Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

  • Medium max 7.5
    ELSA-2024-1141 75 CVEs

    Moderate: mysql security update (Oracle Linux 9)

    [8.0.36-1] - Update to MySQL 8.0.36

  • Medium max 6.5
    ELSA-2024-1130 2 CVEs

    Moderate: openssh security update (Oracle Linux 9)

    [8.7p1-34.3] - Fix Terrapin attack (CVE-2023-48795) Resolves: RHEL-19764 - Forbid shell metasymbols in username/hostname (CVE-2023-51385) Resolves: RHEL-19822

  • Medium
    ELSA-2024-1131 2 CVEs

    Moderate: golang security update (Oracle Linux 9)

    [1.20.12-1] - Rebase to 1.20.12 - Fix CVE-2023-45285 CVE-2023-39326

  • Medium max 5.5
    ELSA-2024-1147 1 CVE

    Moderate: rear security update (Oracle Linux 9)

    [2.6-21.0.1] - rear: creates a world-readable initrd (CVE-2024-23301)

  • Medium max 8.2
    ELSA-2024-1142 2 CVEs

    Moderate: haproxy security update (Oracle Linux 9)

    [2.4.22-3] - Reject '#' as part of URI path component (CVE-2023-45539, RHEL-18169) [2.4.22-2] - Reject any empty content-length header value (CVE-2023-40225, RHEL-7736)

  • Medium
    ELSA-2024-12191 1 CVE

    Moderate: container-tools:4.0 security update (Oracle Linux 8)

    buildah cockpit-podman conmon containernetworking-plugins containers-common container-selinux criu crun fuse-overlayfs libslirp oci-seccomp-bpf-hook podman [2:4.0.2-26] - rebuild with golang 1.20.12 for CVE-2023-39326 python-podman runc [1:1.1.12-1.0.1] - reb…

  • Medium max 5.6
    ELSA-2024-0967 1 CVE

    Moderate: opensc security update (Oracle Linux 8)

    [0.20.0-8] - Fix CVE-2023-5992: Side-channel leaks while stripping encryption PKCS#1.5 padding

  • Medium max 5.6
    ELSA-2024-0966 1 CVE

    Moderate: opensc security update (Oracle Linux 9)

    [0.23.0-4] - Fix CVE-2023-5992: Side-channel leaks while stripping encryption PKCS#1.5 padding

  • Medium
    ELSA-2024-0887 2 CVEs

    Moderate: go-toolset:ol8 security update (Oracle Linux 8)

    delve [1.20.2-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.20.2-1] - Rebase to 1.20.2 - Resolves: rhbz#2186495 golang [1.20.12-1] - Update to Go 1.20.12 - Fix CVE-2023-39326 CVE-2023-45285 go-toolset [1.20.12-1] - Update to Go 1.20.…

  • Medium max 7.5
    ELSA-2024-0894 75 CVEs

    Moderate: mysql:8.0 security update (Oracle Linux 8)

    mecab mecab-ipadic mysql [8.0.36-1] - Update to MySQL 8.0.36 [8.0.35-2] - Fix int-conversion type error in memcached [8.0.35-1] - Update to MySQL 8.0.35 - Remove patches now upstream [8.0.34-1] - Update to MySQL 8.0.34 - Add patch from upstream bug#110569 - A…

  • Medium
    ELSA-2024-0889 5 CVEs

    Moderate: oniguruma security update (Oracle Linux 8)

    [6.8.2-2.1] - Fix CVE-2019-13224 Resolves: RHEL-6970 - Fix CVE-2019-16163 Resolves: RHEL-9506 - Fix CVE-2019-19012 Resolves: RHEL-9511 - Fix CVE-2019-19203 Resolves: RHEL-9510 - Fix CVE-2019-19204 Resolves: RHEL-9509

  • Medium max 6.5
    ELSA-2024-12164 2 CVEs

    Moderate: openssh security update (Oracle Linux 8)

    [8.0p1-19.0.1.2] - Update patches for CVE-2023-51385, CVE-2023-48795 [Orabug: 36256632] [8.0p1-19.2] - Forbid shell metasymbols in username/hostname Resolves: CVE-2023-51385 - Fix Terrapin attack Resolves: CVE-2023-48795

  • Medium
    ELSA-2024-0811 3 CVEs

    Moderate: sudo security update (Oracle Linux 8)

    RHEL 9.3.0.Z ERRATUM [1.9.5p2-10] - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output Resolves: RHEL-21834 - CVE-2023-28486 sudo: Sudo does not escape control characters in log messages Resolves: RHEL-21828 - CVE-2023-42465 sud…

