[USN-6667-1] Cpanel-JSON-XS vulnerability
[USN-6665-1] Unbound vulnerabilities
[USN-6668-1] python-openstackclient vulnerability
[USN-6666-1] libuv vulnerability
[USN-6651-2] Linux kernel vulnerabilities
[USN-6648-2] Linux kernel (Azure) vulnerabilities
[USN-6653-2] Linux kernel (AWS) vulnerabilities
[USN-6667-1] Cpanel-JSON-XS vulnerability
==========================================================================
Ubuntu Security Notice USN-6667-1
February 28, 2024
libcpanel-json-xs-perl vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Cpanel-JSON-XS could be made to crash or expose information if it
processed specially crafted data.
Software Description:
- libcpanel-json-xs-perl: module for fast and correct serialising to JSON
Details:
It was discovered that Cpanel-JSON-XS incorrectly decoded certain data. A
remote attacker could use this issue to cause Cpanel-JSON-XS to crash,
resulting in a denial of service, or possibly obtain sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
libcpanel-json-xs-perl 4.27-1ubuntu0.1
Ubuntu 20.04 LTS:
libcpanel-json-xs-perl 4.19-1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6667-1
CVE-2022-48623
Package Information:
https://launchpad.net/ubuntu/+source/libcpanel-json-xs-perl/4.27-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libcpanel-json-xs-perl/4.19-1ubuntu0.1
[USN-6665-1] Unbound vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6665-1
February 28, 2024
unbound vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Unbound.
Software Description:
- unbound: validating, recursive, caching DNS resolver
Details:
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Unbound incorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Unbound to consume
resources, leading to a denial of service. (CVE-2023-50387)
It was discovered that Unbound incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Unbound to consume resources, leading to a denial of service.
(CVE-2023-50868)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libunbound8 1.17.1-2ubuntu0.1
unbound 1.17.1-2ubuntu0.1
Ubuntu 22.04 LTS:
libunbound8 1.13.1-1ubuntu5.4
unbound 1.13.1-1ubuntu5.4
Ubuntu 20.04 LTS:
libunbound8 1.9.4-2ubuntu1.5
unbound 1.9.4-2ubuntu1.5
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6665-1
CVE-2023-50387, CVE-2023-50868
Package Information:
https://launchpad.net/ubuntu/+source/unbound/1.17.1-2ubuntu0.1
https://launchpad.net/ubuntu/+source/unbound/1.13.1-1ubuntu5.4
https://launchpad.net/ubuntu/+source/unbound/1.9.4-2ubuntu1.5
[USN-6668-1] python-openstackclient vulnerability
==========================================================================
Ubuntu Security Notice USN-6668-1
February 28, 2024
python-openstackclient vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
python-openstackclient could delete incorrect access rules.
Software Description:
- python-openstackclient: OpenStack Command-line Client
Details:
It was discovered that when python-openstackclient attempted to delete a
non-existing access rule, it would delete another existing access rule
instead, contrary to expectations.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
python3-openstackclient 5.8.0-0ubuntu1.1
Ubuntu 20.04 LTS:
python3-openstackclient 5.2.0-0ubuntu1.20.04.2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6668-1
CVE-2023-6110
Package Information:
https://launchpad.net/ubuntu/+source/python-openstackclient/5.8.0-0ubuntu1.1
https://launchpad.net/ubuntu/+source/python-openstackclient/5.2.0-0ubuntu1.20.04.2
[USN-6666-1] libuv vulnerability
==========================================================================
Ubuntu Security Notice USN-6666-1
February 28, 2024
libuv1 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
libuv could be made to truncate certain hostnames.
