huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2019-1000020: libarchive: Infinite recursion in archive_read_support_format_iso9660.c resulting in denial of service
Component: libarchive
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-01-20T00:00:00+00:00

libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.

Statement: This vulnerability is present in the libarchive package included in Red Hat Virtualization Hypervisor, however it is never exposed to ISO images created by attackers or users, so the vulnerability can not be exploited.

Affected upstream versions: n/a
Fixed upstream versions: v3.4.0
Upstream repository: https://github.com/libarchive/libarchive
Upstream fix commit: 8312eaa576014cd9b965012af51bc1f967b12423
CVE-2019-1010305: libmspack: buffer overflow in function chmd_read_headers()
Component: libmspack
Severity: Low
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 2.5 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)
Public date: 2019-07-15T00:00:00+00:00

libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.

Statement: This issue affects versions of libmspack as shipped with Red Hat Enterprise Linux 7 and 8. This flaw was rated as having a Low security impact by the Red Hat Product Security Team.

Affected upstream versions: 0.9.1alpha [fixed: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d]
Fixed upstream versions: v1.9.1
Upstream repository: https://github.com/kyz/libmspack
Upstream fix commit: 2f084136cfe0d05e5bf5703f3e83c6d955234b4d
CVE-2019-1010315: wavpack: Divide by zero in ParseDsdiffHeaderConfig leads to crash
Component: wavpack
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2019-07-12T00:00:00+00:00

WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash of a software/service that tries to parse a .wav file. The component is: ParseDsdiffHeaderConfig (dsdiff.c:282). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc.

Statement: This issue affects WackPack version as shipped with Red Hat Enterprise Linux 8 and was classified with 'Low' security impact by Red Hat Product Security team.
Red Hat Enterprise Linux 6 and 7 are not affected as WavPack shipped with both system versions doesn't provide support for DSD files.

Affected upstream versions: <=5.1 [fixed: After commit https://github.com/dbry/WavPack/commit/4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc]
Fixed upstream versions: 5.2.0
Upstream repository: https://github.com/dbry/WavPack
Upstream fix commit: 4c0faba32fddbd0745cbfaf1e1aeb3da5d35b9fc
CVE-2019-1010317: wavpack: Use of uninitialized variable in ParseCaffHeaderConfig leads to DoS
Component: wavpack
Severity: Low
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Public date: 2019-08-06T00:00:00+00:00

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b.

Statement: This issue affects wavpack versions as shipped with Red Hat Enterprise Linux 8. The security impact for this flaw was calculated as 'Low' by the Red Hat Product Security Team. Previous Red Hat Enterprise Linux versions are not affected as wavpack shipped with it doesn't support CAF file format, which is needed to reach the code where the flaw resides at.

Affected upstream versions: 5.1.0 and earlier [fixed: After commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b]
Fixed upstream versions: 5.2.0
Upstream repository: https://github.com/dbry/WavPack
Upstream fix commit: f68a9555b548306c5b1ee45199ccdc4a16a6101b
CVE-2019-1010319: wavpack: Use of uninitialized variable in ParseWave64HeaderConfig leads to DoS
Component: wavpack
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 2.5 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2019-08-06T00:00:00+00:00

WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.

Statement: This issue affects the versions of wavpack as shipped with Red Hat Enterprise Linux 8. This flaw has been classified as 'Low' regarding the security impact by the Red Hat Product Security Team.
Red Hat Enterprise Linux versions prior than the mentioned before are not affected as wavpack shipped with those versions doesn't support the file format required.

Affected upstream versions: <=5.1.0 [fixed: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe]
Fixed upstream versions: 5.2.0
Upstream repository: https://github.com/dbry/WavPack
Upstream fix commit: 33a0025d1d63ccd05d9dbaa6923d52b1446a62fe
CVE-2019-10131: ImageMagick: off-by-one read in formatIPTCfromBuffer function in coders/meta.c
Component: ImageMagick
Severity: Low
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2019-04-30T00:00:00+00:00

An off-by-one read vulnerability was discovered in ImageMagick in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.


Affected upstream versions: fixed in 7.0.7-28
Fixed upstream versions: 7.0.7-28
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: cb1214c124e1bd61f7dd551b94a794864861592e
CVE-2019-10160: python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
Component: python
Severity: Important
CWE: CWE-172 (Encoding Error)
CVSS v3: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-06-03T00:00:00+00:00

A security regression of CVE-2019-9636 was discovered in python, since commit d537ab0ff9767ef024f26246899728f0116b1ec3, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

Statement: This issue did not affect the versions of python as shipped with Red Hat Enterprise Linux 5 and 6 as the security regression was not introduced in those versions. See CVE-2019-9636 for more details about the how these versions of Red Hat Enterprise Linux are affected with regard to the original flaw.

