RHBA-2020:0547 Red Hat Bug Fix Advisory: Container Image Rebuild for Ansible Tower 3.4 Dependency
glibc: getaddrinfo should reject IP addresses with trailing characters ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries openssl: timing side channel attack in the DSA signature algorithm procps: Local privilege escalation in top LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp nss: Cache side-channel variant of the Bleichenbacher attack binutils: Stack Exhaustion in the demangling functions provided by libiberty binutils: NULL pointer dereference in work_stuff_copy_to_from in cplus-dem.c. curl: NTLM password overflow via integer overflow python: Missing salt initialization in _elementtree.c module systemd: line splitting via fgets() allows for state injection during daemon-reexec elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file elfutils: Double-free due to double decompression of sections in crafted ELF causes crash elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash curl: Heap-based buffer over-read in the curl tool warning formatting systemd: out-of-bounds read when parsing a crafted syslog message systemd: kills privileged process if unprivileged PIDFile was tampered elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl elfutils: eu-size cannot handle recursive ar files elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c krb5: Reachable assertion in the KDC using S4U2Self requests binutils: integer overflow leads to heap-based buffer overflow in objdump openssl: 0-byte record padding oracle libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read libssh2: Out-of-bounds reads with specially crafted SSH packets libssh2: Out-of-bounds memory comparison with specially crafted message channel request python: NULL pointer dereference using a specially crafted X509 certificate elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c python: CRLF injection via the query part of the url passed to urlopen() python: CRLF injection via the path part of the url passed to urlopen() python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate sqlite: fts3: improve shadow table corruption detection ansible: shell enabled by default in a pipe lookup plugin subprocess ansible: path injection on dest parameter in fetch module ansible: atomic_move primitive sets permissive permissions ansible: Extract-Zip function in win_unzip module does not check extracted path ansible: module package can be selected by the ansible facts ansible: svn module leaks password when specified as a parameter ansible: secrets readable after ansible-vault edit ansible: Information disclosure issue in ldap_attr and ldap_entry modules Ansible: kubectl connection plugin leaks sensitive information Ansible: code injection when using ansible_facts as a subkey Ansible: modules which use files encrypted with vault are not properly cleaned up
CVSS v3.1 score: 5
CVSS v3.0 score: 8.1