Skip to content

Commit 6dc0cd0

Browse files
dongsuparkdongsupark
authored
Merge pull request #1814 from flatcar/buildbot/monthly-glsa-metadata-updates-2024-04-01
Monthly GLSA metadata 2024-04-01
2 parents f04714a + 73605c9 commit 6dc0cd0

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+1997
-25
lines changed

‎sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
-----BEGIN PGP SIGNED MESSAGE-----
22
Hash: SHA512
33

4-
MANIFEST Manifest.files.gz 563604 BLAKE2B d497f4e02c0349649ea1fd84297af45ff253c185da14e6dba30f010f40d1ab86fdeb750087d23d7e892d4b2a6c45bb36baacd75348d2a50c0dc3c70213c1836e SHA512 c8b2f6bb87969de216a6075f22dc589f34d03bc0cd503b9bbedb9672f2aa19209f4d1236cd3f9aaf54428705e66f266c37a1f0bdb30c6fdae78df87761e4d8da
5-
TIMESTAMP 2024-02-01T06:41:25Z
4+
MANIFEST Manifest.files.gz 569494 BLAKE2B 475196fd0ff28d6023f45e6c22284bded2028bbe891778e3828fb75c3727438168bcd5ab63fe48683bb5874710c096e12470eee93163ae90c07d1f9d79810710 SHA512 94822c7f83b3b68b28e1885c442c2d9b5794eb5f861b8a0862162601a2c2b03cdc2bb6144d8b4a1d61befedf2ff1952e540c518e34c7f15ff5af14b7dc567fcb
5+
TIMESTAMP 2024-04-01T06:40:39Z
66
-----BEGIN PGP SIGNATURE-----
77

8-
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmW7PRVfFIAAAAAALgAo
8+
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmYKVudfFIAAAAAALgAo
99
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
1010
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
11-
klB4QRAAmmnYvk0FaooM922vBqTuhwuoLVbDtysDcvBsJHLxoL+AQlp+0romn4tJ
12-
rHDAcIPSjxMPzei60/FKb8/lWyAwDtRJJ6W0NLOBe5K0SRUKTLKQz4OZ3aHFNl2t
13-
Yp18kfnUgMyZ7l3v2CrKEE3oC+hWpULJ9GF+uuvpSHUXDOqIkbm6vhWQWRzDwCrA
14-
0RacuWPedLm34CiqwiZSEsnzOzvBb8A7tbmKtSyqhBTKyam7wy0/Tn99Wp5tnDGu
15-
Vtp7rgT1wMmGFOEYt2I+QM1fWGxf/GN3CNPNrNRQoQHcs9BadB8hn+auklc8zOc2
16-
RxEgAaESWhDLSsHkI1xp4osi9OTBqME1wUcjHPQr8d9JAdzsg5L8wW7rJE8YflM6
17-
uUrchSczds2gc34nG/ZYBC88EpvnU6U2AqZZ22LwOCi5qWo3GQZOc4jZqIuumogi
18-
faLkvuNCX2JKYKZdQQ4Byz9WMN+4X5dWLnQfJT9nHc0F/rTsV4ZcpDUApBCiqCD0
19-
lHY6ZPKcVL7d8cqQ2h6SjRkO0FrytUbBZm97g861/jX/evt1wY8Jx1e+FAxQksq+
20-
uPTXpriBil+N5YWzpHbuOZYjAQ7fv7fx50HM3RVNz2wwa7OUxhIFaE7/vBNbPL1F
21-
axrmSl59VEi9APSEmapOVVZR5tloRvDacB0elAhfpbqCb2BCO9E=
22-
=EZVX
11+
klBWrg//cxk8dWFEYLuuzfXLVmmEZmb3IPhBpMDKhQkoNbb4yGkCNuZUP42QdZzt
12+
f9qKIN4MD71/C9n5pt3UQBYH2fw2BBPDi2mpIVAdSQxydQCOimOF1BVTGDBBvNXd
13+
W64uDqqLnLAUVikdexeTCfHFvoOrqI8xALviM7U+EaXq+9a5s0CjvCFvYWkCKR0B
14+
ytl9J6eD0u7MWWQoNa5wrolHgRidVFtKfIbiOwAOmkWeXrcZ5s5h5eJg+UF9+UxS
15+
i7+sh9NZ4OAoTXszcf9x4L4RGkqWbTHpG6MBqhATI8N6jVsxXtJv3TlvS/OKi9Yn
16+
Dj+GUuok7WdbFGARfAASDGwolspDCacYXj618kioIySnaQrKuUTwFWPveAkfNLWc
17+
k79bwmBbmc6ILRhaYCpuN4hAC14gkL6xxrwGfuY7VxtjRockWTSUTLm9ACnjI7SY
18+
7r4dVvgQQqqu7F5+mpN8gV9yfu7hXvhAaZU8ptzJV6stjEpK/MW0h1BDimMArowI
19+
sGVSPMVkp80BNSHIPwiVM4sQTK1tDsdx9AjHz9hn/UV4uHSobiYvKE5/TUzhJoUO
20+
ERD9VRcyvpat+jNkmQD8a3ZBSbnK8rRee3sC5LhbOh/YeeZwCCBo3ai6LoeFkH4W
21+
c7yTtKfDg7Vb7tODZRG4DdVIHMxDUIT7v8Qi65Rntj6IxFlnMhQ=
22+
=BHZC
2323
-----END PGP SIGNATURE-----

