Ubuntu 6326 Published by

The following updates are available for Ubuntu Linux:

[USN-6667-1] Cpanel-JSON-XS vulnerability
[USN-6665-1] Unbound vulnerabilities
[USN-6668-1] python-openstackclient vulnerability
[USN-6666-1] libuv vulnerability
[USN-6651-2] Linux kernel vulnerabilities
[USN-6648-2] Linux kernel (Azure) vulnerabilities
[USN-6653-2] Linux kernel (AWS) vulnerabilities




[USN-6667-1] Cpanel-JSON-XS vulnerability


==========================================================================
Ubuntu Security Notice USN-6667-1
February 28, 2024

libcpanel-json-xs-perl vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Cpanel-JSON-XS could be made to crash or expose information if it
processed specially crafted data.

Software Description:
- libcpanel-json-xs-perl: module for fast and correct serialising to JSON

Details:

It was discovered that Cpanel-JSON-XS incorrectly decoded certain data. A
remote attacker could use this issue to cause Cpanel-JSON-XS to crash,
resulting in a denial of service, or possibly obtain sensitive information.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
libcpanel-json-xs-perl 4.27-1ubuntu0.1

Ubuntu 20.04 LTS:
libcpanel-json-xs-perl 4.19-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6667-1
CVE-2022-48623

Package Information:
https://launchpad.net/ubuntu/+source/libcpanel-json-xs-perl/4.27-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libcpanel-json-xs-perl/4.19-1ubuntu0.1



[USN-6665-1] Unbound vulnerabilities


==========================================================================
Ubuntu Security Notice USN-6665-1
February 28, 2024

unbound vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in Unbound.

Software Description:
- unbound: validating, recursive, caching DNS resolver

Details:

Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Unbound incorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Unbound to consume
resources, leading to a denial of service. (CVE-2023-50387)

It was discovered that Unbound incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Unbound to consume resources, leading to a denial of service.
(CVE-2023-50868)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
libunbound8 1.17.1-2ubuntu0.1
unbound 1.17.1-2ubuntu0.1

Ubuntu 22.04 LTS:
libunbound8 1.13.1-1ubuntu5.4
unbound 1.13.1-1ubuntu5.4

Ubuntu 20.04 LTS:
libunbound8 1.9.4-2ubuntu1.5
unbound 1.9.4-2ubuntu1.5

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6665-1
CVE-2023-50387, CVE-2023-50868

Package Information:
https://launchpad.net/ubuntu/+source/unbound/1.17.1-2ubuntu0.1
https://launchpad.net/ubuntu/+source/unbound/1.13.1-1ubuntu5.4
https://launchpad.net/ubuntu/+source/unbound/1.9.4-2ubuntu1.5



[USN-6668-1] python-openstackclient vulnerability


==========================================================================
Ubuntu Security Notice USN-6668-1
February 28, 2024

python-openstackclient vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

python-openstackclient could delete incorrect access rules.

Software Description:
- python-openstackclient: OpenStack Command-line Client

Details:

It was discovered that when python-openstackclient attempted to delete a
non-existing access rule, it would delete another existing access rule
instead, contrary to expectations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
python3-openstackclient 5.8.0-0ubuntu1.1

Ubuntu 20.04 LTS:
python3-openstackclient 5.2.0-0ubuntu1.20.04.2

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6668-1
CVE-2023-6110

Package Information:
https://launchpad.net/ubuntu/+source/python-openstackclient/5.8.0-0ubuntu1.1

https://launchpad.net/ubuntu/+source/python-openstackclient/5.2.0-0ubuntu1.20.04.2



[USN-6666-1] libuv vulnerability


==========================================================================
Ubuntu Security Notice USN-6666-1
February 28, 2024

libuv1 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

libuv could be made to truncate certain hostnames.

