RHSA-2021:4381: Security update for 7 packages

RHSA-2021:4381, released November 9, 2021, fixes 29 CVEs across 7 products. 5 of them are being exploited (CVE-2021-1789); 5 on CISA KEV. Patch Radar priority: Patch now.

Patch now5 on CISA KEV

CVEs closed

None rated Critical

Exploited

CVE-2021-1789

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.1398

96th percentile

Priority of the 29 CVEs

Patch now 5
                                Urgent 0
                                High 17
                                Routine 7

Fixed package versions

Product	Release	Fixed in
LibRaw	RHEL 8	0:0.19.5-3.el8
LibRaw-devel	RHEL 8	0:0.19.5-3.el8
gnome-autoar	RHEL 8	0:0.2.3-2.el8
webkit2gtk3	RHEL 8	0:2.32.3-2.el8
webkit2gtk3-devel	RHEL 8	0:2.32.3-2.el8
webkit2gtk3-jsc	RHEL 8	0:2.32.3-2.el8
webkit2gtk3-jsc-devel	RHEL 8	0:2.32.3-2.el8

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Patch now	CVE-2021-1789	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.1398	KEVExploited
Patch now	CVE-2021-1870	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	9.8	0.0771	KEVExploited
Patch now	CVE-2021-1871	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	9.8	0.0700	KEVExploited
Patch now	CVE-2021-30665	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0371	KEVExploited
Patch now	CVE-2021-30663	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0352	KEVExploited
High	CVE-2021-21779	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0292	None reported
High	CVE-2021-21806	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0284	None reported
High	CVE-2021-1844	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0238	None reported
High	CVE-2021-30799	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0226	None reported
High	CVE-2021-30795	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0222	None reported
High	CVE-2021-30734	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0202	None reported
High	CVE-2021-30797	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0187	None reported
High	CVE-2020-13558	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0186	None reported
High	CVE-2021-30749	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0168	None reported
High	CVE-2021-1788	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0168	None reported
High	CVE-2021-30758	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0166	None reported
High	CVE-2020-24870	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0163	None reported
High	CVE-2020-27918	iTunes: A use after free issue was addressed with improved memory management.	7.8	0.0143	None reported
High	CVE-2021-30720	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	9.3	0.0137	None reported
High	CVE-2021-21775	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.8	0.0127	None reported
High	CVE-2021-30744	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.1	0.0116	None reported
High	CVE-2021-30689	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	8.1	0.0110	None reported
Routine	CVE-2021-1799	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	6.5	0.0176	None reported
Routine	CVE-2021-30682	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	6.5	0.0167	None reported
Routine	CVE-2021-1801	gnome-autoar: GNOME is the default desktop environment of Red Hat Enterprise Linux. The following packages have been upgraded to a...	6.5	0.0152	None reported

Also fixes CVE-2021-1789

ELSA-2021-4381
LibRaw, LibRaw-devel, accountsservice and 54 more on ol 8
gir1.2-javascriptcoregtk-4.0 2.30.6-0ubuntu0.18.04.1
gir1.2-javascriptcoregtk-4.0 on Ubuntu 18.04.6 LTS (bionic)
gir1.2-javascriptcoregtk-4.0 2.30.6-0ubuntu0.20.04.1
gir1.2-javascriptcoregtk-4.0 on Ubuntu 20.04 LTS (focal)
gir1.2-webkit2-4.0 2.30.6-0ubuntu0.18.04.1
gir1.2-webkit2-4.0 on Ubuntu 18.04.6 LTS (bionic)
gir1.2-webkit2-4.0 2.30.6-0ubuntu0.20.04.1
gir1.2-webkit2-4.0 on Ubuntu 20.04 LTS (focal)
libjavascriptcoregtk-4.0-18 2.30.6-0ubuntu0.18.04.1
libjavascriptcoregtk-4.0-18 on Ubuntu 18.04.6 LTS (bionic)
libjavascriptcoregtk-4.0-18 2.30.6-0ubuntu0.20.04.1
libjavascriptcoregtk-4.0-18 on Ubuntu 20.04 LTS (focal)
libjavascriptcoregtk-4.0-bin 2.30.6-0ubuntu0.18.04.1
libjavascriptcoregtk-4.0-bin on Ubuntu 18.04.6 LTS (bionic)

Vendor advisory

https://access.redhat.com/errata/RHSA-2021:4381

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/rhsa-2021-4381">RHSA-2021:4381 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.