-security/2024/11/28/1