Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,321 results · Feed

High max 10.0

ELSA-2024-1435 1 CVE

Important: postgresql-jdbc security update (Oracle Linux 8)

[42.2.14-3] - Fix CVE-2024-1597

Mar 20, 2024
High max 8.6

ELSA-2024-1376 3 CVEs

Important: squid security update (Oracle Linux 9)

[7:5.5-6.0.1.8] - Rebuild with release bump [7:5.5-6.8] - Resolves: RHEL-19555 - squid: denial of service in HTTP request parsing (CVE-2023-50269) [7:5.5-6.7] - Resolves: RHEL-28614 - squid: Denial of Service in HTTP Chunked Decoding (CVE-2024-25111) [7:5.5-6…

Mar 20, 2024
High max 8.3

ELSA-2024-1427 2 CVEs

Important: libreoffice security update (Oracle Linux 9)

[1:7.1.8.1-12.0.1] - Replace colors with Oracle colors [Orabug: 32120093] - Added the --with-hamcrest option to configure. [1:7.1.8.1-12] - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols

Mar 20, 2024
High max 10.0

ELSA-2024-1436 1 CVE

Important: postgresql-jdbc security update (Oracle Linux 9)

[42.2.28-1] - rebase to 42.2.28 - fix for CVE-2024-1597

Mar 20, 2024
Medium max 5.9

ELSA-2024-12232 1 CVE

Moderate: openssh security update (Oracle Linux 7)

[7.4p1-23.0.3_fips] - Change Epoch from 1 to 10 - Enable fips KDF POST [Orabug: 32461750] - Disable diffie-hellman-group-exchange-sha256 KEX FIPS method [Orabug: 32461739] [7.4p1-23.0.3] - add KEX_INITIAL flag [Orabug: 36160445] - implement 'strict key exchan…

Mar 19, 2024
High

ELSA-2024-12226 1 CVE

Important: conmon security update (Oracle Linux 8)

conmon [2.1.3-8] - address CVE-2023-39326 cri-o [1.26.4-1] - Added Oracle Specific Files for cri-o - Cherry-picked upstream commits for OCPBUGS-17150: oci: simplify stopping code https://github.com/cri-o/cri-o/pull/7185 - Fixed CVE-2023-39325: bump golang.org…

Mar 19, 2024
Medium max 5.9

ELSA-2024-12233 1 CVE

Moderate: openssh security update (Oracle Linux 7)

[7.4p1-23.0.3_fips] - Change Epoch from 1 to 10 - Enable fips KDF POST [Orabug: 32461750] - Disable diffie-hellman-group-exchange-sha256 KEX FIPS method [Orabug: 32461739] [7.4p1-23.0.3] - add KEX_INITIAL flag [Orabug: 36160445] - implement 'strict key exchan…

Mar 18, 2024
High

ELSA-2024-12225 1 CVE

Important: conmon security update (Oracle Linux 9)

conmon [2.1.3-8] - address CVE-2023-39326 cri-o [1.26.4-1] - Added Oracle Specific Files for cri-o - Cherry-picked upstream commits for OCPBUGS-17150: oci: simplify stopping code https://github.com/cri-o/cri-o/pull/7185 - Fixed CVE-2023-39325: bump golang.org…

Mar 18, 2024
Medium max 7.5

ELSA-2024-1308 1 CVE

Moderate: .NET 7.0 security update (Oracle Linux 8)

[7.0.117-1.0.1] - Update to .NET SDK 7.0.117 and Runtime 7.0.17 - Port Revert 'Disable implicit rejection for RSA PKCS#1 (#95217) patch

Mar 15, 2024
High max 7.5

ELSA-2024-1335 2 CVEs

Important: dnsmasq security update (Oracle Linux 8)

[2.79-31.2] - Fix CVE 2023-50387 and CVE 2023-50868 - Resolves: RHEL-25628 - Resolves: RHEL-25666 [2.79-31.1] - Do not crash on invalid domain in --synth-domain option (RHEL-22741) [2.79-31] - Do not create and search --local and --address=/x/# domains (#2233…

Mar 15, 2024
High max 7.8

ELSA-2024-1248 11 CVEs

Important: kernel security update (Oracle Linux 9)

- [5.14.0-362.24.1_3.OL9] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.g…

Mar 15, 2024
High max 7.5

ELSA-2024-1334 2 CVEs

Important: dnsmasq security update (Oracle Linux 9)