Software Description:
- libuv1: asynchronous event notification library
Details:
It was discovered that libuv incorrectly truncated certain hostnames. A
remote attacker could possibly use this issue with specially crafted
hostnames to bypass certain checks.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libuv1 1.44.2-1ubuntu0.1
Ubuntu 22.04 LTS:
libuv1 1.43.0-1ubuntu0.1
Ubuntu 20.04 LTS:
libuv1 1.34.2-1ubuntu1.5
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6666-1
CVE-2024-24806
Package Information:
https://launchpad.net/ubuntu/+source/libuv1/1.44.2-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libuv1/1.43.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libuv1/1.34.2-1ubuntu1.5
[USN-6651-2] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6651-2
February 28, 2024
linux-lowlatency, linux-lowlatency-hwe-6.5, linux-oem-6.5 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-lowlatency: Linux low latency kernel
- linux-lowlatency-hwe-6.5: Linux low latency kernel
- linux-oem-6.5: Linux kernel for OEM systems
Details:
It was discovered that a race condition existed in the ATM (Asynchronous
Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51780)
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)
Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)
Jann Horn discovered that the io_uring subsystem in the Linux kernel did
not properly handle the release of certain buffer rings. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2024-0582)
Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
linux-image-6.5.0-21-lowlatency 6.5.0-21.21.1
linux-image-6.5.0-21-lowlatency-64k 6.5.0-21.21.1
linux-image-lowlatency 6.5.0.21.21.15
linux-image-lowlatency-64k 6.5.0.21.21.15
Ubuntu 22.04 LTS:
linux-image-6.5.0-1015-oem 6.5.0-1015.16
linux-image-6.5.0-21-lowlatency 6.5.0-21.21.1~22.04.1
linux-image-6.5.0-21-lowlatency-64k 6.5.0-21.21.1~22.04.1
linux-image-lowlatency-64k-hwe-22.04 6.5.0.21.21.1~22.04.7
linux-image-lowlatency-hwe-22.04 6.5.0.21.21.1~22.04.7
linux-image-oem-22.04d 6.5.0.1015.17
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6651-2
https://ubuntu.com/security/notices/USN-6651-1
CVE-2023-51780, CVE-2023-51781, CVE-2023-6915, CVE-2024-0565,
CVE-2024-0582, CVE-2024-0646
Package Information:
https://launchpad.net/ubuntu/+source/linux-lowlatency/6.5.0-21.21.1
https://launchpad.net/ubuntu/+source/linux-lowlatency-hwe-6.5/6.5.0-21.21.1~22.04.1
https://launchpad.net/ubuntu/+source/linux-oem-6.5/6.5.0-1015.16
[USN-6648-2] Linux kernel (Azure) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6648-2
February 28, 2024
linux-azure, linux-azure-5.4 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-azure-5.4: Linux kernel for Microsoft Azure cloud systems
Details:
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)
Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)
Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.4.0-1124-azure 5.4.0-1124.131
linux-image-azure-lts-20.04 5.4.0.1124.117
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
linux-image-5.4.0-1124-azure 5.4.0-1124.131~18.04.1
linux-image-azure 5.4.0.1124.97
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6648-2
https://ubuntu.com/security/notices/USN-6648-1
CVE-2023-51781, CVE-2023-6915, CVE-2024-0565, CVE-2024-0646
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/5.4.0-1124.131
[USN-6653-2] Linux kernel (AWS) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6653-2
February 28, 2024
linux-aws, linux-aws-5.15 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-aws-5.15: Linux kernel for Amazon Web Services (AWS) systems
Details:
It was discovered that a race condition existed in the ATM (Asynchronous
Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51780)
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)
Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)
Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
linux-image-5.15.0-1055-aws 5.15.0-1055.60
linux-image-aws-lts-22.04 5.15.0.1055.54
Ubuntu 20.04 LTS:
linux-image-5.15.0-1055-aws 5.15.0-1055.60~20.04.1
linux-image-aws 5.15.0.1055.60~20.04.42
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6653-2
https://ubuntu.com/security/notices/USN-6653-1
CVE-2023-51780, CVE-2023-51781, CVE-2023-6915, CVE-2024-0565,
CVE-2024-0646
Package Information:
https://launchpad.net/ubuntu/+source/linux-aws/5.15.0-1055.60
https://launchpad.net/ubuntu/+source/linux-aws-5.15/5.15.0-1055.60~20.04.1
