var-202103-1001
Vulnerability from variot
An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.). GNOME Glib is a multi-platform toolkit for creating graphical user interfaces, and is the underlying core library of GTK+ and GNOME projects. The vulnerability is caused by g_file_replace and G_FILE_CREATE_REPLACE_DESTINATION incorrectly creating the target of a symbolic link as an empty file. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: glib2 security and bug fix update Advisory ID: RHSA-2021:4385-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4385 Issue date: 2021-11-09 CVE Names: CVE-2021-3800 CVE-2021-28153 ==================================================================== 1. Summary:
An update for glib2 is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux CRB (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64
- Description:
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.
Security Fix(es):
-
glib2: Possible privilege escalation thourgh pkexec and aliases (CVE-2021-3800)
-
glib: g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION creates empty target for dangling symlink (CVE-2021-28153)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
1938284 - CVE-2021-3800 glib2: Possible privilege escalation thourgh pkexec and aliases 1938291 - CVE-2021-28153 glib: g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION creates empty target for dangling symlink 1948988 - Refcounting issue causes crashes and slow workarounds 1971533 - MD5 HMAC computation should not cause glib to segfault in FIPS mode
- Package List:
Red Hat Enterprise Linux BaseOS (v. 8):
Source: glib2-2.56.4-156.el8.src.rpm
aarch64: glib2-2.56.4-156.el8.aarch64.rpm glib2-debuginfo-2.56.4-156.el8.aarch64.rpm glib2-debugsource-2.56.4-156.el8.aarch64.rpm glib2-devel-2.56.4-156.el8.aarch64.rpm glib2-devel-debuginfo-2.56.4-156.el8.aarch64.rpm glib2-fam-2.56.4-156.el8.aarch64.rpm glib2-fam-debuginfo-2.56.4-156.el8.aarch64.rpm glib2-tests-2.56.4-156.el8.aarch64.rpm glib2-tests-debuginfo-2.56.4-156.el8.aarch64.rpm
ppc64le: glib2-2.56.4-156.el8.ppc64le.rpm glib2-debuginfo-2.56.4-156.el8.ppc64le.rpm glib2-debugsource-2.56.4-156.el8.ppc64le.rpm glib2-devel-2.56.4-156.el8.ppc64le.rpm glib2-devel-debuginfo-2.56.4-156.el8.ppc64le.rpm glib2-fam-2.56.4-156.el8.ppc64le.rpm glib2-fam-debuginfo-2.56.4-156.el8.ppc64le.rpm glib2-tests-2.56.4-156.el8.ppc64le.rpm glib2-tests-debuginfo-2.56.4-156.el8.ppc64le.rpm
s390x: glib2-2.56.4-156.el8.s390x.rpm glib2-debuginfo-2.56.4-156.el8.s390x.rpm glib2-debugsource-2.56.4-156.el8.s390x.rpm glib2-devel-2.56.4-156.el8.s390x.rpm glib2-devel-debuginfo-2.56.4-156.el8.s390x.rpm glib2-fam-2.56.4-156.el8.s390x.rpm glib2-fam-debuginfo-2.56.4-156.el8.s390x.rpm glib2-tests-2.56.4-156.el8.s390x.rpm glib2-tests-debuginfo-2.56.4-156.el8.s390x.rpm
x86_64: glib2-2.56.4-156.el8.i686.rpm glib2-2.56.4-156.el8.x86_64.rpm glib2-debuginfo-2.56.4-156.el8.i686.rpm glib2-debuginfo-2.56.4-156.el8.x86_64.rpm glib2-debugsource-2.56.4-156.el8.i686.rpm glib2-debugsource-2.56.4-156.el8.x86_64.rpm glib2-devel-2.56.4-156.el8.i686.rpm glib2-devel-2.56.4-156.el8.x86_64.rpm glib2-devel-debuginfo-2.56.4-156.el8.i686.rpm glib2-devel-debuginfo-2.56.4-156.el8.x86_64.rpm glib2-fam-2.56.4-156.el8.x86_64.rpm glib2-fam-debuginfo-2.56.4-156.el8.i686.rpm glib2-fam-debuginfo-2.56.4-156.el8.x86_64.rpm glib2-tests-2.56.4-156.el8.x86_64.rpm glib2-tests-debuginfo-2.56.4-156.el8.i686.rpm glib2-tests-debuginfo-2.56.4-156.el8.x86_64.rpm
Red Hat Enterprise Linux CRB (v. 8):
aarch64: glib2-debuginfo-2.56.4-156.el8.aarch64.rpm glib2-debugsource-2.56.4-156.el8.aarch64.rpm glib2-devel-debuginfo-2.56.4-156.el8.aarch64.rpm glib2-fam-debuginfo-2.56.4-156.el8.aarch64.rpm glib2-static-2.56.4-156.el8.aarch64.rpm glib2-tests-debuginfo-2.56.4-156.el8.aarch64.rpm
noarch: glib2-doc-2.56.4-156.el8.noarch.rpm
ppc64le: glib2-debuginfo-2.56.4-156.el8.ppc64le.rpm glib2-debugsource-2.56.4-156.el8.ppc64le.rpm glib2-devel-debuginfo-2.56.4-156.el8.ppc64le.rpm glib2-fam-debuginfo-2.56.4-156.el8.ppc64le.rpm glib2-static-2.56.4-156.el8.ppc64le.rpm glib2-tests-debuginfo-2.56.4-156.el8.ppc64le.rpm
s390x: glib2-debuginfo-2.56.4-156.el8.s390x.rpm glib2-debugsource-2.56.4-156.el8.s390x.rpm glib2-devel-debuginfo-2.56.4-156.el8.s390x.rpm glib2-fam-debuginfo-2.56.4-156.el8.s390x.rpm glib2-static-2.56.4-156.el8.s390x.rpm glib2-tests-debuginfo-2.56.4-156.el8.s390x.rpm