This issue did not affect the versions of python as shipped with Red Hat Enterprise Linux 8 as the security regression was not introduced in those versions. See CVE-2019-9636 for more details about the how these versions of Red Hat Enterprise Linux are affected with regard to the original flaw.

Affected upstream versions: affects 2.7, 3.5, 3.6, 3.7, >= v3.8.0a4 and < v3.8.0b1
Fixed upstream versions: 3.8
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 8d0ef0b5edeae52960c7ed05ae8a12388324f87e
CVE-2019-10161: libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API
Component: libvirt
Severity: Important
CWE: CWE-284 (Improper Access Control)
CVSS v3: 8.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2019-06-20T12:00:00+00:00

It was discovered that libvirtd would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.

Statement: * This vulnerability requires access to the libvirt socket, normally in /var/run/libvirt/libvirt_sock_ro.  Typically in hypervisor environments, local user accounts are not supported so no untrusted users should be able to access this socket.
* Red Hat Gluster Storage 3 is not affected by this vulnerability as libvirtd daemon is not shipped in Gluster.
* On Red Hat Enterprise Linux 6, the impact of this vulnerability is limited to denial of service or disclosing the existence of arbitrary files.  Privilege escalation is not possible.  For RHEL6, this CVE is rated as Moderate severity with 7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H

Affected upstream versions: fixed in 4.10.1, fixed in 5.4.1
Fixed upstream versions: v5.5.0
Upstream repository: https://libvirt.org/git/libvirt.git
Upstream fix commit: aed6a032cead4386472afb24b16196579e239580
CVE-2019-10216: ghostscript: -dSAFER escape via .buildfont1 (701394)
Component: ghostscript
Severity: Important
CWE: CWE-648 (Incorrect Use of Privileged APIs)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2019-08-12T13:00:00+00:00

It was found that the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.


Affected upstream versions: before 9.50
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 5b85ddd19
CVE-2019-10219: hibernate-validator: safeHTML validator allows XSS
Component: hibernate-validator
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2019-08-28T00:00:00+00:00

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Statement: Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it is being deprecated and is only receiving security fixes for Important and Critical flaws.

Affected upstream versions: 6.0.0.Alpha1 <= 6.0.17.Final, 6.1.0.Alpha1 <= 6.1.0.Alpha6
Fixed upstream versions: 6.0.18.Final, 6.1.0.Final
Upstream repository: https://github.com/hibernate/hibernate-validator
Upstream fix commit: 124b7dd6d9a4ad24d4d49f74701f05a13e56cee
CVE-2019-10638: Kernel: net: weak IP ID generation leads to remote device tracking
Component: Kernel
Severity: Low
CWE: CWE-1241 (Use of Predictable Algorithm in Random Number Generator)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2019-07-15T00:00:00+00:00

A flaw was found in the way the Linux kernel derived the IP ID field from a partial kernel space address returned by a net_hash_mix() function. A remote user could observe a weak IP ID generation in this field to track Linux devices.

Statement: This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 7,  8 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 7, 8 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 355b98553789b646ed97ad801a619ff898471b92
CVE-2019-10639: Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR
Component: Kernel
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2019-07-15T00:00:00+00:00

A flaw was found in the way the Linux kernel derived the IP ID field from a partial kernel space address returned by a net_hash_mix() function. A remote user could observe this IP ID field to extract the kernel address bits used to derive its value, which may result in leaking the hash key and potentially defeating KASLR.

Statement: This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 7,  8 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 7, 8 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 355b98553789b646ed97ad801a619ff898471b92
CVE-2019-10768: AngularJS: Prototype pollution in merge function could result in code injection
Component: AngularJS
Severity: Moderate
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2019-11-07T00:00:00+00:00

A prototype pollution vulnerability was found in AngularJS. A remote attacker could abuse this flaw by providing malicious input to the merge() function by overriding or adding properties of the Object.prototype, allowing possible injection of code.

Statement: Whilst servicemesh-grafana, and grafana-container both include a vulnerable version of angular.js (v1.6.6) the impact is lowered due to Grafana not directly implementing the angular.merge function.

Quay does not contain the affected vulnerable code pattern.

Affected upstream versions: All versions prior to version 1.7.9
Fixed upstream versions: v1.8.0
Upstream repository: https://github.com/angular/angular.js
Upstream fix commit: add78e62004e80bb1e16ab2dfe224afa8e513bc3
CVE-2019-10773: nodejs-yarn: Install functionality can be abused to generate arbitrary symlinks
Component: nodejs-yarn
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-12-16T00:00:00+00:00

A flaw was found in Yarn in versions prior to 1.21.1. Arbitrary symlinks can be generated using the package install functionality leading to existing files being overwritten. The highest threat from this vulnerability is to system confidentiality and integrity as well as system availability.