‎sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz

5.75 KB
Binary file not shown.

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202208-24.xml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,16 @@
55
<synopsis>Multiple vulnerabilities have been discovered in the GNU C Library, the worst of which could result in denial of service.</synopsis>
66
<product type="ebuild">glibc</product>
77
<announced>2022-08-14</announced>
8-
<revised count="1">2022-08-14</revised>
8+
<revised count="2">2024-02-18</revised>
99
<bug>803437</bug>
1010
<bug>807935</bug>
1111
<bug>831096</bug>
1212
<bug>831212</bug>
1313
<access>remote</access>
1414
<affected>
1515
<package name="sys-libs/glibc" auto="yes" arch="*">
16-
<unaffected range="ge">2.34</unaffected>
17-
<vulnerable range="lt">2.34</vulnerable>
16+
<unaffected range="ge">2.34-r7</unaffected>
17+
<vulnerable range="lt">2.34-r7</vulnerable>
1818
</package>
1919
</affected>
2020
<background>
@@ -47,4 +47,4 @@
4747
</references>
4848
<metadata tag="requester" timestamp="2022-08-14T14:29:01.578271Z">ajak</metadata>
4949
<metadata tag="submitter" timestamp="2022-08-14T14:29:01.583276Z">sam</metadata>
50-
</glsa>
50+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202305-15.xml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<synopsis>Multiple vulnerabilities have been discovered in systemd, the worst of which could result in denial of service.</synopsis>
66
<product type="ebuild">systemd,systemd-tmpfiles,systemd-utils,udev</product>
77
<announced>2023-05-03</announced>
8-
<revised count="1">2023-05-03</revised>
8+
<revised count="2">2024-02-11</revised>
99
<bug>880547</bug>
1010
<bug>830967</bug>
1111
<access>remote</access>
@@ -15,14 +15,14 @@
1515
<vulnerable range="lt">251.3</vulnerable>
1616
</package>
1717
<package name="sys-apps/systemd-tmpfiles" auto="yes" arch="*">
18-
<vulnerable range="lt">250</vulnerable>
18+
<vulnerable range="le">250</vulnerable>
1919
</package>
2020
<package name="sys-apps/systemd-utils" auto="yes" arch="*">
2121
<unaffected range="ge">251.3</unaffected>
2222
<vulnerable range="lt">251.3</vulnerable>
2323
</package>
2424
<package name="sys-fs/udev" auto="yes" arch="*">
25-
<vulnerable range="lt">250</vulnerable>
25+
<vulnerable range="le">250</vulnerable>
2626
</package>
2727
</affected>
2828
<background>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202401-33.xml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
<revised count="1">2024-01-31</revised>
99
<bug>915222</bug>
1010
<bug>918667</bug>
11+
<bug>920667</bug>
1112
<access>remote</access>
1213
<affected>
1314
<package name="net-libs/webkit-gtk" auto="yes" arch="*">
@@ -54,4 +55,4 @@
5455
</references>
5556
<metadata tag="requester" timestamp="2024-01-31T14:29:39.449978Z">graaff</metadata>
5657
<metadata tag="submitter" timestamp="2024-01-31T14:29:39.452391Z">graaff</metadata>
57-
</glsa>
58+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202402-01.xml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202402-01">
4+
<title>glibc: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities in glibc could result in Local Privilege Escalation.</synopsis>
6+
<product type="ebuild">glibc</product>
7+
<announced>2024-02-02</announced>
8+
<revised count="1">2024-02-02</revised>
9+
<bug>918412</bug>
10+
<bug>923352</bug>
11+
<access>local and remote</access>
12+
<affected>
13+
<package name="sys-libs/glibc" auto="yes" arch="*">
14+