x86_64: glib2-debuginfo-2.56.4-156.el8.i686.rpm glib2-debuginfo-2.56.4-156.el8.x86_64.rpm glib2-debugsource-2.56.4-156.el8.i686.rpm glib2-debugsource-2.56.4-156.el8.x86_64.rpm glib2-devel-debuginfo-2.56.4-156.el8.i686.rpm glib2-devel-debuginfo-2.56.4-156.el8.x86_64.rpm glib2-fam-debuginfo-2.56.4-156.el8.i686.rpm glib2-fam-debuginfo-2.56.4-156.el8.x86_64.rpm glib2-static-2.56.4-156.el8.i686.rpm glib2-static-2.56.4-156.el8.x86_64.rpm glib2-tests-debuginfo-2.56.4-156.el8.i686.rpm glib2-tests-debuginfo-2.56.4-156.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2021-3800 https://access.redhat.com/security/cve/CVE-2021-28153 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBYYrdwdzjgjWX9erEAQj1Ww//TA/kISfe8RjrOJ3//LZrFuwYWT/lYRvA azcyR6n+o/hSTHmAJ0ccc8y2SVdh/ukBI96cB8n4BKAYlZhbdXFm3btcItT8rpqP Cc0z1SIhna+nm8Kdo4eDmjgMUm96E+uKq2bgmxduLWjYfKr/AB0n25nSn1o9sdAl F2iL6vlgmVtfGfa3ODovzIDwas7udIlaRzjnAmA9QSnnQUfZhvsBJbWcMJWJxej9 SrT5lkwPXYJxyGuXN8MD+kfgwjyXS3G+Svv//YkBmuiYjqpQJghRe3YfHCeQ6ow6 NlMOs2ZgNVIN8c03mhpZj6vUIr2qO7LcfUZaKCdIoTbVZKZY1yPkLxQ63EEB/AnP 2pnAwybjS06Izr8JWjwGt/20+gsq1sGWKKU1T/yuLtj6kADbDrY/T6ApnBxF5ajD 6h6Q5UebLHX3p/ks8Kz4V+/hqHXjjWfqy9x16909n2TSwjuGeszqaNrQYjF3lwqt J04E3kWavzyHK5Gr4ZwuS/lLoTNfvWHLRY8GoySL6Wt2agLskbDTgqBoe1NptbT+ siyOCEMFaWC7g5dhzdAusTzHUUJnnLbZzypb1581Ie42A4un+x3F7epktk462WKl uXmc5Big8aODwsVuMd+foFkOD0JKmK8RcfT8W0WciRAPycj5yq009wavogQ/7AEa Kweg3HIZMNU\xc8A2 -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Solution:
OSP 16.2.z Release - OSP Director Operator Containers
- Bugs fixed (https://bugzilla.redhat.com/):
2025995 - Rebase tech preview on latest upstream v1.2.x branch 2030801 - CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache 2036784 - osp controller (fencing enabled) in downed state after system manual crash test
- Bugs fixed (https://bugzilla.redhat.com/):
1983596 - CVE-2021-34558 golang: crypto/tls: certificate of wrong type is causing TLS client to panic 1992006 - CVE-2021-29923 golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet 1997017 - unprivileged client fails to get guest agent data 1998855 - Node drain: Sometimes source virt-launcher pod status is Failed and not Completed 2000251 - RoleBinding and ClusterRoleBinding brought in by kubevirt does not get reconciled when kind is ServiceAccount 2001270 - [VMIO] [Warm from Vmware] Snapshot files are not deleted after Successful Import 2001281 - [VMIO] [Warm from VMware] Source VM should not be turned ON if vmio import is removed 2001901 - [4.8.3] NNCP creation failures after nmstate-handler pod deletion 2007336 - 4.8.3 containers 2007776 - Failed to Migrate Windows VM with CDROM (readonly) 2008511 - [CNV-4.8.3] VMI is in LiveMigrate loop when Upgrading Cluster from 2.6.7/4.7.32 to OCP 4.8.13 2012890 - With descheduler during multiple VMIs migrations, some VMs are restarted 2025475 - [4.8.3] Upgrade from 2.6 to 4.x versions failed due to vlan-filtering issues 2026881 - [4.8.3] vlan-filtering is getting applied on veth ports
- Red Hat OpenShift Container Storage is highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Container Storage provides a multicloud data management service with an S3 compatible API.
Bug Fix(es):
-
Previously, when the namespace store target was deleted, no alert was sent to the namespace bucket because of an issue in calculating the namespace bucket health. With this update, the issue in calculating the namespace bucket health is fixed and alerts are triggered as expected. (BZ#1993873)
-
Previously, the Multicloud Object Gateway (MCG) components performed slowly and there was a lot of pressure on the MCG components due to non-optimized database queries. With this update the non-optimized database queries are fixed which reduces the compute resources and time taken for queries. Bugs fixed (https://bugzilla.redhat.com/):
1993873 - [4.8.z clone] Alert NooBaaNamespaceBucketErrorState is not triggered when namespacestore's target bucket is deleted 2006958 - CVE-2020-26301 nodejs-ssh2: Command injection by calling vulnerable method with untrusted input
- JIRA issues fixed (https://issues.jboss.org/):
TRACING-2235 - Release RHOSDT 2.1
- 9) - noarch
3
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202103-1001",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "glib",
"scope": "lt",
"trust": 1.0,
"vendor": "gnome",
"version": "2.66.8"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "33"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "9.0"
},
{
"model": "brocade fabric operating system",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": null
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-28153"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.66.8",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-28153"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "164850"
},
{
"db": "PACKETSTORM",
"id": "166308"
},
{
