[USN-6559-1] ZooKeeper vulnerabilities
[USN-6588-1] PAM vulnerability
[USN-6559-1] ZooKeeper vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6559-1
January 16, 2024
zookeeper vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in ZooKeeper.
Software Description:
- zookeeper: High-performance coordination service for distributed applications
Details:
It was discovered that ZooKeeper incorrectly handled authorization for
the getACL() command. A remote attacker could possibly use this issue to
obtain sensitive information. This issue only affected Ubuntu 14.04
LTS and Ubuntu 16.04 LTS. (CVE-2019-0201)
Damien Diederen discovered that ZooKeeper incorrectly handled
authorization if SASL Quorum Peer authentication is enabled. An
attacker could possibly use this issue to bypass ZooKeeper's
authorization system. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04
and Ubuntu 23.10. (CVE-2023-44981)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libzookeeper-java 3.8.0-11ubuntu0.1
Ubuntu 23.04:
libzookeeper-java 3.8.0-10ubuntu0.1
Ubuntu 22.04 LTS:
libzookeeper-java 3.4.13-6ubuntu4.1
Ubuntu 20.04 LTS:
libzookeeper-java 3.4.13-5ubuntu0.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libzookeeper-java 3.4.13-3ubuntu0.1~esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libzookeeper-java 3.4.8-1ubuntu0.1~esm2
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
libzookeeper-java 3.4.5+dfsg-1ubuntu0.1~esm3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6559-1
CVE-2019-0201, CVE-2023-44981
Package Information:
https://launchpad.net/ubuntu/+source/zookeeper/3.8.0-11ubuntu0.1
https://launchpad.net/ubuntu/+source/zookeeper/3.8.0-10ubuntu0.1
https://launchpad.net/ubuntu/+source/zookeeper/3.4.13-6ubuntu4.1
https://launchpad.net/ubuntu/+source/zookeeper/3.4.13-5ubuntu0.1
[USN-6588-1] PAM vulnerability
==========================================================================
Ubuntu Security Notice USN-6588-1
January 17, 2024
pam vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
PAM could be made to stop responding if it opened a specially crafted file.
Software Description:
- pam: Pluggable Authentication Modules
Details:
Matthias Gerstner discovered that the PAM pam_namespace module incorrectly
handled special files when performing directory checks. A local attacker
could possibly use this issue to cause PAM to stop responding, resulting in
a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libpam-modules 1.5.2-6ubuntu1.1
Ubuntu 23.04:
libpam-modules 1.5.2-5ubuntu1.1
Ubuntu 22.04 LTS:
libpam-modules 1.4.0-11ubuntu2.4
Ubuntu 20.04 LTS:
libpam-modules 1.3.1-5ubuntu4.7
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6588-1
CVE-2024-22365
Package Information:
https://launchpad.net/ubuntu/+source/pam/1.5.2-6ubuntu1.1
https://launchpad.net/ubuntu/+source/pam/1.5.2-5ubuntu1.1
https://launchpad.net/ubuntu/+source/pam/1.4.0-11ubuntu2.4
https://launchpad.net/ubuntu/+source/pam/1.3.1-5ubuntu4.7
