Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

Medium max 8.6

ELSA-2024-2002 1 CVE

Moderate: grub2 security update (Oracle Linux 7)

[2.02-0.87.0.26.el7.14] - Replace bugzilla.oracle.com reference [Orabug: 35477723] - Backport kernel EFI allocation pacthes [Orabug: 34301086] - Add to the list CVE-2021-3695, CVE-2021-3696, CVE-2021-3697, CVE-2022-28734, CVE-2022-28735, CVE-2022-28736 [JIRA:…

May 1, 2024
Medium max 8.3

ELSA-2024-20865 10 CVEs

Moderate: edk2 security update (Oracle Linux 8)

* Tue Feb 27 2024 Aaron Young - Create new 20240227 release for OL8 which includes the following fixed CVEs: {CVE-2023-45229} {CVE-2023-45230} {CVE-2023-45231} {CVE-2023-45232} {CVE-2023-45233} {CVE-2023-45234} {CVE-2023-45235} {CVE-2022-36763} {CVE-2022-3676…

Apr 24, 2024
Medium max 8.3

ELSA-2024-12343 10 CVEs

Moderate: edk2 security update (Oracle Linux 8)

* Tue Feb 27 2024 Aaron Young - Create new 20240227 release for OL8 which includes the following fixed CVEs: {CVE-2023-45229} {CVE-2023-45230} {CVE-2023-45231} {CVE-2023-45232} {CVE-2023-45233} {CVE-2023-45234} {CVE-2023-45235} {CVE-2022-36763} {CVE-2022-3676…

Apr 24, 2024
Medium max 6.5

ELSA-2024-2033 1 CVE

Moderate: libreswan security and bug fix update (Oracle Linux 9)

[4.12-1.0.1.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.12-1.1] - Fix CVE-2024-2357 (RHEL-29734) - x509: unpack IPv6 general names based on length (RHEL-32719) [4.12-1] - Update to 4.12 to fix CVE-2023-38710, CVE-2023-38711, CVE-2023-3871…

Apr 24, 2024
Medium max 6.5

ELSA-2024-1998 1 CVE

Moderate: libreswan security update (Oracle Linux 8)

[4.12-2.0.1.2] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.12-2.2] - Fix patch application in the previous change [4.12-2.1] - Fix CVE-2024-2357 (RHEL-28742)

Apr 23, 2024
Medium max 3.7

ELSA-2024-1828 3 CVEs

Moderate: java-21-openjdk security update (Oracle Linux 8)

[1:21.0.3.0.9-1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:21.0.3.0.9-1] - Update to jdk-21.0.3+9 (GA) - Update release notes to 21.0.3+9 - Switch to GA mode. - Sync the copy of the portable specfile with the latest update - ** This tarball is emb…

Apr 23, 2024
Medium max 3.7

ELSA-2024-1818 4 CVEs

Moderate: java-1.8.0-openjdk security update (Oracle Linux 8)

[1:1.8.0.412.b08-2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155]

Apr 23, 2024
Medium max 3.7

ELSA-2024-1822 5 CVEs

Moderate: java-11-openjdk security update (Oracle Linux 8)

[1:11.0.23.0.9-3.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:11.0.23.0.9-2] - Fix 11.0.22 release date in NEWS [1:11.0.23.0.9-1] - Update to jdk-11.0.23+9 (GA) - Update release notes to 11.0.23+9 - Switch to GA mode for release - Require tzdata 202…

Apr 23, 2024
Medium max 3.7

ELSA-2024-1821 5 CVEs

Moderate: java-11-openjdk security update (Oracle Linux 7)

[1:11.0.23.0.9-2.0.1] - link atomic for ix86 build [1:11.0.23.0.9-2] - Fix 11.0.22 release date in NEWS - Restore ppc64le --with-jobs=1 workaround to avoid flaky ppc builds [1:11.0.23.0.9-1] - Update to jdk-11.0.23+9 (GA) - Update release notes to 11.0.23+9 -…

Apr 22, 2024
Medium max 3.7

ELSA-2024-1825 4 CVEs

Moderate: java-17-openjdk security update (Oracle Linux 8)

[17.0.11.0.9-2.0.1] - Add Oracle vendor bug URL [1:17.0.11.0.9-2] - Update to jdk-17.0.11+9 (GA) - Add openjdk-17.0.11+9.tar.xz to .gitignore - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8 - Update buildver from 7 to 9 - Update portable…

Apr 22, 2024
Medium

ELSA-2024-12337 1 CVE

Moderate: nss security update (Oracle Linux 9)

[3.90.0-6_fips] - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35862190] - Update FIPS module name for Oracle Linux [Orabug: 35862190] [3.90.0-6] - Fix ecc DER wrapping. [3.90.0-5] - Pick up validated constant time implemen…

Apr 19, 2024
Medium max 7.5

ELSA-2024-12336 5 CVEs

Moderate: gnutls security update (Oracle Linux 9)

[3.7.6-23.4_fips] - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35925409] - Update FIPS module name for Oracle Linux [Orabug: 35925409] - Verify salt length and iteration count for PBKDF [Orabug: 35925409] [3.7.6-23.4] - F…