<unaffected range="ge">2.38-r10</unaffected>
15+
<vulnerable range="lt">2.38-r10</vulnerable>
16+
</package>
17+
</affected>
18+
<background>
19+
<p>glibc is a package that contains the GNU C library.</p>
20+
</background>
21+
<description>
22+
<p>Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details.</p>
23+
</description>
24+
<impact type="high">
25+
<p>Please review the referenced CVE identifiers for details.</p>
26+
</impact>
27+
<workaround>
28+
<p>There is no known workaround at this time.</p>
29+
</workaround>
30+
<resolution>
31+
<p>All glibc users should upgrade to the latest version:</p>
32+
33+
<code>
34+
# emerge --sync
35+
# emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.38-r10"
36+
</code>
37+
</resolution>
38+
<references>
39+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-5156">CVE-2023-5156</uri>
40+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-6246">CVE-2023-6246</uri>
41+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-6779">CVE-2023-6779</uri>
42+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-6780">CVE-2023-6780</uri>
43+
<uri>GLIBC-SA-2024-0001</uri>
44+
<uri>GLIBC-SA-2024-0002</uri>
45+
<uri>GLIBC-SA-2024-0003</uri>
46+
</references>
47+
<metadata tag="requester" timestamp="2024-02-02T03:02:44.468870Z">sam</metadata>
48+
<metadata tag="submitter" timestamp="2024-02-02T03:02:44.472185Z">sam</metadata>
49+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202402-02.xml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202402-02">
4+
<title>SDDM: Privilege Escalation</title>
5+
<synopsis>A vulnerability has been discovered in SDDM which can lead to privilege escalation.</synopsis>
6+
<product type="ebuild">sddm</product>
7+
<announced>2024-02-03</announced>
8+
<revised count="1">2024-02-03</revised>
9+
<bug>753104</bug>
10+
<access>local</access>
11+
<affected>
12+
<package name="x11-misc/sddm" auto="yes" arch="*">
13+
<unaffected range="ge">0.18.1-r6</unaffected>
14+
<vulnerable range="lt">0.18.1-r6</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>SDDM is a modern display manager for X11 and Wayland sessions aiming to be fast, simple and beautiful. It uses modern technologies like QtQuick, which in turn gives the designer the ability to create smooth, animated user interfaces.</p>
19+
</background>
20+
<description>
21+
<p>A vulnerability has been discovered in SDDM. Please review the CVE identifier referenced below for details.</p>
22+
</description>
23+
<impact type="normal">
24+
<p>SDDM passes the -auth and -displayfd command line arguments when
25+
starting the Xserver. It then waits for the display number to be
26+
received from the Xserver via the `displayfd`, before the Xauthority
27+
file specified via the `-auth` parameter is actually written. This
28+
results in a race condition, creating a time window in which no valid
29+
Xauthority file is existing while the Xserver is already running.
30+
31+
The X.Org server, when encountering a non-existing, empty or
32+
corrupt/incomplete Xauthority file, will grant any connecting client
33+
access to the Xorg display. A local unprivileged attacker can thus
34+
create an unauthorized connection to the Xserver and grab e.g. keyboard
35+
input events from other legitimate users accessing the Xserver.</p>
36+
</impact>
37+
<workaround>
38+
<p>There is no known workaround at this time.</p>
39+
</workaround>
40+
<resolution>
41+
<p>All SDDM users should upgrade to the latest version:</p>
42+
