Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.2963 procps-ng security and bug fix update 7 August 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: procps-ng Publisher: Red Hat Operating System: Red Hat Enterprise Linux Server 7 Red Hat Enterprise Linux WS/Desktop 7 Impact/Access: Increased Privileges -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2018-1122 Reference: ESB-2018.2456.3 ESB-2018.1562 Original Bulletin: https://access.redhat.com/errata/RHSA-2019:2189 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: procps-ng security and bug fix update Advisory ID: RHSA-2019:2189-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:2189 Issue date: 2019-08-06 CVE Names: CVE-2018-1122 ===================================================================== 1. Summary: An update for procps-ng is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: The procps-ng packages contain a set of system utilities that provide system information, including ps, free, skill, pkill, pgrep, snice, tload, top, uptime, vmstat, w, watch, and pwdx. Security Fix(es): * procps-ng, procps: Local privilege escalation in top (CVE-2018-1122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1575466 - CVE-2018-1122 procps-ng, procps: Local privilege escalation in top 1692843 - ps reports numerical CLS value of "#6" for SCHED_DEADLINE policy tasks instead of DLN 1699264 - Free output is wrong 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: procps-ng-3.3.10-26.el7.src.rpm x86_64: procps-ng-3.3.10-26.el7.i686.rpm procps-ng-3.3.10-26.el7.x86_64.rpm procps-ng-debuginfo-3.3.10-26.el7.i686.rpm procps-ng-debuginfo-3.3.10-26.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: procps-ng-debuginfo-3.3.10-26.el7.i686.rpm procps-ng-debuginfo-3.3.10-26.el7.x86_64.rpm procps-ng-devel-3.3.10-26.el7.i686.rpm procps-ng-devel-3.3.10-26.el7.x86_64.rpm procps-ng-i18n-3.3.10-26.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: procps-ng-3.3.10-26.el7.src.rpm x86_64: procps-ng-3.3.10-26.el7.i686.rpm procps-ng-3.3.10-26.el7.x86_64.rpm procps-ng-debuginfo-3.3.10-26.el7.i686.rpm procps-ng-debuginfo-3.3.10-26.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: procps-ng-debuginfo-3.3.10-26.el7.i686.rpm procps-ng-debuginfo-3.3.10-26.el7.x86_64.rpm procps-ng-devel-3.3.10-26.el7.i686.rpm procps-ng-devel-3.3.10-26.el7.x86_64.rpm procps-ng-i18n-3.3.10-26.el7.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: procps-ng-3.3.10-26.el7.src.rpm ppc64: procps-ng-3.3.10-26.el7.ppc.rpm procps-ng-3.3.10-26.el7.ppc64.rpm procps-ng-debuginfo-3.3.10-26.el7.ppc.rpm procps-ng-debuginfo-3.3.10-26.el7.ppc64.rpm ppc64le: procps-ng-3.3.10-26.el7.ppc64le.rpm procps-ng-debuginfo-3.3.10-26.el7.ppc64le.rpm s390x: procps-ng-3.3.10-26.el7.s390.rpm procps-ng-3.3.10-26.el7.s390x.rpm procps-ng-debuginfo-3.3.10-26.el7.s390.rpm procps-ng-debuginfo-3.3.10-26.el7.s390x.rpm x86_64: procps-ng-3.3.10-26.el7.i686.rpm procps-ng-3.3.10-26.el7.x86_64.rpm procps-ng-debuginfo-3.3.10-26.el7.i686.rpm procps-ng-debuginfo-3.3.10-26.