"db": "PACKETSTORM",
"id": "165135"
},
{
"db": "PACKETSTORM",
"id": "165096"
},
{
"db": "PACKETSTORM",
"id": "165862"
},
{
"db": "PACKETSTORM",
"id": "165758"
},
{
"db": "PACKETSTORM",
"id": "169850"
}
],
"trust": 0.7
},
"cve": "CVE-2021-28153",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-387564",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2021-28153",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202103-821",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-387564",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-387564"
},
{
"db": "CNNVD",
"id": "CNNVD-202103-821"
},
{
"db": "NVD",
"id": "CVE-2021-28153"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.). GNOME Glib is a multi-platform toolkit for creating graphical user interfaces, and is the underlying core library of GTK+ and GNOME projects. The vulnerability is caused by g_file_replace and G_FILE_CREATE_REPLACE_DESTINATION incorrectly creating the target of a symbolic link as an empty file. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Moderate: glib2 security and bug fix update\nAdvisory ID: RHSA-2021:4385-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://access.redhat.com/errata/RHSA-2021:4385\nIssue date: 2021-11-09\nCVE Names: CVE-2021-3800 CVE-2021-28153\n====================================================================\n1. Summary:\n\nAn update for glib2 is now available for Red Hat Enterprise Linux 8. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux CRB (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64\n\n3. Description:\n\nGLib provides the core application building blocks for libraries and\napplications written in C. It provides the core object system used in\nGNOME, the main loop implementation, and a large set of utility functions\nfor strings and common data structures. \n\nSecurity Fix(es):\n\n* glib2: Possible privilege escalation thourgh pkexec and aliases\n(CVE-2021-3800)\n\n* glib: g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION creates\nempty target for dangling symlink (CVE-2021-28153)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 8.5 Release Notes linked from the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1938284 - CVE-2021-3800 glib2: Possible privilege escalation thourgh pkexec and aliases\n1938291 - CVE-2021-28153 glib: g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION creates empty target for dangling symlink\n1948988 - Refcounting issue causes crashes and slow workarounds\n1971533 - MD5 HMAC computation should not cause glib to segfault in FIPS mode\n\n6. Package List:\n\nRed Hat Enterprise Linux BaseOS (v. 8):\n\nSource:\nglib2-2.56.4-156.el8.src.rpm\n\naarch64:\nglib2-2.56.4-156.el8.aarch64.rpm\nglib2-debuginfo-2.56.4-156.el8.aarch64.rpm\nglib2-debugsource-2.56.4-156.el8.aarch64.rpm\nglib2-devel-2.56.4-156.el8.aarch64.rpm\nglib2-devel-debuginfo-2.56.4-156.el8.aarch64.rpm\nglib2-fam-2.56.4-156.el8.aarch64.rpm\nglib2-fam-debuginfo-2.56.4-156.el8.aarch64.rpm\nglib2-tests-2.56.4-156.el8.aarch64.rpm\nglib2-tests-debuginfo-2.56.4-156.el8.aarch64.rpm\n\nppc64le:\nglib2-2.56.4-156.el8.ppc64le.rpm\nglib2-debuginfo-2.56.4-156.el8.ppc64le.rpm\nglib2-debugsource-2.56.4-156.el8.ppc64le.rpm\nglib2-devel-2.56.4-156.el8.ppc64le.rpm\nglib2-devel-debuginfo-2.56.4-156.el8.ppc64le.rpm\nglib2-fam-2.56.4-156.el8.ppc64le.rpm\nglib2-fam-debuginfo-2.56.4-156.el8.ppc64le.rpm\nglib2-tests-2.56.4-156.el8.ppc64le.rpm\nglib2-tests-debuginfo-2.56.4-156.el8.ppc64le.rpm\n\ns390x:\nglib2-2.56.4-156.el8.s390x.rpm\nglib2-debuginfo-2.56.4-156.el8.s390x.rpm\nglib2-debugsource-2.56.4-156.el8.s390x.rpm\nglib2-devel-2.56.4-156.el8.s390x.rpm\nglib2-devel-debuginfo-2.56.4-156.el8.s390x.rpm\nglib2-fam-2.56.4-156.el8.s390x.rpm\nglib2-fam-debuginfo-2.56.4-156.el8.s390x.rpm\nglib2-tests-2.56.4-156.el8.s390x.rpm\nglib2-tests-debuginfo-2.56.4-156.el8.s390x.rpm\n\nx86_64:\nglib2-2.56.4-156.el8.i686.rpm\nglib2-2.56.4-156.el8.x86_64.rpm\nglib2-debuginfo-2.56.4-156.el8.i686.rpm\nglib2-debuginfo-2.56.4-156.el8.x86_64.rpm\nglib2-debugsource-2.56.4-156.el8.i686.rpm\nglib2-debugsource-2.56.4-156.el8.x86_64.rpm\nglib2-devel-2.56.4-156.el8.i686.rpm\nglib2-devel-2.56.4-156.el8.x86_64.rpm\nglib2-devel-debuginfo-2.56.4-156.el8.i686.rpm\nglib2-devel-debuginfo-2.56.4-156.el8.x86_64.rpm\nglib2-fam-2.56.4-156.el8.x86_64.rpm\nglib2-fam-debuginfo-2.56.4-156.el8.i686.rpm\nglib2-fam-debuginfo-2.56.4-156.el8.x86_64.rpm\nglib2-tests-2.56.4-156.el8.x86_64.rpm\nglib2-tests-debuginfo-2.56.4-156.el8.i686.rpm\nglib2-tests-debuginfo-2.56.4-156.el8.x86_64.rpm\n\nRed Hat Enterprise Linux CRB (v. 