Linux · Oracle Linux · Security advisory · November 18, 2023

ELSA-2023-6938: Security update for 32 packages

ELSA-2023-6938, released November 18, 2023, fixes 12 CVEs across 32 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
12
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0456
91st percentile

Priority of the 12 CVEs

Patch now 0 Urgent 0 High 12 Routine 0

Fixed package versions

ProductReleaseFixed in
aardvark-dnsol 82:1.0.1-38.0.1.module+el8.9.0+90044+a34bc939
buildahol 81:1.24.6-7.module+el8.9.0+90044+a34bc939
buildah-testsol 81:1.24.6-7.module+el8.9.0+90044+a34bc939
cockpit-podmanol 80:46-1.module+el8.9.0+90044+a34bc939
conmonol 82:2.1.4-2.module+el8.9.0+90044+a34bc939
container-selinuxol 82:2.205.0-3.module+el8.9.0+90044+a34bc939
containernetworking-pluginsol 81:1.1.1-5.module+el8.9.0+90044+a34bc939
containers-commonol 82:1-38.0.1.module+el8.9.0+90044+a34bc939
critol 80:3.15-3.module+el8.9.0+90044+a34bc939
criuol 80:3.15-3.module+el8.9.0+90044+a34bc939
criu-develol 80:3.15-3.module+el8.9.0+90044+a34bc939
criu-libsol 80:3.15-3.module+el8.9.0+90044+a34bc939
crunol 80:1.8.3-1.module+el8.9.0+90044+a34bc939
fuse-overlayfsol 80:1.9-2.module+el8.9.0+90044+a34bc939
libslirpol 80:4.4.0-1.module+el8.9.0+90044+a34bc939
libslirp-develol 80:4.4.0-1.module+el8.9.0+90044+a34bc939
netavarkol 82:1.0.1-38.0.1.module+el8.9.0+90044+a34bc939
oci-seccomp-bpf-hookol 80:1.2.5-2.module+el8.9.0+90044+a34bc939
podmanol 82:4.0.2-24.module+el8.9.0+90044+a34bc939
podman-catatonitol 82:4.0.2-24.module+el8.9.0+90044+a34bc939
podman-dockerol 82:4.0.2-24.module+el8.9.0+90044+a34bc939
podman-gvproxyol 82:4.0.2-24.module+el8.9.0+90044+a34bc939
podman-pluginsol 82:4.0.2-24.module+el8.9.0+90044+a34bc939
podman-remoteol 82:4.0.2-24.module+el8.9.0+90044+a34bc939
podman-testsol 82:4.0.2-24.module+el8.9.0+90044+a34bc939
python3-criuol 80:3.15-3.module+el8.9.0+90044+a34bc939
python3-podmanol 80:4.0.0-2.module+el8.9.0+90044+a34bc939
runcol 81:1.1.5-2.module+el8.9.0+90044+a34bc939
skopeool 82:1.6.2-8.module+el8.9.0+90044+a34bc939
skopeo-testsol 82:1.6.2-8.module+el8.9.0+90044+a34bc939
slirp4netnsol 80:1.1.8-3.module+el8.9.0+90044+a34bc939
udicaol 80:0.2.6-4.module+el8.9.0+90044+a34bc939

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2022-41723 golang-github-prometheus-prometheus: This update for golang-github-prometheus-prometheus fixes the following issues: - Require Go > 1.20 for building -...9.8 0.0456 None reported
High CVE-2023-24538 delve: Go Toolset provides the Go programming language tools and libraries9.8 0.0228 None reported
High CVE-2023-24534 delve: Go Toolset provides the Go programming language tools and libraries9.8 0.0189 None reported
High CVE-2022-3064 aardvark-dns: The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Se...9.8 0.0187 None reported
High CVE-2023-24540 delve: Go Toolset provides the Go programming language tools and libraries9.8 0.0156 None reported
High CVE-2023-24536 delve: Go Toolset provides the Go programming language tools and libraries9.8 0.0148 None reported
High CVE-2023-24537 golang-race: Go Toolset provides the Go programming language tools and libraries9.8 0.0141 None reported
High CVE-2022-41725 delve: Go Toolset provides the Go programming language tools and libraries9.8 0.0124 None reported
High CVE-2022-41724 delve: Go Toolset provides the Go programming language tools and libraries9.8 0.0111 None reported
High CVE-2023-24539 delve: Go Toolset provides the Go programming language tools and libraries9.8 0.0104 None reported
High CVE-2023-29400 delve: Go Toolset provides the Go programming language tools and libraries9.8 0.0104 None reported
High CVE-2023-3978 golang-github-prometheus-promu: This update fixes the following issues: golang-github-lusitaniae-apache_exporter: - Security issues fixed: * CVE...9.8 0.0085 None reported
Showing 1 to 12 of 12 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.