Affected upstream versions: All versions prior to version 1.21.1
Fixed upstream versions: v1.22.0
Upstream repository: https://github.com/yarnpkg/yarn
Upstream fix commit: 039bafd74b7b1a88a53a54f8fa6fa872615e90e7
CVE-2019-11068: libxslt: xsltCheckRead and xsltCheckWrite routines security bypass by crafted URL
Component: libxslt
Severity: Moderate
CWE: CWE-284 (Improper Access Control)
CVSS v3: 6.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2019-04-10T00:00:00+00:00

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.

Statement: Red Hat OpenStack will consume fixes from the base Red Hat Enterprise Linux Operating System. Therefore the package provided by Red Hat OpenStack has been marked as will not fix.

Affected upstream versions: n/a
Fixed upstream versions: v1.1.34
Upstream repository: https://gitlab.gnome.org/GNOME/libxslt
Upstream fix commit: e03553605b45c88f0b4b2980adfbbb8f6fca2fd6
CVE-2019-11190: kernel: ASLR bypass for setuid binaries due to late install_exec_creds()
Component: kernel
Severity: Low
CWE: CWE-250 (Execution with Unnecessary Privileges)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2019-04-03T00:00:00+00:00

A flaw in the load_elf_binary() function in the Linux kernel allows a local attacker to leak the base address of .text and stack sections for setuid binaries and bypass ASLR because install_exec_creds() is called too late in this function.


Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git
Upstream fix commit: a5b5352558f6808db0589644ea5401b3e3148a0d
CVE-2019-11358: jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
Component: jquery
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2019-03-27T00:00:00+00:00

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.

Statement: Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.

Affected upstream versions: n/a
Fixed upstream versions: 3.4.0
Upstream repository: https://github.com/jquery/jquery
Upstream fix commit: 753d591aea698e57d6db58c9f722cd0808619b1b
CVE-2019-11470: ImageMagick: denial of service in cineon parsing component
Component: ImageMagick
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2019-02-05T00:00:00+00:00

The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-28
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: e3cdce6fe12193f235b8c0ae5efe6880a25eb957
CVE-2019-11472: ImageMagick: denial of service in ReadXWDImage in coders/xwd.c in the XWD image parsing component
Component: ImageMagick
Severity: Low
CWE: CWE-248 (Uncaught Exception)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2019-04-14T00:00:00+00:00

ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.10-41
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: f663dfb8431c97d95682a2b533cca1c8233d21b4
CVE-2019-11477: Kernel: tcp: integer overflow while processing SACK blocks allows remote denial of service
Component: Kernel
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-06-17T17:00:00+00:00

An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented. Each fragment is about TCP maximum segment size (MSS) bytes. To efficiently process SACK blocks, the Linux kernel merges multiple fragmented SKBs into one, potentially overflowing the variable holding the number of segments. A remote attacker could use this flaw to crash the Linux kernel by sending a crafted sequence of SACK segments on a TCP connection with small value of TCP MSS, resulting in a denial of service (DoS).

Statement: Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article:  https://access.redhat.com/security/vulnerabilities/tcpsack

Affected upstream versions: 4.4 < 4.4.182, 4.9 < 4.9.182, 4.14 < 4.14.127, 4.19 < 4.19.52, 5.1 < 5.1.11
Fixed upstream versions: 4.14.127, 4.19.52, 4.4.182, 4.9.182, 5.1.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
Upstream fix commit: 3b4929f65b0d8249f19a50245cd88ed1a2f78cff
CVE-2019-11478: Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service
Component: Kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2019-06-17T17:00:00+00:00

An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented, which leads to increased resource utilization to traverse and process these fragments as further SACK segments are received on the same TCP connection. A remote attacker could use this flaw to cause a denial of service (DoS) by sending a crafted sequence of SACK segments on a TCP connection.

Statement: Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article:  https://access.redhat.com/security/vulnerabilities/tcpsack

Red Hat Enterprise Linux 5 is now in Maintenance Support 2 Phase of maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be  addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: 4.4 < 4.4.182, 4.9 < 4.9.182, 4.14 < 4.14.127, 4.19 < 4.19.52, 5.1 < 5.1.11
Fixed upstream versions: 4.14.127, 4.19.52, 4.4.182, 4.9.182, 5.1.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
Upstream fix commit: f070ef2ac66716357066b683fb0baf55f8191a2e