8):\n\naarch64:\nglib2-debuginfo-2.56.4-156.el8.aarch64.rpm\nglib2-debugsource-2.56.4-156.el8.aarch64.rpm\nglib2-devel-debuginfo-2.56.4-156.el8.aarch64.rpm\nglib2-fam-debuginfo-2.56.4-156.el8.aarch64.rpm\nglib2-static-2.56.4-156.el8.aarch64.rpm\nglib2-tests-debuginfo-2.56.4-156.el8.aarch64.rpm\n\nnoarch:\nglib2-doc-2.56.4-156.el8.noarch.rpm\n\nppc64le:\nglib2-debuginfo-2.56.4-156.el8.ppc64le.rpm\nglib2-debugsource-2.56.4-156.el8.ppc64le.rpm\nglib2-devel-debuginfo-2.56.4-156.el8.ppc64le.rpm\nglib2-fam-debuginfo-2.56.4-156.el8.ppc64le.rpm\nglib2-static-2.56.4-156.el8.ppc64le.rpm\nglib2-tests-debuginfo-2.56.4-156.el8.ppc64le.rpm\n\ns390x:\nglib2-debuginfo-2.56.4-156.el8.s390x.rpm\nglib2-debugsource-2.56.4-156.el8.s390x.rpm\nglib2-devel-debuginfo-2.56.4-156.el8.s390x.rpm\nglib2-fam-debuginfo-2.56.4-156.el8.s390x.rpm\nglib2-static-2.56.4-156.el8.s390x.rpm\nglib2-tests-debuginfo-2.56.4-156.el8.s390x.rpm\n\nx86_64:\nglib2-debuginfo-2.56.4-156.el8.i686.rpm\nglib2-debuginfo-2.56.4-156.el8.x86_64.rpm\nglib2-debugsource-2.56.4-156.el8.i686.rpm\nglib2-debugsource-2.56.4-156.el8.x86_64.rpm\nglib2-devel-debuginfo-2.56.4-156.el8.i686.rpm\nglib2-devel-debuginfo-2.56.4-156.el8.x86_64.rpm\nglib2-fam-debuginfo-2.56.4-156.el8.i686.rpm\nglib2-fam-debuginfo-2.56.4-156.el8.x86_64.rpm\nglib2-static-2.56.4-156.el8.i686.rpm\nglib2-static-2.56.4-156.el8.x86_64.rpm\nglib2-tests-debuginfo-2.56.4-156.el8.i686.rpm\nglib2-tests-debuginfo-2.56.4-156.el8.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2021-3800\nhttps://access.redhat.com/security/cve/CVE-2021-28153\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2021 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYYrdwdzjgjWX9erEAQj1Ww//TA/kISfe8RjrOJ3//LZrFuwYWT/lYRvA\nazcyR6n+o/hSTHmAJ0ccc8y2SVdh/ukBI96cB8n4BKAYlZhbdXFm3btcItT8rpqP\nCc0z1SIhna+nm8Kdo4eDmjgMUm96E+uKq2bgmxduLWjYfKr/AB0n25nSn1o9sdAl\nF2iL6vlgmVtfGfa3ODovzIDwas7udIlaRzjnAmA9QSnnQUfZhvsBJbWcMJWJxej9\nSrT5lkwPXYJxyGuXN8MD+kfgwjyXS3G+Svv//YkBmuiYjqpQJghRe3YfHCeQ6ow6\nNlMOs2ZgNVIN8c03mhpZj6vUIr2qO7LcfUZaKCdIoTbVZKZY1yPkLxQ63EEB/AnP\n2pnAwybjS06Izr8JWjwGt/20+gsq1sGWKKU1T/yuLtj6kADbDrY/T6ApnBxF5ajD\n6h6Q5UebLHX3p/ks8Kz4V+/hqHXjjWfqy9x16909n2TSwjuGeszqaNrQYjF3lwqt\nJ04E3kWavzyHK5Gr4ZwuS/lLoTNfvWHLRY8GoySL6Wt2agLskbDTgqBoe1NptbT+\nsiyOCEMFaWC7g5dhzdAusTzHUUJnnLbZzypb1581Ie42A4un+x3F7epktk462WKl\nuXmc5Big8aODwsVuMd+foFkOD0JKmK8RcfT8W0WciRAPycj5yq009wavogQ/7AEa\nKweg3HIZMNU\\xc8A2\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. Solution:\n\nOSP 16.2.z Release - OSP Director Operator Containers\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n2025995 - Rebase tech preview on latest upstream v1.2.x branch\n2030801 - CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache\n2036784 - osp controller (fencing enabled) in downed state after system manual crash test\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1983596 - CVE-2021-34558 golang: crypto/tls: certificate of wrong type is causing TLS client to panic\n1992006 - CVE-2021-29923 golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet\n1997017 - unprivileged client fails to get guest agent data\n1998855 - Node drain: Sometimes source virt-launcher pod status is Failed and not Completed\n2000251 - RoleBinding and ClusterRoleBinding brought in by kubevirt does not get reconciled when kind is ServiceAccount\n2001270 - [VMIO] [Warm from Vmware] Snapshot files are not deleted after Successful Import\n2001281 - [VMIO] [Warm from VMware] Source VM should not be turned ON if vmio import is removed\n2001901 - [4.8.3] NNCP creation failures after nmstate-handler pod deletion\n2007336 - 4.8.3 containers\n2007776 - Failed to Migrate Windows VM with CDROM (readonly)\n2008511 - [CNV-4.8.3] VMI is in LiveMigrate loop when Upgrading Cluster from 2.6.7/4.7.32 to OCP 4.8.13\n2012890 - With descheduler during multiple VMIs migrations, some VMs are restarted\n2025475 - [4.8.3] Upgrade from 2.6 to 4.x versions failed due to vlan-filtering issues\n2026881 - [4.8.3] vlan-filtering is getting applied on veth ports\n\n5. \nRed Hat OpenShift Container Storage is highly scalable, production-grade\npersistent storage for stateful applications running in the Red Hat\nOpenShift Container Platform. In addition to persistent storage, Red Hat\nOpenShift Container Storage provides a multicloud data management service\nwith an S3 compatible API. \n\nBug Fix(es):\n\n* Previously, when the namespace store target was deleted, no alert was\nsent to the namespace bucket because of an issue in calculating the\nnamespace bucket health. With this update, the issue in calculating the\nnamespace bucket health is fixed and alerts are triggered as expected. \n(BZ#1993873)\n\n* Previously, the Multicloud Object Gateway (MCG) components performed\nslowly and there was a lot of pressure on the MCG components due to\nnon-optimized database queries. With this update the non-optimized\ndatabase queries are fixed which reduces the compute resources and time\ntaken for queries. Bugs fixed (https://bugzilla.redhat.com/):\n\n1993873 - [4.8.z clone] Alert NooBaaNamespaceBucketErrorState is not triggered when namespacestore\u0027s target bucket is deleted\n2006958 - CVE-2020-26301 nodejs-ssh2: Command injection by calling vulnerable method with untrusted input\n\n5. JIRA issues fixed (https://issues.jboss.org/):\n\nTRACING-2235 - Release RHOSDT 2.1\n\n6. 