[2.85-14.1] - Fix CVE 2023-50387 and CVE 2023-50868 - Resolves: RHEL-25674 - Resolves: RHEL-25638

Mar 15, 2024
Medium max 7.5

ELSA-2024-1311 1 CVE

Moderate: .NET 8.0 security update (Oracle Linux 8)

[8.0.103-1.0.1] - Update to .NET SDK 8.0.103 and Runtime 8.0.3 - Backport MSBuild locale fix

Mar 14, 2024
Medium max 7.5

ELSA-2024-1310 1 CVE

Moderate: .NET 8.0 security update (Oracle Linux 9)

[- 8.0.103-2.0.1] - Update to .NET SDK 8.0.103 and Runtime 8.0.3 - Disable checking the signature of the last certificate in a chain if the certificate is supposedly self-signed. - Resolves: RHEL-25254 - Backport MSBuild locale fix - Resolves: RHEL-23936

Mar 14, 2024
Medium max 7.5

ELSA-2024-1309 1 CVE

Moderate: .NET 7.0 security update (Oracle Linux 9)

[- 7.0.117-1.0.1] - Update to .NET SDK 7.0.117 and Runtime 7.0.17 - Port revert 'Disable implicit rejection for RSA PKCS#1 (#95217)' patch [- 7.0.116-1.0.1] - Update to .NET SDK 7.0.116 and Runtime 7.0.16 * Tue Jan 16 2024 Lukas Lipinsky - 7.0.115-1.0.1 - Upd…

Mar 14, 2024
High max 7.8

ELSA-2024-12208 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-204.147.6.2] - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Kees Cook) [Orabug: 36353543] - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Shradha Gupta) [Orabug: 36358874] - hv_netvsc: Fix race condition between net…

Mar 11, 2024
High max 8.3

ELSA-2024-1075 2 CVEs

Important: edk2 security update (Oracle Linux 9)

[20230524-4.el9_3.2] - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853] - edk2-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch [RHEL-21841 RHEL-21843 RHEL…

Mar 8, 2024
Medium max 5.9

ELSA-2024-1239 1 CVE

Moderate: opencryptoki security update (Oracle Linux 9)

[3.21.0-9] - timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin) Resolves: RHEL-22792

Mar 8, 2024
Medium max 5.9

ELSA-2024-1150 1 CVE

Moderate: buildah security update (Oracle Linux 9)

[1.31.4-1.0.1] - update to https://github.com/containers/buildah/releases/tag/v1.31 - https://github.com/containers/buildah/commit/11bbf33

Mar 7, 2024
Medium

ELSA-2024-1149 1 CVE

Moderate: skopeo security update (Oracle Linux 9)

[2:1.13.3-4] - Rebuild with golang 1.20.12: golang:net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)

Mar 7, 2024
High max 8.8

ELSA-2024-0461 17 CVEs

Important: kernel security update (Oracle Linux 9)

[5.14.0-362.18.1.el9_3.OL9] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509…

Mar 7, 2024
High max 7.5

ELSA-2024-1134 1 CVE

Important: tomcat security update (Oracle Linux 9)

[1:9.0.62-37.el9_3.2] - Resolves: #2252050 HTTP request smuggling via malformed trailer headers (CVE-2023-46589)

Mar 7, 2024
High max 7.8

ELSA-2024-0897 19 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-513.18.1.el8_9.OL8] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509…

Mar 6, 2024
Medium max 6.5

ELSA-2024-1129 1 CVE

Moderate: curl security update (Oracle Linux 9)

[7.76.1-26.el9_3.3] - cap SFTP packet size sent (RHEL-14697) - lowercase the domain names before PSL checks (CVE-2023-46218)

Mar 6, 2024
Medium max 7.5

ELSA-2024-1141 75 CVEs

Moderate: mysql security update (Oracle Linux 9)

[8.0.36-1] - Update to MySQL 8.0.36

Mar 6, 2024
Medium max 6.5

ELSA-2024-1130 2 CVEs

Moderate: openssh security update (Oracle Linux 9)

[8.7p1-34.3] - Fix Terrapin attack (CVE-2023-48795) Resolves: RHEL-19764 - Forbid shell metasymbols in username/hostname (CVE-2023-51385) Resolves: RHEL-19822

Mar 6, 2024
Medium

ELSA-2024-1131 2 CVEs

Moderate: golang security update (Oracle Linux 9)

