Linux · Security advisory · July 5, 2022

RLSA-2022:5498: libdb security update

RLSA-2022:5498, released July 5, 2022, fixes 27 CVEs in libdb (version 0:5.3.28-42.el8_4). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
27
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.4953
98th percentile

Priority of the 27 CVEs

Patch now 0 Urgent 1 High 11 Routine 15

Fixed package versions

ProductReleaseFixed in
libdbrocky 80:5.3.28-42.el8_4

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2022-28346 python-django: An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4 9.8 0.1866 None reported
High CVE-2022-23833 python-django: An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 7.5 0.4953 None reported
High CVE-2022-23837 ruby-sidekiq: In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the g... 7.5 0.0522 None reported
High CVE-2022-28347 python3-django: A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 be... 9.8 0.0294 None reported
High CVE-2021-43818 python39-urllib3: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, excepti... 8.8 0.0266 None reported
High CVE-2021-45115 python3-django: An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and4.0 before 4.0.1 7.5 0.0260 None reported
High CVE-2021-44420 python-django: In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines... 7.3 0.0242 None reported
High CVE-2021-45116 python3-django: An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and4.0 before 4.0.1 7.5 0.0198 None reported
High CVE-2021-33928 libsolv: The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security... 7.5 0.0147 None reported
High CVE-2021-33930 libsolv: The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security... 7.5 0.0146 None reported
High CVE-2021-33929 libsolv: The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security... 7.5 0.0144 None reported
High CVE-2021-33938 libsolv: The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security... 7.5 0.0142 None reported
Routine CVE-2021-21295 libnetty-java: Netty is an open-source, asynchronous event-driven network applicationframework for rapid development of maintainable... n/a 0.1889 None reported
Routine CVE-2021-21409 libnetty-java: Netty is an open-source, asynchronous event-driven network applicationframework for rapid development of maintainable... n/a 0.0494 None reported
Routine CVE-2021-42550 logback: In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files co... 6.6 0.0477 None reported
Routine CVE-2021-30151 ruby-sidekiq: ruby-sidekiq - security update n/a 0.0416 None reported
Routine CVE-2021-3584 libdb: Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based infrastructure n/a 0.0404 None reported
Routine CVE-2021-43797 libnetty-java: Netty is an asynchronous event-driven network application framework forrapid development of maintainable high perform... 6.5 0.0288 None reported
Routine CVE-2021-45452 python3-django: Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before4.0.1 allows directory traversal if crafte... 5.3 0.0259 None reported
Routine CVE-2021-32839 sqlparse: sqlparse - security update n/a 0.0234 None reported
Routine CVE-2022-23633 rails: Action Pack is a framework for handling and responding to web requests 5.9 0.0222 None reported
Routine CVE-2022-23634 puma: Puma is a Ruby/Rack web server built for parallelism 5.9 0.0211 None reported
Routine CVE-2021-21290 libnetty-java: Netty is an open-source, asynchronous event-driven network applicationframework for rapid development of maintainable... n/a 0.0180 None reported
Routine CVE-2021-44568 libsolv: Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable v... 6.5 0.0179 None reported
Routine CVE-2021-3200 libsolv: The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security... 3.3 0.0131 None reported
Showing 1 to 25 of 27 1Next