Red Hat Security Advisory 2022-6820-01 ≈ Packet Storm

Roger Wilco Alertes 6 octobre 2022 Affichages : 303

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

Red Hat Security Advisory 2022-6820-01^[6]: Authored by Red Hat ^[7] | Site access.redhat.com ^[8]; Red Hat Security Advisory 2022-6820-01 - Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target. Issues addressed include a denial of service vulnerability.; systems | linux ^[9], redhat ^[10]; advisories | CVE-2022-25857 ^[11]; SHA-256 | 606e7ef9a54b678919985503c7b7e45e37c281f511849e2c1aef24734c18fa81; Download ^[12] | Favorite ^[13] | View ^[14]

        -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================                   
Red Hat Security Advisory
Synopsis:          Moderate: prometheus-jmx-exporter security update
Advisory ID:       RHSA-2022:6820-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6820
Issue date:        2022-10-06
CVE Names:         CVE-2022-25857
====================================================================
1. Summary:
An update for prometheus-jmx-exporter is now available for Red Hat
Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - noarch
3. Description:
Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that
can be configured to scrape and expose MBeans of a JMX target.
Security Fix(es):
* snakeyaml: Denial of Service due to missing nested depth limitation for
collections (CVE-2022-25857)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
2126789 - CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections
6. Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
prometheus-jmx-exporter-0.12.0-8.el8_6.src.rpm
noarch:
prometheus-jmx-exporter-0.12.0-8.el8_6.noarch.rpm
prometheus-jmx-exporter-openjdk11-0.12.0-8.el8_6.noarch.rpm
These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2022-25857
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/security/cve/CVE-2022-25857
8. Contact:
The Red Hat security contact is <Cette adresse e-mail est protégée contre les robots spammeurs. Vous devez activer le JavaScript pour la visualiser.>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYz6YNdzjgjWX9erEAQh2uxAAowMbBjqOmms6hVpTMZu68GNx8uV+JM4P
UfyklEe3cs1A2ZmJAxfcw1YZ5QB3a7mQl1x+WjXPt1Nwyi1jNJyBTo1AFWTf6YUB
8ZNqdip5Lq82lkte7CvrubpebaTbHEQ7Ydiw2UVv5olBGdvPNGvVT5y8a98fJIQR
E4iWJ5dhE1EqA5KE88Rz03CrgGsCh56kDef+dy6iJwq65S9HZGLQt+nSgptcEhga
mNKxf4k0PWBW5P1hI7GuheUwOZkciRmvO4ieRGxxdvEdStA2QuXnMC4SefrmFCoC
fm+wNdUdDxc5me2gpWDG33oH/Z/NSoIvEACi2DS1xkHfgv/7Ao1TfQ9DtOcdbN1o
qmR6hT0xn3wtURfZw/ZDZfkuoYjNxbtarYjp3midVj4lWJU9dSrccqPP0vdWg+n9
PggDyIALqtKUGsNKTXv27yWDRxx+/7Wx/J2zdAhVR+7r229d7+3xMvwPHQ3rmBGy
eNm34HCA1iM78evJlU/FOzMJ8e1RJFPvnTUFPFUgb+aAA9LQFtM+DfJULFNmf8qK
BBI334wFBy9p1kAXar393QpXucQJd1zJ+IAb0RCQ7PcOlni5RlacvBDa9de31Ozn
aIP6b9K7scUBWgk7DwgmqrQYh51ykUpwafRGmuR5KCV1yiqpcAmHUYQF8lKl10Ne
2PRsxdbQXIY½j1
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
Cette adresse e-mail est protégée contre les robots spammeurs. Vous devez activer le JavaScript pour la visualiser.
https://listman.redhat.com/mailman/listinfo/rhsa-announce