43+
<code>
44+
# emerge --sync
45+
# emerge --ask --oneshot --verbose ">=x11-misc/sddm-0.18.1-r6"
46+
</code>
47+
</resolution>
48+
<references>
49+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-28049">CVE-2020-28049</uri>
50+
</references>
51+
<metadata tag="requester" timestamp="2024-02-03T06:18:59.426090Z">graaff</metadata>
52+
<metadata tag="submitter" timestamp="2024-02-03T06:18:59.429353Z">ajak</metadata>
53+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202402-03.xml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202402-03">
4+
<title>QtGui: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in QtGui which can lead to remote code execution.</synopsis>
6+
<product type="ebuild">qtgui</product>
7+
<announced>2024-02-03</announced>
8+
<revised count="1">2024-02-03</revised>
9+
<bug>808531</bug>
10+
<bug>907119</bug>
11+
<access>remote</access>
12+
<affected>
13+
<package name="dev-qt/qtgui" auto="yes" arch="*">
14+
<unaffected range="ge">5.15.9-r1</unaffected>
15+
<vulnerable range="lt">5.15.9-r1</vulnerable>
16+
</package>
17+
</affected>
18+
<background>
19+
<p>QtGui is a module for the Qt toolkit.</p>
20+
</background>
21+
<description>
22+
<p>Multiple vulnerabilities have been discovered in QtGui. Please review the CVE identifiers referenced below for details.</p>
23+
</description>
24+
<impact type="normal">
25+
<p>Please review the referenced CVE identifiers for details.</p>
26+
</impact>
27+
<workaround>
28+
<p>There is no known workaround at this time.</p>
29+
</workaround>
30+
<resolution>
31+
<p>All QtGui users should upgrade to the latest version:</p>
32+
33+
<code>
34+
# emerge --sync
35+
# emerge --ask --oneshot --verbose ">=dev-qt/qtgui-5.15.9-r1"
36+
</code>
37+
</resolution>
38+
<references>
39+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-38593">CVE-2021-38593</uri>
40+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-32763">CVE-2023-32763</uri>
41+
</references>
42+
<metadata tag="requester" timestamp="2024-02-03T06:19:26.894264Z">graaff</metadata>
43+
<metadata tag="submitter" timestamp="2024-02-03T06:19:26.896389Z">ajak</metadata>
44+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202402-04.xml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202402-04">
4+
<title>GNAT Ada Suite: Remote Code Execution</title>
5+
<synopsis>A vulnerability has been discovered in GNAT Ada Suite which can lead to remote code execution.</synopsis>
6+
<product type="ebuild">gnat-suite-bin</product>
7+
<announced>2024-02-03</announced>
8+
<revised count="2">2024-02-11</revised>
9+
<bug>787440</bug>
10+
<access>remote</access>
11+
<affected>
12+
<package name="dev-ada/gnat-suite-bin" auto="yes" arch="*">
13+
<vulnerable range="le">2019-r2</vulnerable>
14+
</package>
15+
</affected>
16+
<background>
17+
<p>The GNAT Ada Suite is an Ada development environment.</p>
18+
</background>
19+
<description>
20+
<p>A vulnerability has been discovered in GNAT Ada Suite. Please review the CVE identifier referenced below for details.</p>
21+
</description>
22+
<impact type="high">
23+
<p>Please review the referenced CVE identifiers for details.</p>
24+
</impact>
25+
<workaround>
26+
<p>There is no known workaround at this time.</p>
27+
</workaround>
28+
<resolution>
29+
<p>Gentoo has discontinued support for GNAT Ada Suite. We recommend that users unmerge it:</p>
30+
31+
<code>
32+
# emerge --ask --depclean "dev-ada/gnat-suite-bin"
33+
</code>
34+
</resolution>
35+
