Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

367 results · Clear filters · Feed

High max 7.8

ELSA-2024-12271 5 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.330.7.1] - KVM: x86: Add BHI_NO (Daniel Sneddon) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Pawan Gupta) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Pawan Gupta) [Orabug: 36384803] {CVE-2024-…

Apr 8, 2024
High max 7.8

ELSA-2024-12275 5 CVEs 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

[5.4.17-2136.330.7.1.el8] - KVM: x86: Add BHI_NO (Daniel Sneddon) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Mitigate KVM by default (Pawan Gupta) [Orabug: 36384803] {CVE-2024-2201} - x86/bhi: Add BHI mitigation knob (Pawan Gupta) [Orabug: 36384803] {CVE-2…

Apr 8, 2024
High max 7.8

ELSA-2024-12266 1 CVE 1 exploited

Important: kernel security update (Oracle Linux 8)

[4.18.0-513.18.1.0.1_9.OL8] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters [Orabug: 36461932] {CVE-2024-1086} [4.18.0-513.18.1_9.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHC…

Apr 3, 2024
High max 7.8

ELSA-2024-12265 1 CVE 1 exploited

Important: kernel security update (Oracle Linux 9)

- [5.14.0-362.24.1.0.1_3.OL9] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters [Orabug: 36461940 ] {CVE-2024-1086} - [5.14.0-362.24.1_3.OL9] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linu…

Apr 3, 2024
High max 7.8

ELSA-2024-12257 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2047.534.3.1] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36251145] {CVE-2024-1086}

Apr 2, 2024
High max 7.8

ELSA-2024-12259 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[5.4.17-2136.329.3.2.el7] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36465920] {CVE-2024-1086}

Apr 2, 2024
High max 7.8

ELSA-2024-12260 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8)

[5.4.17-2136.329.3.2.el8] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36465920] {CVE-2024-1086}

Apr 2, 2024
High max 7.8

ELSA-2024-12258 3 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.84.2] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36251327] {CVE-2024-1086} [4.1.12-124.84.1] - mm: avoid conflict between MADV_DOEXEC and upstream advice values (Anthony Yznaga) [Orabug: 36334311] - ko…

Apr 1, 2024
High max 7.8

ELSA-2024-12256 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.329.3.2] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36465920] {CVE-2024-1086}

Apr 1, 2024
High max 7.8

ELSA-2024-12255 1 CVE 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-204.147.6.3] - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [Orabug: 36464807] {CVE-2024-1086}

Apr 1, 2024
High max 7.5

ELSA-2024-1444 2 CVEs 1 exploited

Important: nodejs:16 security update (Oracle Linux 8)

nodejs [1:16.20.2-4.0.1] - reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks Resolves: CVE-2024-22019 nodejs-nodemon nodejs-packaging [26-1] - nodejs.prov: find namespaced bundled dependencies - Apply https://src.fedoraproject…

Mar 21, 2024
High max 8.0

ELSA-2024-1249 6 CVEs 1 exploited

Important: kernel security and bug fix update (Oracle Linux 7)

[3.10.0-1160.114.2.0.1.OL7] - debug: lock down kgdb [Orabug: 34270798] {CVE-2022-21499} [3.10.0-1160.114.2.OL7] - Update Oracle Linux certificates (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.p…

Mar 20, 2024
High max 7.8

ELSA-2023-5455 4 CVEs 1 exploited

Important: glibc security update (Oracle Linux 8)

[2.28-225.0.4.6] - CVE-2023-4527: Stack read overflow in getaddrinfo in no-aaa mode. - CVE-2023-4806: potential use-after-free in getaddrinfo. - CVE-2023-4813: potential use-after-free in gaih_inet (RHEL-2435). - CVE-2023-4813: work around RHEL-8 limitation i…

Dec 19, 2023
High max 7.5

ELSA-2023-13054 2 CVEs 1 exploited

Important: conmon security update (Oracle Linux 8)

conmon [2.1.3-7] - Resolve CVE-2023-39325 [2.1.3-6] - Add ol8_baseos_latest, and ol9_baseos_latest, to Jenkinsfile [2.1.3-5] - Add systemd-devel as build requirement [2.1.3-4] - Add support ARM build cri-o [1.26.3-3] - Resolve CVE-2023-39325 [1.26.3-2] - Add …