9) - noarch\n\n3",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-28153"
},
{
"db": "VULHUB",
"id": "VHN-387564"
},
{
"db": "PACKETSTORM",
"id": "164850"
},
{
"db": "PACKETSTORM",
"id": "166308"
},
{
"db": "PACKETSTORM",
"id": "165135"
},
{
"db": "PACKETSTORM",
"id": "165096"
},
{
"db": "PACKETSTORM",
"id": "165862"
},
{
"db": "PACKETSTORM",
"id": "165758"
},
{
"db": "PACKETSTORM",
"id": "169850"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-28153",
"trust": 2.4
},
{
"db": "PACKETSTORM",
"id": "165758",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "166308",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "164850",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "165862",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "163426",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "165129",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "161797",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "166489",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "166051",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "165002",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-202103-821",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "169850",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "166789",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.0912",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.6274",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.2809",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4059",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.0245",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.1071",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.0716",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4095",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4172",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.1677",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.0493",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4254",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.3905",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.0394",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.3935",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.1837",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4019",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.3773",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.4229",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021070711",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "166309",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-387564",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "165135",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "165096",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-387564"
},
{
"db": "PACKETSTORM",
"id": "164850"
},
{
"db": "PACKETSTORM",
"id": "166308"
},
{
"db": "PACKETSTORM",
"id": "165135"
},
{
"db": "PACKETSTORM",
"id": "165096"
},
{
"db": "PACKETSTORM",
"id": "165862"
},
{
"db": "PACKETSTORM",
"id": "165758"
},
{
"db": "PACKETSTORM",
"id": "169850"
},
{
"db": "CNNVD",
"id": "CNNVD-202103-821"
},
{
"db": "NVD",
"id": "CVE-2021-28153"
}
]
},
"id": "VAR-202103-1001",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-387564"
}
],
"trust": 0.725
},
"last_update_date": "2024-07-23T21:02:01.229000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "GNOME Glib Post-link vulnerability fixes",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=145465"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202103-821"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-59",
"trust": 1.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-387564"
},
{
"db": "NVD",
"id": "CVE-2021-28153"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://security.netapp.com/advisory/ntap-20210416-0003/"
},
{
"trust": 1.7,
"url": "https://security.gentoo.org/glsa/202107-13"
},
{
"trust": 1.7,
"url": "https://gitlab.gnome.org/gnome/glib/-/issues/2325"