<references>
36+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-27619">CVE-2020-27619</uri>
37+
</references>
38+
<metadata tag="requester" timestamp="2024-02-03T06:20:11.020220Z">graaff</metadata>
39+
<metadata tag="submitter" timestamp="2024-02-03T06:20:11.022709Z">ajak</metadata>
40+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202402-05.xml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202402-05">
4+
<title>Microsoft Edge: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in Microsoft Edge, the worst of which could lead to remote code execution.</synopsis>
6+
<product type="ebuild">microsoft-edge</product>
7+
<announced>2024-02-03</announced>
8+
<revised count="1">2024-02-03</revised>
9+
<bug>907817</bug>
10+
<bug>908518</bug>
11+
<bug>918586</bug>
12+
<bug>919495</bug>
13+
<access>remote</access>
14+
<affected>
15+
<package name="www-client/microsoft-edge" auto="yes" arch="*">
16+
<unaffected range="ge">120.0.2210.61</unaffected>
17+
<vulnerable range="lt">120.0.2210.61</vulnerable>
18+
</package>
19+
</affected>
20+
<background>
21+
<p>Microsoft Edge is a browser that combines a minimal design with sophisticated technology to make the web faster, safer, and easier.</p>
22+
</background>
23+
<description>
24+
<p>Multiple vulnerabilities have been discovered in Microsoft Edge. Please review the CVE identifiers referenced below for details.</p>
25+
</description>
26+
<impact type="high">
27+
<p>Please review the referenced CVE identifiers for details.</p>
28+
</impact>
29+
<workaround>
30+
<p>There is no known workaround at this time.</p>
31+
</workaround>
32+
<resolution>
33+
<p>All Microsoft Edge users should upgrade to the latest version:</p>
34+
35+
<code>
36+
# emerge --sync
37+
# emerge --ask --oneshot --verbose ">=www-client/microsoft-edge-120.0.2210.61"
38+
</code>
39+
</resolution>
40+
<references>
41+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-29345">CVE-2023-29345</uri>
42+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-33143">CVE-2023-33143</uri>
43+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-33145">CVE-2023-33145</uri>
44+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-35618">CVE-2023-35618</uri>
45+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-36022">CVE-2023-36022</uri>
46+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-36029">CVE-2023-36029</uri>
47+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-36034">CVE-2023-36034</uri>
48+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-36409">CVE-2023-36409</uri>
49+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-36559">CVE-2023-36559</uri>
50+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-36562">CVE-2023-36562</uri>
51+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-36727">CVE-2023-36727</uri>
52+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-36735">CVE-2023-36735</uri>
53+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-36741">CVE-2023-36741</uri>
54+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-36787">CVE-2023-36787</uri>
55+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-36880">CVE-2023-36880</uri>
56+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-38174">CVE-2023-38174</uri>
57+
</references>
58+
<metadata tag="requester" timestamp="2024-02-03T08:00:41.979777Z">graaff</metadata>
59+
<metadata tag="submitter" timestamp="2024-02-03T08:00:41.982534Z">graaff</metadata>
60+
</glsa>

0 commit comments

Comments
 (0)