  • Medium max 5.9
    ELSA-2024-12157 1 CVE

    Moderate: openssh security update (Oracle Linux 7)

    [7.4p1-23.0.3] - add KEX_INITIAL flag [Orabug: 36160445] - implement 'strict key exchange' [CVE-2023-48795][Orabug: 36160445]

  • Medium max 5.9
    ELSA-2024-12158 1 CVE

    Moderate: openssh security update (Oracle Linux 7)

    [7.4p1-23.0.3] - add KEX_INITIAL flag [Orabug: 36160445] - implement 'strict key exchange' [CVE-2023-48795][Orabug: 36160445]

  • Medium
    ELSA-2024-0769 1 CVE

    Moderate: tcpdump security update (Oracle Linux 8)

    [14:4.9.3-3.1] - tcpslice: use-after-free in extract_slice() (CVE-2021-41043)

  • Medium
    ELSA-2024-0786 1 CVE

    Moderate: nss security update (Oracle Linux 8)

    [3.90.0-6] - Fix ecc DER wrapping. [3.90.0-5] - Pick up validated constant time implementations of p256, p384, and p521 from upsream - More Fips indicator changes

  • Medium
    ELSA-2024-0790 1 CVE

    Moderate: nss security update (Oracle Linux 9)

    [3.90.0-6] - Fix ecc DER wrapping. [3.90.0-5] - Pick up validated constant time implementations of p256, p384, and p521 from upsream - More Fips indicator changes

  • Medium
    ELSA-2024-0768 1 CVE

    Moderate: libmaxminddb security update (Oracle Linux 8)

    [1.2.0-10.1] - Resolves: RHEL-20594 - improper initialization in dump_entry_data_list() in maxminddb.c

  • Medium max 6.0
    ELSA-2024-12152 3 CVEs

    Moderate: virt:kvm_utils1 security update (Oracle Linux 8)

    hivex libguestfs libguestfs-winsupport libiscsi libnbd libvirt [5.7.0-41] - qemu_monitor: Add defensive protection on mon->msg (Wim ten Have) [Orabug: 35699260] - vircpi: Add PCIe 5.0 and 6.0 link speeds (Michal Privoznik) [Orabug: 35496776] - qemuProcessSetu…

  • Medium max 7.5
    ELSA-2024-12135 1 CVE

    Moderate: gnutls security update (Oracle Linux 8)

    [3.6.16-8.1_fips] - Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length as defined in FIPS 186-4 section B.3.2 [Orabug: 33200526] - Allow bigger known RSA modulus sizes when calling rsa_generate_fips186_4_keypair directly [O…

  • Medium max 7.5
    ELSA-2024-0627 1 CVE

    Moderate: gnutls security update (Oracle Linux 8)

    [3.6.16-8.1] - auth/rsa-psk: minimize branching after decryption (RHEL-21550)

  • Medium
    ELSA-2024-0647 3 CVEs

    Moderate: rpm security update (Oracle Linux 8)

    [4.14.3-28.0.2] - Import additional patches to fix regressions with CVE-2021-35937, CVE-2021-35938 and CVE-2021-35939 patchset [Orabug: 36256318] [4.14.3-28.0.1] - Fixed infinte loop for db_create with error check [Orabug: 36202920] [4.14.3-28] - Backport fil…

  • Medium max 5.9
    ELSA-2024-0628 1 CVE

    Moderate: libssh security update (Oracle Linux 8)

    [0.9.6-13] - Client and Server side mitigations (CVE-2023-48795) - Strip extensions from both kex lists for matching (CVE-2023-48795) - tests: Adjust calculation to strict kex (CVE-2023-48795)

  • Medium max 7.5
    ELSA-2024-0533 3 CVEs

    Moderate: gnutls security update (Oracle Linux 9)

    [3.7.6-23.3] - Fixes for CVE-2023-5981, CVE-2024-0553, CVE-2024-0567

  • Medium max 7.5
    ELSA-2024-0477 4 CVEs

    Moderate: frr security update (Oracle Linux 9)

    [8.3.1-11.2] - Add patches for CVE-2023-47235, CVE-2023-47234, CVE-2023-38406, CVE-2023-38407

  • Medium max 6.1
    ELSA-2024-0474 4 CVEs

    Moderate: tomcat security update (Oracle Linux 9)