},
{
"trust": 1.7,
"url": "https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html"
},
{
"trust": 1.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-28153"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6rxtd5hcp2k4aauswwztbkqnhrctaeof/"
},
{
"trust": 1.0,
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/icutqphznzwx2dzr46qflqzrhvmhiilj/"
},
{
"trust": 0.7,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/icutqphznzwx2dzr46qflqzrhvmhiilj/"
},
{
"trust": 0.7,
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6rxtd5hcp2k4aauswwztbkqnhrctaeof/"
},
{
"trust": 0.7,
"url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.7,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.7,
"url": "https://access.redhat.com/security/cve/cve-2021-28153"
},
{
"trust": 0.7,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.6,
"url": "https://access.redhat.com/security/cve/cve-2021-3800"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0245"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/161797/ubuntu-security-notice-usn-4764-1.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.2809"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.3905"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.1071"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.0912"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4019"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/163426/gentoo-linux-security-advisory-202107-13.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/165862/red-hat-security-advisory-2022-0434-05.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.6274"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021070711"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.3773"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0716"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/165129/red-hat-security-advisory-2021-4902-06.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/164850/red-hat-security-advisory-2021-4385-03.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/166489/red-hat-security-advisory-2022-1081-01.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/169850/red-hat-security-advisory-2022-8418-01.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0394"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.0493"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.3935"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4229"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/gnome-glib-file-corruption-via-g-file-replace-34853"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/165002/red-hat-security-advisory-2021-4032-01.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4059"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/166051/red-hat-security-advisory-2022-0580-01.html"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/166789/red-hat-security-advisory-2022-1396-01.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4254"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/165758/red-hat-security-advisory-2022-0318-06.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4095"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.4172"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.1837"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/166308/red-hat-security-advisory-2022-0842-01.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.1677"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2019-17595"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2019-19603"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-3445"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-13435"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-19603"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-42574"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-35942"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-14155"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-16135"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-3200"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-20231"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-22925"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2019-17594"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-20232"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-5827"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-24370"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2020-12762"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-36086"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2019-13750"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-18218"