Dec 19, 2023
High max 7.5

ELSA-2023-13053 2 CVEs 1 exploited

Important: conmon security update (Oracle Linux 9)

conmon [2.1.3-7] - Resolve CVE-2023-39325 [2.1.3-6] - Add ol8_baseos_latest, and ol9_baseos_latest, to Jenkinsfile [2.1.3-5] - Add systemd-devel as build requirement [2.1.3-4] - Add support ARM build cri-o [1.26.3-3] - Resolve CVE-2023-39325 [1.26.3-2] - Add …

Dec 19, 2023
High max 8.8

ELSA-2023-7716 1 CVE 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.40.5-1.1] - Add patch for CVE-2023-42917 Resolves: rhbz#2253058

Dec 13, 2023
High max 8.8

ELSA-2023-7715 1 CVE 1 exploited

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.40.5-1.1] - Add patch for CVE-2023-42917 Resolves: rhbz#2253058

Dec 13, 2023
High max 7.5

ELSA-2023-13029 2 CVEs 1 exploited

Important: olcne security update (Oracle Linux 7)

conmon [2.1.3-7] - Resolve CVE-2023-39325 [2.1.3-6] - Add ol8_baseos_latest, and ol9_baseos_latest, to Jenkinsfile [2.1.3-5] - Add systemd-devel as build requirement [2.1.3-4] - Add support ARM build [2.1.3.3] - Add OL9 support [2.1.3.2] - Update inline with …

Dec 7, 2023
High max 7.5

ELSA-2023-13028 2 CVEs 1 exploited

Important: olcne security update (Oracle Linux 8)

conmon [2.1.3-7] - Resolve CVE-2023-39325 [2.1.3-6] - Add ol8_baseos_latest, and ol9_baseos_latest, to Jenkinsfile [2.1.3-5] - Add systemd-devel as build requirement [2.1.3-4] - Add support ARM build [2.1.3.3] - Add OL9 support [2.1.3.2] - Update inline with …

Dec 7, 2023
High max 7.7

ELSA-2023-7205 6 CVEs 1 exploited

Important: nodejs:20 security update (Oracle Linux 8)

nodejs [1:20.8.1-1] - Update node and nghttp - Add fips patch - Fixes CVE-2023-44487 (nghttp) - Fixes CVE-2023-45143, CVE-2023-39331, CVE-2023-39332, CVE-2023-38552, CVE-2023-39333 nodejs-nodemon nodejs-packaging

Nov 22, 2023
High max 7.5

ELSA-2023-6746 1 CVE 1 exploited

Important: nghttp2 security update (Oracle Linux 9)

[1.43.0-5.1] - fix HTTP/2 Rapid Reset (CVE-2023-44487)

Nov 16, 2023
Medium max 7.5

ELSA-2023-6120 1 CVE 1 exploited

Moderate: nginx:1.22 security update (Oracle Linux 9)

[1:1.22.1-3.0.1.1] - Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (CVE-2023-44487)

Oct 26, 2023
High max 7.5

ELSA-2023-5989 1 CVE 1 exploited

Important: varnish security update (Oracle Linux 8)

varnish [6.0.8-3.1] - Add parameters h2_rst_allowance and h2_rst_allowance_period to mitigate CVE-2023-44487 varnish-modules

Oct 24, 2023
High max 7.5

ELSA-2023-5928 1 CVE 1 exploited

Important: tomcat security update (Oracle Linux 8)

[1:9.0.62-5.2] - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

Oct 24, 2023
High max 7.5

ELSA-2023-5924 1 CVE 1 exploited

Important: varnish security update (Oracle Linux 9)

[6.6.2-3.el9_2.1] - Add parameters h2_rst_allowance and h2_rst_allowance_period to mitigate CVE-2023-44487 - Resolves: RHEL-12818

Oct 24, 2023
High max 7.5

ELSA-2023-5869 4 CVEs 1 exploited

Important: nodejs:18 security update (Oracle Linux 8)

nodejs [1:18.18.2-1] - Rebase to version 18.18.2 Resolves: CVE-2023-44487 CVE-2023-45143 CVE-2023-38552 CVE-2023-39333 nodejs-nodemon nodejs-packaging

Oct 23, 2023
High max 7.5

ELSA-2023-5929 1 CVE 1 exploited

Important: tomcat security update (Oracle Linux 9)

[1:9.0.62-11.3] - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

Oct 23, 2023
Medium max 7.5

ELSA-2023-5863 2 CVEs 1 exploited

Moderate: grafana security update (Oracle Linux 8)