Apr 19, 2024
Medium max 5.3

ELSA-2024-1879 2 CVEs

Moderate: gnutls security update (Oracle Linux 9)

[3.7.6-23.4] - Fix timing side-channel in deterministic ECDSA (RHEL-28958) - Fix potential crash during chain building/verification (RHEL-28953)

Apr 18, 2024
Medium max 3.7

ELSA-2024-1817 4 CVEs

Moderate: java-1.8.0-openjdk security update (Oracle Linux 7)

[1:1.8.0.412.b08-1] - Update to shenandoah-jdk8u412-b08 (GA) - Update release notes for shenandoah-8u412-b08. - Complete release note for Certainly roots - Switch to GA mode. - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. ** - Related: RHEL-30926 […

Apr 17, 2024
Medium max 5.3

ELSA-2024-1784 1 CVE

Moderate: gnutls security update (Oracle Linux 8)

[3.6.16-8.3_fips] - Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length as defined in FIPS 186-4 section B.3.2 [Orabug: 33200526] - Allow bigger known RSA modulus sizes when calling rsa_generate_fips186_4_keypair directly [O…

Apr 15, 2024
Medium max 8.8

ELSA-2024-12276 8 CVEs

Moderate: virt:kvm_utils3 security update (Oracle Linux 8)

hivex libguestfs libguestfs-winsupport [8.9-1] - Rebase to ntfs-3g 2022.10.3 - Fixes: CVE-2022-40284 - resolves: rhbz#2236372 libiscsi libnbd libtpms libvirt [9.0.0-5] - Fix off-by-one error in udevListInterfacesByStatus (Martin Kletzander) [Orabug: 36364464]…

Apr 10, 2024
Medium max 5.5

ELSA-2024-1719 1 CVE

Moderate: rear security update (Oracle Linux 8)

[2.6-11.0.1] - Change OS_VENDOR to OracleServer [2.6-11] - make initrd accessible only by root (CVE-2024-23301), PR 3123

Apr 9, 2024
Medium max 7.8

ELSA-2024-1692 1 CVE

Moderate: less security update (Oracle Linux 9)

[590-3] - Fix CVE-2022-48624 - Resolves: RHEL-26265

Apr 8, 2024
Medium max 7.5

ELSA-2024-1615 1 CVE

Moderate: expat security update (Oracle Linux 8)

[2.2.5-11.0.1.1] - lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910314] [2.2.5-11.1] - CVE-2023-52425 expat: parsing large tokens can trigger a denial of service - Resolves: RHEL-29321

Apr 3, 2024
Medium max 6.5

ELSA-2024-1601 3 CVEs

Moderate: curl security and bug fix update (Oracle Linux 8)

[7.61.1-33.5] - cap SFTP packet size sent (RHEL-5485) - when keyboard-interactive auth fails, try password (#2229800) - unify the upload/method handling (CVE-2023-28322) - fix cookie injection with none file (CVE-2023-38546) - lowercase the domain names befor…

Apr 3, 2024
Medium max 5.9

ELSA-2024-1608 1 CVE

Moderate: opencryptoki security update (Oracle Linux 8)

[3.21.0-10] - timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin) Resolves: RHEL-22791

Apr 3, 2024
Medium max 7.8

ELSA-2024-1610 1 CVE

Moderate: less security update (Oracle Linux 8)

[530-2] - Fix CVE-2022-48624 - Resolves: RHEL-26265

Apr 3, 2024
Medium max 8.8

ELSA-2024-1576 4 CVEs

Moderate: ruby:3.1 security, bug fix, and enhancement update (Oracle Linux 9)

ruby [3.1.4-143] - Upgrade to Ruby 3.1.4. Resolves: RHEL-5586 - Fix HTTP response splitting in CGI. Resolves: RHEL-5591 - Fix ReDos vulnerability in URI. Resolves: RHEL-28919 Resolves: RHEL-5612 - Fix ReDos vulnerability in Time. Resolves: RHEL-28920 - Make R…

Apr 2, 2024
Medium max 8.8

ELSA-2024-1494 9 CVEs

Moderate: thunderbird security update (Oracle Linux 8)

[115.9.0-1.0.1] - Add Oracle prefs [115.9.0-1] - Update to 115.9.0 build1 - Fix expat CVE-2023-52425

Mar 26, 2024
Medium max 7.5

ELSA-2024-1530 2 CVEs

Moderate: expat security update (Oracle Linux 9)

[2.5.0-1.1] - CVE-2023-52425: Fix parsing of large tokens - CVE-2024-28757: Reject direct parameter entity recursion - Resolves: RHEL-29698 - Resolves: RHEL-29695

Mar 26, 2024
Medium max 8.8

ELSA-2024-1493 9 CVEs

Moderate: thunderbird security update (Oracle Linux 9)

[115.9.0-1.0.1] - Add Oracle prefs [115.9.0-1] - Update to 115.9.0 build1 - Fix expat CVE-2023-52425

Mar 26, 2024
Medium max 8.8

ELSA-2024-1498 9 CVEs

Moderate: thunderbird security update (Oracle Linux 7)

