SB2024061158 - Red Hat Enterprise Linux 8 update for resource-agents

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024061158

SB2024061158 - Red Hat Enterprise Linux 8 update for resource-agents

Published: June 11, 2024

Security Bulletin ID SB2024061158
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2023-45803)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to urllib3 does not remove the HTTP request body when redirecting HTTP response using status codes 301, 302, or 303, after the request had its method changed from one that could accept a request body (e.g. from POST to GET). A remote attacker can gain access to potentially sensitive information.


2) Observable discrepancy (CVE-ID: CVE-2023-52323)

The vulnerability allows a remote attacker to perform a side-channel attack.

The vulnerability exists due to observable discrepancy, which allows the side-channel leakage for OAEP decryption. A remote attacker can perform a Manger attack and gain access to sensitive information.


Remediation

Install update from vendor's website.

References