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-13750"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-20232"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-13751"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2019-20838"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-22898"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2019-18218"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-22876"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-3580"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-27645"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-33574"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-20231"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2020-13435"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-12762"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2020-14155"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2019-5827"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2020-16135"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-36084"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2020-24370"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-17595"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-17594"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-20838"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-36087"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-22925"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-22898"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-36085"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2019-13751"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-22876"
},
{
"trust": 0.5,
"url": "https://access.redhat.com/security/cve/cve-2021-33560"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/cve/cve-2021-3572"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-27645"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/cve/cve-2021-3426"
},
{
"trust": 0.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-20266"
},
{
"trust": 0.4,
"url": "https://access.redhat.com/security/cve/cve-2021-20266"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33560"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2021-3712"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3200"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3445"
},
{
"trust": 0.3,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33574"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2021-29923"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2021-3778"
},
{
"trust": 0.3,
"url": "https://access.redhat.com/security/cve/cve-2021-3796"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3426"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-23841"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-23840"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-29923"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3800"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:4385"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3984"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3521"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-4193"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-4122"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-44716"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2022-24407"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3572"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3872"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2022:0842"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-4019"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-4192"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3521"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-25648"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-36385"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-33938"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-34558"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-33930"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-43267"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-33928"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-0512"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-37750"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-22947"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-0512"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-22946"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-20673"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2018-20673"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3733"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