Software Description:
- libuv1: asynchronous event notification library

Details:

It was discovered that libuv incorrectly truncated certain hostnames. A
remote attacker could possibly use this issue with specially crafted
hostnames to bypass certain checks.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
libuv1 1.44.2-1ubuntu0.1

Ubuntu 22.04 LTS:
libuv1 1.43.0-1ubuntu0.1

Ubuntu 20.04 LTS:
libuv1 1.34.2-1ubuntu1.5

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6666-1
CVE-2024-24806

Package Information:
https://launchpad.net/ubuntu/+source/libuv1/1.44.2-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libuv1/1.43.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libuv1/1.34.2-1ubuntu1.5



[USN-6651-2] Linux kernel vulnerabilities


==========================================================================
Ubuntu Security Notice USN-6651-2
February 28, 2024

linux-lowlatency, linux-lowlatency-hwe-6.5, linux-oem-6.5 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux-lowlatency: Linux low latency kernel
- linux-lowlatency-hwe-6.5: Linux low latency kernel
- linux-oem-6.5: Linux kernel for OEM systems

Details:

It was discovered that a race condition existed in the ATM (Asynchronous
Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51780)

It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)

Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)

Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)

Jann Horn discovered that the io_uring subsystem in the Linux kernel did
not properly handle the release of certain buffer rings. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2024-0582)

Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
linux-image-6.5.0-21-lowlatency 6.5.0-21.21.1
linux-image-6.5.0-21-lowlatency-64k 6.5.0-21.21.1
linux-image-lowlatency 6.5.0.21.21.15
linux-image-lowlatency-64k 6.5.0.21.21.15

Ubuntu 22.04 LTS:
linux-image-6.5.0-1015-oem 6.5.0-1015.16
linux-image-6.5.0-21-lowlatency 6.5.0-21.21.1~22.04.1
linux-image-6.5.0-21-lowlatency-64k 6.5.0-21.21.1~22.04.1
linux-image-lowlatency-64k-hwe-22.04 6.5.0.21.21.1~22.04.7
linux-image-lowlatency-hwe-22.04 6.5.0.21.21.1~22.04.7
linux-image-oem-22.04d 6.5.0.1015.17

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://ubuntu.com/security/notices/USN-6651-2
https://ubuntu.com/security/notices/USN-6651-1
CVE-2023-51780, CVE-2023-51781, CVE-2023-6915, CVE-2024-0565,
CVE-2024-0582, CVE-2024-0646

Package Information:
https://launchpad.net/ubuntu/+source/linux-lowlatency/6.5.0-21.21.1

https://launchpad.net/ubuntu/+source/linux-lowlatency-hwe-6.5/6.5.0-21.21.1~22.04.1
https://launchpad.net/ubuntu/+source/linux-oem-6.5/6.5.0-1015.16



[USN-6648-2] Linux kernel (Azure) vulnerabilities


==========================================================================
Ubuntu Security Notice USN-6648-2
February 28, 2024

linux-azure, linux-azure-5.4 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-azure-5.4: Linux kernel for Microsoft Azure cloud systems

Details:

It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)

Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)

Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)

Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
linux-image-5.4.0-1124-azure 5.4.0-1124.131
linux-image-azure-lts-20.04 5.4.0.1124.117

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
linux-image-5.4.0-1124-azure 5.4.0-1124.131~18.04.1
linux-image-azure 5.4.0.1124.97

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://ubuntu.com/security/notices/USN-6648-2
https://ubuntu.com/security/notices/USN-6648-1
CVE-2023-51781, CVE-2023-6915, CVE-2024-0565, CVE-2024-0646

Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/5.4.0-1124.131



[USN-6653-2] Linux kernel (AWS) vulnerabilities


==========================================================================
Ubuntu Security Notice USN-6653-2
February 28, 2024

linux-aws, linux-aws-5.15 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-aws-5.15: Linux kernel for Amazon Web Services (AWS) systems

Details:

It was discovered that a race condition existed in the ATM (Asynchronous
Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51780)

It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)

Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)

Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)

Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
linux-image-5.15.0-1055-aws 5.15.0-1055.60
linux-image-aws-lts-22.04 5.15.0.1055.54

Ubuntu 20.04 LTS:
linux-image-5.15.0-1055-aws 5.15.0-1055.60~20.04.1
linux-image-aws 5.15.0.1055.60~20.04.42

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://ubuntu.com/security/notices/USN-6653-2
https://ubuntu.com/security/notices/USN-6653-1
CVE-2023-51780, CVE-2023-51781, CVE-2023-6915, CVE-2024-0565,
CVE-2024-0646

Package Information:
https://launchpad.net/ubuntu/+source/linux-aws/5.15.0-1055.60
https://launchpad.net/ubuntu/+source/linux-aws-5.15/5.15.0-1055.60~20.04.1