[1.20.12-1] - Rebase to 1.20.12 - Fix CVE-2023-45285 CVE-2023-39326

Mar 6, 2024
Medium max 5.5

ELSA-2024-1147 1 CVE

Moderate: rear security update (Oracle Linux 9)

[2.6-21.0.1] - rear: creates a world-readable initrd (CVE-2024-23301)

Mar 6, 2024
Medium max 8.2

ELSA-2024-1142 2 CVEs

Moderate: haproxy security update (Oracle Linux 9)

[2.4.22-3] - Reject '#' as part of URI path component (CVE-2023-45539, RHEL-18169) [2.4.22-2] - Reject any empty content-length header value (CVE-2023-40225, RHEL-7736)

Mar 6, 2024
Low max 2.3

ELSA-2024-1139 1 CVE

Low: keylime security update (Oracle Linux 9)

[7.3.0-13] - Backport fix for CVE-2023-3674 Resolves: RHEL-21013

Mar 6, 2024
High max 8.3

ELSA-2024-1063 2 CVEs

Important: edk2 security update (Oracle Linux 8)

[20220126gitbb1bba3d77-6.el8_9.6] - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21840 RHEL-21842] - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch [RHEL-21840 RHEL-21842] - Resolves: RHEL-21842 (CVE-2023-45230 edk2: …

Mar 5, 2024
High

ELSA-2024-12189 1 CVE

Important: conmon security update (Oracle Linux 7)

conmon [2.1.3-8] - address CVE-2023-39326 [2.1.3-7] - Resolve CVE-2023-39325 [2.1.3-6] - Add ol8_baseos_latest, and ol9_baseos_latest, to Jenkinsfile [2.1.3-5] - Add systemd-devel as build requirement [2.1.3-4] - Add support ARM build [2.1.3.3] - Add OL9 supp…

Mar 1, 2024
High max 7.5

ELSA-2024-12193 5 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.1.12-124.83.2] - Input: add bounds checking to input_set_capability() (Jeff LaBundy) [Orabug: 36192120] {CVE-2022-48619} - netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() (Hangyu Hua) [Orabug: 36155598] {CVE-2023-7192} [4.1…

Mar 1, 2024
High

ELSA-2024-12190 1 CVE

Important: conmon security update (Oracle Linux 8)

conmon [2.1.3-8] - address CVE-2023-39326 cri-o [1.25.5-1] - Added Oracle Specifile Files for cri-o cri-tools [1.25.0-3] - Resolve CVE-2023-39326 flannel-cni-plugin [1.0.1-4] - Resolve CVE-2023-39326 helm [3.11.1-3] - address CVE-2023-39326 istio [1.16.7-3] -…

Mar 1, 2024
Medium

ELSA-2024-12191 1 CVE

Moderate: container-tools:4.0 security update (Oracle Linux 8)

buildah cockpit-podman conmon containernetworking-plugins containers-common container-selinux criu crun fuse-overlayfs libslirp oci-seccomp-bpf-hook podman [2:4.0.2-26] - rebuild with golang 1.20.12 for CVE-2023-39326 python-podman runc [1:1.1.12-1.0.1] - reb…

Mar 1, 2024
High max 7.8

ELSA-2024-12187 3 CVEs

Important: kernel security update (Oracle Linux 8)

[4.18.0-513.18.0.2.el8_9] - net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623} - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve {CVE-2023-4623} - x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2…

Feb 29, 2024
High max 8.0

ELSA-2024-0956 1 CVE

Important: postgresql:10 security update (Oracle Linux 8)

[10.23-4.0.1] - Resolves: CVE-2024-0985

Feb 28, 2024
High max 7.5

ELSA-2024-0965 2 CVEs

Important: unbound security update (Oracle Linux 8)

[1.16.2-5.2] - bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) - bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)

Feb 28, 2024
High max 7.5

ELSA-2024-0977 2 CVEs

Important: unbound security update (Oracle Linux 9)

[1.16.2-3.1] - Fix DNSSEC validation vulnerabilities which can lead to DoS in trivially orchestrated attacks (CVE-2023-50387 and CVE-2023-50868)

Feb 28, 2024
High max 8.1

ELSA-2024-0964 8 CVEs

Important: thunderbird security update (Oracle Linux 8)

[115.8.0-1.0.1] - Add Oracle modifications [115.8.0-1] - Update to 115.8.0 build1

Feb 27, 2024