-36385"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-20317"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-20317"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:4914"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-22947"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-25648"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-33929"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-36222"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3656"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-22946"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-28950"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2021:4845"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-20095"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-23841"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-28493"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-42771"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-26301"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-26301"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-28957"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-8037"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-8037"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-23840"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-20095"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-28493"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2022:0434"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3580"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-39293"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-38297"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index"
},
{
"trust": 0.1,
"url": "https://issues.jboss.org/):"
},
{
"trust": 0.1,
"url": "https://docs.openshift.com/container-platform/latest/distr_tracing/distr_tracing_install/distr-tracing-updating.html"
},
{
"trust": 0.1,
"url": "https://docs.openshift.com/container-platform/latest/distr_tracing/distributed-tracing-release-notes.html"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2022:0318"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-36221"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/updates/classification/#low"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2022:8418"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-387564"
},
{
"db": "PACKETSTORM",
"id": "164850"
},
{
"db": "PACKETSTORM",
"id": "166308"
},
{
"db": "PACKETSTORM",
"id": "165135"
},
{
"db": "PACKETSTORM",
"id": "165096"
},
{
"db": "PACKETSTORM",
"id": "165862"
},
{
"db": "PACKETSTORM",
"id": "165758"
},
{
"db": "PACKETSTORM",
"id": "169850"
},
{
"db": "CNNVD",
"id": "CNNVD-202103-821"
},
{
"db": "NVD",
"id": "CVE-2021-28153"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-387564"
},
{
"db": "PACKETSTORM",
"id": "164850"
},
{
"db": "PACKETSTORM",
"id": "166308"
},
{
"db": "PACKETSTORM",
"id": "165135"
},
{
"db": "PACKETSTORM",
"id": "165096"
},
{
"db": "PACKETSTORM",
"id": "165862"
},
{
"db": "PACKETSTORM",
"id": "165758"
},
{
"db": "PACKETSTORM",
"id": "169850"
},
{
"db": "CNNVD",
"id": "CNNVD-202103-821"
},
{
"db": "NVD",
"id": "CVE-2021-28153"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-03-11T00:00:00",
"db": "VULHUB",
"id": "VHN-387564"
},
{
"date": "2021-11-10T17:06:46",
"db": "PACKETSTORM",
"id": "164850"
},
{
"date": "2022-03-15T15:41:45",
"db": "PACKETSTORM",
"id": "166308"
},
{
"date": "2021-12-03T16:41:45",
"db": "PACKETSTORM",
"id": "165135"
},
{
"date": "2021-11-29T18:12:32",
"db": "PACKETSTORM",
"id": "165096"
},
{
"date": "2022-02-04T17:26:39",
"db": "PACKETSTORM",
"id": "165862"
},
{
"date": "2022-01-28T14:33:13",
"db": "PACKETSTORM",
"id": "165758"
},
{
"date": "2022-11-15T16:41:21",
"db": "PACKETSTORM",
"id": "169850"
},
{
"date": "2021-03-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202103-821"
},
{
"date": "2021-03-11T22:15:12.777000",
"db": "NVD",
"id": "CVE-2021-28153"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-02-03T00:00:00",
"db": "VULHUB",
"id": "VHN-387564"
},
{
"date": "2022-12-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202103-821"
},
{
"date": "2023-11-07T03:32:04.533000",
"db": "NVD",
"id": "CVE-2021-28153"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202103-821"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GNOME Glib Post link vulnerability",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202103-821"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "post link",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202103-821"
}
],
"trust": 0.6
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.