    [1:9.0.62-37.el9_3.1] - Resolves: #2235370 CVE-2023-41080 tomcat: Open Redirect vulnerability in FORM authentication - Resolves: #2243749 CVE-2023-45648 tomcat: incorrectly parsed http trailer headers can cause request smuggling - Resolves: #2243751 CVE-2023-…

  • Medium max 9.4
    ELSA-2024-0387 6 CVEs

    Moderate: php:8.1 security update (Oracle Linux 9)

    php [8.1.27-1] - rebase to 8.1.27 RHEL-19093 [8.1.14-1] - rebase to 8.1.14 [8.1.8-1] - update to 8.1.8 #2070040 [8.1.7-2] - clean unneeded dependency on useradd command [8.1.7-1] - update to 8.1.7 #2070040 [8.1.6-2] - add upstream patch to initialize pcre bef…

  • Medium max 6.8
    ELSA-2024-0468 1 CVE

    Moderate: grub2 security update (Oracle Linux 9)

    [2.06-70.0.2.2] - search command: add flag to only search root dev - Resolves: #CVE-2023-4001

  • Medium max 5.9
    ELSA-2024-0464 2 CVEs

    Moderate: python-urllib3 security update (Oracle Linux 9)

    [1.26.5-3.0.1.1] - Security fix for CVE-2023-45803 Resolves: RHEL-16874 - Security fix for CVE-2023-43804 Resolves: RHEL-12001

  • Medium max 5.3
    ELSA-2024-0466 1 CVE

    Moderate: python3.9 security update (Oracle Linux 9)

    [3.9.18-1.1] - Security fix for CVE-2023-27043 Resolves: RHEL-20613

  • Medium
    ELSA-2024-0463 3 CVEs

    Moderate: rpm security update (Oracle Linux 9)

    [4.16.1.3-27] - TOCTOU race in checks for unsafe symlinks (CVE-2021-35937) - races with chown/chmod/capabilities calls during installation (CVE-2021-35938) - checks for unsafe symlinks are not performed for intermediary directories (CVE-2021-35939)

  • Medium max 5.5
    ELSA-2024-0465 1 CVE

    Moderate: sqlite security update (Oracle Linux 9)

    [3.34.1-7] - Fixes CVE-2023-7104

  • Medium max 7.5
    ELSA-2024-0345 1 CVE

    Moderate: python-pillow security update (Oracle Linux 7)

    [2.0.0-24gitd1c6db8] - Security fix for CVE-2023-44271 Resolves: RHEL-15459

  • Medium max 7.8
    ELSA-2024-0343 1 CVE

    Moderate: LibRaw security update (Oracle Linux 7)

    [0.19.4-2] - Fix CVE-2021-32142 - Resolves: RHEL-9524

  • Medium max 7.5
    ELSA-2024-0310 1 CVE

    Moderate: openssl security update (Oracle Linux 9)

    [1:3.0.7-25.0.1] - Replace upstream references [Orabug: 34340177] [1:3.0.7-25] - Provide relevant diagnostics when FIPS checksum is corrupted Resolves: RHEL-5317 - Don't limit using SHA1 in KDFs in non-FIPS mode. Resolves: RHEL-5295 - Provide empty evp_proper…

  • Medium max 5.3
    ELSA-2024-0256 1 CVE

    Moderate: python3 security update (Oracle Linux 8)

    [3.6.8-56.0.1.3] - Security fix for CVE-2023-27043 Resolves: rhbz#2196183

  • Medium max 5.5
    ELSA-2024-0253 1 CVE

    Moderate: sqlite security update (Oracle Linux 8)

    [3.26.0-19.0.1] - Fixed CVE-2023-7104

  • Medium max 6.6
    ELSA-2024-0143 2 CVEs

    Moderate: idm:DL1 security update (Oracle Linux 8)

    bind-dyndb-ldap custodia ipa [4.9.12-11.0.1] - Resolves: 2242828 Invalid CSRF protection (CVE-2023-5455) ipa-healthcheck opendnssec python-jwcrypto python-kdcproxy [0.4-5] - Always buffer TCP data in __handle_recv() - Resolves: #1747144 [0.4-4] - Correct addr…

  • Medium max 7.5
    ELSA-2024-0130 4 CVEs

    Moderate: frr security update (Oracle Linux 8)

    [7.5.1-13.3] - Resolves: RHEL-15916 - Flowspec overflow in bgpd/bgp_flowspec.c - Resolves: RHEL-15919 - Out of bounds read in bgpd/bgp_label.c - Resolves: RHEL-15869 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message - Resolves: RHEL…