[115.9.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build [115.9.0-1] - Update to 115.9.0 build1 - Fix expat CVE-2023-52425

Mar 25, 2024
Medium max 5.9

ELSA-2024-12234 1 CVE

Moderate: python-cryptography security update (Oracle Linux 7)

[3.2.1-1.0.1] - Fix CVE-2023-49083: NULL-dereference when loading PKCS7 certificates [Orabug: 36143838]

Mar 20, 2024
Medium max 5.9

ELSA-2024-19480 1 CVE

Moderate: python-cryptography security update (Oracle Linux 7)

[3.2.1-1.0.1] - Fix CVE-2023-49083: NULL-dereference when loading PKCS7 certificates [Orabug: 36143838]

Mar 20, 2024
Medium max 8.8

ELSA-2024-1431 4 CVEs

Moderate: ruby:3.1 security, bug fix, and enhancement update (Oracle Linux 8)

ruby [3.1.4-142] - Upgrade to Ruby 3.1.4. Resolves: RHEL-28565 - Fix HTTP response splitting in CGI. Resolves: RHEL-28564 - Fix ReDos vulnerability in URI. Resolves: RHEL-28567 Resolves: RHEL-28576 - Fix ReDos vulnerability in Time. Resolves: RHEL-28566 - Mak…

Mar 20, 2024
Medium max 5.9

ELSA-2024-12232 1 CVE

Moderate: openssh security update (Oracle Linux 7)

[7.4p1-23.0.3_fips] - Change Epoch from 1 to 10 - Enable fips KDF POST [Orabug: 32461750] - Disable diffie-hellman-group-exchange-sha256 KEX FIPS method [Orabug: 32461739] [7.4p1-23.0.3] - add KEX_INITIAL flag [Orabug: 36160445] - implement 'strict key exchan…

Mar 19, 2024
Medium max 5.9

ELSA-2024-12233 1 CVE

Moderate: openssh security update (Oracle Linux 7)

[7.4p1-23.0.3_fips] - Change Epoch from 1 to 10 - Enable fips KDF POST [Orabug: 32461750] - Disable diffie-hellman-group-exchange-sha256 KEX FIPS method [Orabug: 32461739] [7.4p1-23.0.3] - add KEX_INITIAL flag [Orabug: 36160445] - implement 'strict key exchan…

Mar 18, 2024
Medium max 7.5

ELSA-2024-1308 1 CVE

Moderate: .NET 7.0 security update (Oracle Linux 8)

[7.0.117-1.0.1] - Update to .NET SDK 7.0.117 and Runtime 7.0.17 - Port Revert 'Disable implicit rejection for RSA PKCS#1 (#95217) patch

Mar 15, 2024
Medium max 7.5

ELSA-2024-1311 1 CVE

Moderate: .NET 8.0 security update (Oracle Linux 8)

[8.0.103-1.0.1] - Update to .NET SDK 8.0.103 and Runtime 8.0.3 - Backport MSBuild locale fix

Mar 14, 2024
Medium max 7.5

ELSA-2024-1310 1 CVE

Moderate: .NET 8.0 security update (Oracle Linux 9)

[- 8.0.103-2.0.1] - Update to .NET SDK 8.0.103 and Runtime 8.0.3 - Disable checking the signature of the last certificate in a chain if the certificate is supposedly self-signed. - Resolves: RHEL-25254 - Backport MSBuild locale fix - Resolves: RHEL-23936

Mar 14, 2024
Medium max 7.5

ELSA-2024-1309 1 CVE

Moderate: .NET 7.0 security update (Oracle Linux 9)

[- 7.0.117-1.0.1] - Update to .NET SDK 7.0.117 and Runtime 7.0.17 - Port revert 'Disable implicit rejection for RSA PKCS#1 (#95217)' patch [- 7.0.116-1.0.1] - Update to .NET SDK 7.0.116 and Runtime 7.0.16 * Tue Jan 16 2024 Lukas Lipinsky - 7.0.115-1.0.1 - Upd…

Mar 14, 2024
Medium max 5.9

ELSA-2024-1239 1 CVE

Moderate: opencryptoki security update (Oracle Linux 9)

[3.21.0-9] - timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin) Resolves: RHEL-22792

Mar 8, 2024
Medium max 5.9

ELSA-2024-1150 1 CVE

Moderate: buildah security update (Oracle Linux 9)

[1.31.4-1.0.1] - update to https://github.com/containers/buildah/releases/tag/v1.31 - https://github.com/containers/buildah/commit/11bbf33

Mar 7, 2024
Medium

ELSA-2024-1149 1 CVE

Moderate: skopeo security update (Oracle Linux 9)

[2:1.13.3-4] - Rebuild with golang 1.20.12: golang:net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)

Mar 7, 2024
Medium max 6.5

ELSA-2024-1129 1 CVE

Moderate: curl security update (Oracle Linux 9)

[7.76.1-26.el9_3.3] - cap SFTP packet size sent (RHEL-14697) - lowercase the domain names before PSL checks (CVE-2023-46218)

Mar 6, 2024