-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.4153
                    lldpad security and bug fix update
                              6 November 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           lldpad
Publisher:         Red Hat
Operating System:  Red Hat Enterprise Linux Server 8
                   Red Hat Enterprise Linux WS/Desktop 8
                   Linux variants
Impact/Access:     Unauthorised Access -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-10932  

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2019:3673

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Red Hat. It is recommended that administrators
         running lldpad check for an updated version of the software for 
         their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Low: lldpad security and bug fix update
Advisory ID:       RHSA-2019:3673-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:3673
Issue date:        2019-11-05
CVE Names:         CVE-2018-10932 
=====================================================================

1. Summary:

An update for lldpad is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

The lldpad packages provide the Linux user space daemon and configuration
tool for Intel's Link Layer Discovery Protocol (LLDP) Agent with Enhanced
Ethernet support.

Security Fix(es):

* lldptool: improper sanitization of shell-escape codes (CVE-2018-10932)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.1 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1614896 - CVE-2018-10932 lldptool: improper sanitization of shell-escape codes
1727326 - lldpad memory usage increases over time

6. Package List:

Red Hat Enterprise Linux BaseOS (v. 8):

Source:
lldpad-1.0.1-13.git036e314.el8.src.rpm

aarch64:
lldpad-1.0.1-13.git036e314.el8.aarch64.rpm
lldpad-debuginfo-1.0.1-13.git036e314.el8.aarch64.rpm
lldpad-debugsource-1.0.1-13.git036e314.el8.aarch64.rpm

ppc64le:
lldpad-1.0.1-13.git036e314.el8.ppc64le.rpm
lldpad-debuginfo-1.0.1-13.git036e314.el8.ppc64le.rpm
lldpad-debugsource-1.0.1-13.git036e314.el8.ppc64le.rpm

s390x:
lldpad-1.0.1-13.git036e314.el8.s390x.rpm
lldpad-debuginfo-1.0.1-13.git036e314.el8.s390x.rpm
lldpad-debugsource-1.0.1-13.git036e314.el8.s390x.rpm

x86_64:
lldpad-1.0.1-13.git036e314.el8.i686.rpm
lldpad-1.0.1-13.git036e314.el8.x86_64.rpm
lldpad-debuginfo-1.0.1-13.git036e314.el8.i686.rpm
lldpad-debuginfo-1.0.1-13.git036e314.el8.x86_64.rpm
lldpad-debugsource-1.0.1-13.git036e314.el8.i686.rpm
lldpad-debugsource-1.0.1-13.git036e314.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-10932
https://access.redhat.com/security/updates/classification/#low
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXcHqL9zjgjWX9erEAQg8uxAAp1sXX7k616voF4T1ESaLw/2xgwVpXcFA
rssf0zsmwNH4Ckt/ehyTMTyeE2b0pEZajfQDLfP5u6Baz6YHJr3/gnDG8/ffHJZ5
alvJGBoWPTtgVvcmC/T8++eUyMQ9KmpG1SX6sUiIvTbxNVGAe8eYEWmEv3cOVNo9
fClotoOCiOc+T18xqHfBiUybFuqYYnApzb/UH5R0LEY5hND76PKaijrnNhw+vLe8
KOnfFu3h79IAfAFbSfj62LTKLNnScHtzNB5N0dlmt/UzyTX0yRZLD4ISqq4j6a7H
svOTOb7w2PefY+pIN/nwooR2rcD9w98N7KmH2q+8euzE2x9BeuoEgBLe7hH40dSo
P8siGfzIGhnw1xNdF/8VgUlow0HFRfNXycxVYtTJCwcPczrUFJr0NeaQ9ATwdToI
N14/JjJ/dpLGoTboUAub2Nhgx3Y4PJEKqnNHfA0hC/0YJ6VHHtbXAmKFiHmZGiNz
LwAUMQYQ4BcOU0eIy1y55rDy4drAmf1QI+QXq7A0Ax8e8uCxAVcjkoeYbS1ecl1V
fbC9wtM5Ev/OMWt1nEJfsScDeqIUZKpOYk2nYPVB2EoDzyzlPKJKiv8T1Eu9brY3
WcffJxHFd2JhPvrxEj9YfCZK4Zk7UEN0swQMEURknKgbSEyaU79mnU6Qlk8DNSJ4
KxLsAQumMR8=
=tsSa
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXcJLVWaOgq3Tt24GAQibIhAAhJMtgENnh0UlrucniD9et3Z4voO+sBlG
wCHYdNv4SJwd5gw2/R/opMe3ZmLBIx5m1KfdmMbEcQhJZ7POsdKkVS6mQw8K114N
bXfqPsqzFh1HnC/O0MaNvRUNJBU/Spg6E2whWPE1BPltNizeFiOv5PS8Lr3R2Xab
rUUQ5+SiyFIltxN3OVmtdYIDDs4ehHZnXQ2gbZV2ITJWwsvK9aKbSnduzf7UH8ZQ
PpKKJSTz9/BfRQ++LEfOJM8/NOcb9RKd1AjyZXP9eB7Wqk9jVQ1k24IxBOaOSDu/
MRieuPB1zaBjChzYCN+TLH3gQgo3Jk86GvOX6ZJuF1IWfoJOXI1zaD88jmxbJFZ/
jqCVZltDYZd3a37Gq9ntdkWVntH2kuVKQ5j0LazS27+7+K5dApkBWqNlAI4wmDjz
Z56bCMgdMUzdHqWTyl/TcyHPgvpcXeh0G0ulAUgJeE/SNlUiMM8a5s4T6RC+7Cdq
ZdZkIvmhYhi06i82zgZSVOna9GE7bxVkq5P0m3yJ53ulyh0c7upVEl7ka962sDzg
ZDw2xvr4CmsDom/zcK2s0mYb+VWXLVix7JuT+a1I0vDRnpzjRggw0qbKCpjM7D6s
Ejr3xFf6Dkir+kNvoJVVlxR53hQf3N1VBe+UOv2vkmKVB78Qp4EvWhMuvbpMb67+
Q8zSp+RJhDE=
=uphC
-----END PGP SIGNATURE-----