RHSA-2024:3823

Security

Issued at: 2024-06-11

Synopsis

Moderate: rpm-ostree security update

Description

The rpm-ostree tool binds together the RPM packaging model with the OSTree model of bootable file system trees. It provides commands that can be used both on client systems and on server-side composes. The rpm-ostree-client package provides commands for client systems to perform upgrades and rollbacks.

Security Fix(es):

* rpm-ostree: world-readable /etc/shadow file [9.4.z] (JIRA:RHEL-31852)

Affected products

Red Hat Enterprise Linux for ARM 64 - 9 Red Hat Enterprise Linux for IBM z Systems - 9 Red Hat Enterprise Linux for Power, little endian - 9 Red Hat Enterprise Linux for x86_64 - 9

Fixes

2271585

CVEs

CVE-2024-2905

Affected packages

rpm-ostree-0:2024.3-3.el9_4.aarch64 rpm-ostree-0:2024.3-3.el9_4.ppc64le rpm-ostree-0:2024.3-3.el9_4.s390x rpm-ostree-0:2024.3-3.el9_4.src rpm-ostree-0:2024.3-3.el9_4.x86_64 rpm-ostree-debuginfo-0:2024.3-3.el9_4.aarch64 rpm-ostree-debuginfo-0:2024.3-3.el9_4.i686 rpm-ostree-debuginfo-0:2024.3-3.el9_4.ppc64le rpm-ostree-debuginfo-0:2024.3-3.el9_4.s390x rpm-ostree-debuginfo-0:2024.3-3.el9_4.x86_64 rpm-ostree-debugsource-0:2024.3-3.el9_4.aarch64 rpm-ostree-debugsource-0:2024.3-3.el9_4.i686 rpm-ostree-debugsource-0:2024.3-3.el9_4.ppc64le rpm-ostree-debugsource-0:2024.3-3.el9_4.s390x rpm-ostree-debugsource-0:2024.3-3.el9_4.x86_64 rpm-ostree-libs-0:2024.3-3.el9_4.aarch64 rpm-ostree-libs-0:2024.3-3.el9_4.i686 rpm-ostree-libs-0:2024.3-3.el9_4.ppc64le rpm-ostree-libs-0:2024.3-3.el9_4.s390x rpm-ostree-libs-0:2024.3-3.el9_4.x86_64 rpm-ostree-libs-debuginfo-0:2024.3-3.el9_4.aarch64 rpm-ostree-libs-debuginfo-0:2024.3-3.el9_4.i686 rpm-ostree-libs-debuginfo-0:2024.3-3.el9_4.ppc64le rpm-ostree-libs-debuginfo-0:2024.3-3.el9_4.s390x rpm-ostree-libs-debuginfo-0:2024.3-3.el9_4.x86_64