New Red Hat Product Security OpenPGP key

Red Hat Product Security has transitioned from using its old 1024-bit DSA OpenPGP key to a new 4096-bit RSA OpenPGP key.This was done to improve the long-term security of our communications with our customers and also to meet current key[…]

Red Hat’s disclosure process

Last week, a vulnerability (CVE-2018-10892) that affected CRI-O, Buildah, Podman, and Docker was made public before some affected upstream projects were notified. We regret that this was not handled in a way that lives up to our own standards around[…]

Certificate Transparency and HTTPS

Google has announced that on April 30, 2018, Chrome will:“...require that all TLS server certificates issued after 30 April, 2018 be compliant with the Chromium CT Policy. After this date, when Chrome connects to a site serving a publicly-trusted certificate[…]

Security is from Mars, Developers are from Venus…...or ARE they?

It is a tale as old as time.Developers and security personnel view each other withsuspicion.The perception is that a vast gulf of understanding and ability lies between the two camps.“They can’t possibly understand what it is to do my job!”[…]

Kernel Stack Protector and BlueBorne

Today, a security issue called BlueBorne was disclosed, a vulnerability that could be used to attack sensitive systems via the Bluetooth protocol. Specifically, BlueBorne is a flaw where a remote (but physically quite close) attacker could get root on a[…]

Debian: DSA-5833-1: dpdk Security Advisory Updates

A buffer overflow was discovered in the vhost code of DPDK, a set of libraries for fast packet processing, which could result in denial of service or the execution of arbitrary code by malicious guests/containers.

Debian: DSA-5831-1: gst-plugins-base1.0 Security Advisory Updates

Multiple multiple vulnerabilities were discovered in plugins for the GStreamer media framework and its codecs and demuxers, which may result in denial of service or potentially the execution of arbitrary code if a malformed media file is opened.

Debian: DSA-5829-1: chromium Security Advisory Updates

Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure.

Debian: DSA-5827-1: proftpd-dfsg Security Advisory Updates

Brian Ristuccia discovered that in ProFTPD, a powerful modular FTP/SFTP/FTPS server, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.

Debian: DSA-5825-1: ceph Security Advisory Updates

Sage McTaggart discovered an authentication bypass in radosgw, the RADOS REST gateway of Ceph, a distributed storage and file system. For the stable distribution (bookworm), these problems have been fixed in

chromium -- multiple security fixes

gitea -- multiple vulnerabilities

gitea -- Fix misuse of PublicKeyCallback

forgejo -- multiple vulnerabilities

zeek -- potential DoS vulnerability