[7.5.15-5] - Resolve CVE-2023-44487 Rapid Reset Attack - Resolve CVE-2023-39325 rapid stream resets can cause excessive work

Oct 20, 2023
High max 7.5

ELSA-2023-5850 1 CVE 1 exploited

Important: nodejs:16 security update (Oracle Linux 8)

nodejs [1:16.20.2-3.0.1] - Update nghttp2 to 1.57.0 Resolves: CVE-2023-44487 nodejs-nodemon nodejs-packaging [26-1] - nodejs.prov: find namespaced bundled dependencies - Apply https://src.fedoraproject.org/rpms/nodejs-packaging/c/e24e7df

Oct 20, 2023
Medium max 7.5

ELSA-2023-5867 2 CVEs 1 exploited

Moderate: grafana security update (Oracle Linux 9)

[9.0.9-4] - Resolve CVE-2023-44487 Rapid Reset Attack - Resolve CVE-2023-39325 rapid stream resets can cause excessive work

Oct 20, 2023
High max 7.5

ELSA-2023-5765 1 CVE 1 exploited

Important: nodejs security update (Oracle Linux 9)

[1:16.20.2-3.0.1] - Update nghttp2 to 1.57.0 Resolves: CVE-2023-44487

Oct 20, 2023
High max 7.5

ELSA-2023-5849 4 CVEs 1 exploited

Important: 18 security update (Oracle Linux 9)

nodejs [1:18.18.2-2] - Rebase to version 18.18.2 Resolves: CVE-2023-44487 CVE-2023-45143 CVE-2023-38552 CVE-2023-39333 nodejs-nodemon [3.0.1-1] - Rebase to 3.0.1 - Resolves: CVE-2022-25883 nodejs-packaging [2021.06-4] - NPM bundler: also find namespaced bundl…

Oct 20, 2023
High max 7.5

ELSA-2023-5709 1 CVE 1 exploited

Important: dotnet7.0 security update (Oracle Linux 8)

[7.0.112-1.0.1] - Update to .NET SDK 7.0.112 and Runtime 7.0.12 - Resolves: RHEL-11698

Oct 19, 2023
High max 7.5

ELSA-2023-5837 1 CVE 1 exploited

Important: nghttp2 security update (Oracle Linux 8)

[1.33.0-5] - fix HTTP/2 Rapid Reset (CVE-2023-44487) [1.33.0-4] - prevent DoS caused by overly large SETTINGS frames (CVE-2020-11080)

Oct 19, 2023
High max 7.5

ELSA-2023-5838 1 CVE 1 exploited

Important: nghttp2 security update (Oracle Linux 9)

[1.43.0-5.1] - fix HTTP/2 Rapid Reset (CVE-2023-44487)

Oct 19, 2023
High max 7.5

ELSA-2023-5721 2 CVEs 1 exploited

Important: go-toolset:ol8 security update (Oracle Linux 8)

delve golang [1.19.13-1] - Rebase to Go 1.19.13 [CVE-2023-39325] [CVE-2023-44487] go-toolset [1.19.13-1] - Rebase to Go 1.19.13 [CVE-2023-39325] [CVE-2023-44487]

Oct 18, 2023
High max 7.5

ELSA-2023-5710 1 CVE 1 exploited

Important: dotnet6.0 security update (Oracle Linux 8)

[6.0.123-1.0.1] - Update to .NET SDK 6.0.123 and Runtime 6.0.23 - Resolves: RHEL-11696

Oct 18, 2023
High max 7.5

ELSA-2023-5749 1 CVE 1 exploited

Important: .NET 7.0 security update (Oracle Linux 9)

[7.0.112-1.0.1] - Update to .NET SDK 7.0.112 and Runtime 7.0.12 - Resolves: RHEL-11698

Oct 18, 2023
High max 7.5

ELSA-2023-5738 3 CVEs 1 exploited

Important: go-toolset and golang security and bug fix update (Oracle Linux 9)

golang [1.19.13-1] - Update to go 1.19.13 [CVE-2023-44487] [CVE-2023-39325] [CVE-2023-29409] go-toolset [1.19.13-1] - Update to Go version 1.19.13

Oct 18, 2023
High max 7.5

ELSA-2023-5708 1 CVE 1 exploited

Important: dotnet6.0 security update (Oracle Linux 9)

[6.0.123-1.0.1] - Update to .NET SDK 6.0.123 and Runtime 6.0.23 - Resolves: RHEL-11696

Oct 18, 2023