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: procps-ng-debuginfo-3.3.10-26.el7.ppc.rpm procps-ng-debuginfo-3.3.10-26.el7.ppc64.rpm procps-ng-devel-3.3.10-26.el7.ppc.rpm procps-ng-devel-3.3.10-26.el7.ppc64.rpm procps-ng-i18n-3.3.10-26.el7.ppc64.rpm ppc64le: procps-ng-debuginfo-3.3.10-26.el7.ppc64le.rpm procps-ng-devel-3.3.10-26.el7.ppc64le.rpm procps-ng-i18n-3.3.10-26.el7.ppc64le.rpm s390x: procps-ng-debuginfo-3.3.10-26.el7.s390.rpm procps-ng-debuginfo-3.3.10-26.el7.s390x.rpm procps-ng-devel-3.3.10-26.el7.s390.rpm procps-ng-devel-3.3.10-26.el7.s390x.rpm procps-ng-i18n-3.3.10-26.el7.s390x.rpm x86_64: procps-ng-debuginfo-3.3.10-26.el7.i686.rpm procps-ng-debuginfo-3.3.10-26.el7.x86_64.rpm procps-ng-devel-3.3.10-26.el7.i686.rpm procps-ng-devel-3.3.10-26.el7.x86_64.rpm procps-ng-i18n-3.3.10-26.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: procps-ng-3.3.10-26.el7.src.rpm x86_64: procps-ng-3.3.10-26.el7.i686.rpm procps-ng-3.3.10-26.el7.x86_64.rpm procps-ng-debuginfo-3.3.10-26.el7.i686.rpm procps-ng-debuginfo-3.3.10-26.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: procps-ng-debuginfo-3.3.10-26.el7.i686.rpm procps-ng-debuginfo-3.3.10-26.el7.x86_64.rpm procps-ng-devel-3.3.10-26.el7.i686.rpm procps-ng-devel-3.3.10-26.el7.x86_64.rpm procps-ng-i18n-3.3.10-26.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-1122 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.7_Release_Notes/index.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXUl3HNzjgjWX9erEAQhuzA/+IHaEp9EtKY1INk2dCcZ22nhWaq3zf6VR TMQ8km75Z3XmJEPA1uWkW2RQAlZIb7XE4gAXrZs0B8sUtrlZ63ojmlUw5LzKmDEN PiBIkLzLJWTLHwM94CqtBMQ3C6VMBKU8PDpKaF2NEoFertZGoF1sv9oAMBx+G2n6 mMuQ2PjNK9pQk9oMvbXf7KLFSzL2aGo1cpHQht4cLTXyHfAwM8NAujTldFuhPNRo 7bGjrmTm5QCZCvDr9Phfa5v7heYl0Kh4Kjt6JbAW3nYZzSO8jrZ+hpd8vdSzay1s YDOzDYRPXOkEcmjjtRTALh2KCflKmt2EyNVDI0dDPgSulqg22JN7ooBkO6PVfjvG Q9hwGREn/cFyj4GpGiJj/ODiX/EkGj0udxVlhzfSRI3TSBOxDJpwiJdoA4JIyCGY FWWNraO0McgPsd90NPDhVfY4bV3RUHQJMSk9kBJ3bGnEdhbCP1vt7mrzGyg+mXhM kbnysKaXqWfMgC+bwd+eiA63thM15vARirQ71CSQwKVdrysaahfUtxSaEOVjaWYY 5WQ13wCowVhSBQDlu1CKIgVSuzasKkSWV/UmDgqZyzjkNEjarHbTsKjsOwfASzHQ ewegL3n+q+izImYpEPQLed7X/HZmAWN8jxanwpRAF6oeX+pdWNU7G+vNQ1Vrk10d Hm5lf8lAGWQ= =9bG+ - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXUpcOGaOgq3Tt24GAQgBKhAAhii0JPn6YYDjGy5qF5YpMnsmW7EgzkVy T30HunpUAq8TGOEY3vV3pwdF7RlRDOXpSgyECOW2rCqLPv1czZxCOKV2jikXO18O iBXwBrQQ1SNteQFsP6r5G0shbQ2jFLwif+rk2y7hFMAiZ1/SS4SrDZkhmUqR6QCU 2NfE61Sj/XzfvP4RbkGsS7D032iDMOKZj5b6q/aOYuZOG5a1EcowrkBkk5syFEqf MesXOqQIcFl0nMnq8BnXEE2L0Es7btuHzt/BficQnpbt2rZK3aWI9JvCP6W2Eouo lcFM3BpjKLPpf+eOIKEdaB1fIuSIa/Oq1FSXowrEyUxwowY5tvA36/LVAOo8WdXt YtZjn3p3ihJL3kUDzvpTv99i6XkZan81PFRem+bW2xXoionVbhkJ9zA9VdZkJP6U wUGL9N5r0XlfPi23+TaZF/xl2md8HFTU/K1UY/X7fHmgcAdRqHAbkOMjnn7RCLC2 f8Exs0kQF3M07TCdHcJSEdsUa2zbs8pDH3n4klSrP54DpfkuAiP546wCDTT+W3Kx +FnBIGdpye9vMq1V+71XUvKJr/dHwHniL50ONbISVSmrP4JTOfvpxsvBviG6pRVT 5DCmAgT5kT3ltj5SMxBV4+e7pioTP16rInouUpduTVBE7UXdtlOMmTsQQMLLmgct 2H8Zdp2Wniw= =oQlo -----END PGP SIGNATURE-----