Bug 2190092 (CVE-2023-2319) - CVE-2023-2319 pcs: webpack: Regression of CVE-2023-28154 fixes in the Red Hat Enterprise Linux
Summary: CVE-2023-2319 pcs: webpack: Regression of CVE-2023-28154 fixes in the Red Hat...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-2319
Deadline: 2023-05-09
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2179901
Blocks: 2177766
TreeView+ depends on / blocked
 
Reported: 2023-04-27 06:15 UTC by TEJ RATHI
Modified: 2023-05-09 19:45 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. The CVE-2023-2319 was assigned to that Red Hat specific security regression in Red Hat Enterprise Linux 9.2.
Clone Of:
Environment:
Last Closed: 2023-05-09 19:45:53 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:2652 0 None None None 2023-05-09 11:35:40 UTC

Description TEJ RATHI 2023-04-27 06:15:02 UTC
The Webpack flaw CVE-2023-28154 (bug 2179227) for PCS package was addressed in Red Hat Enterprise Linux 9 via erratum RHSA-2023:1591, released on Apr 04, 2023:

https://access.redhat.com/errata/RHSA-2023:1591

However, the fix for this issue was not included in the PCS updates released as part of Red Hat Enterprise Linux 9.2 GA erratum (RHBA-2023:2151), causing a security regression of previously released fix. A new CVE-ID CVE-2023-2319 was assigned for this security regression.

Note that this issue and CVE-ID is specific to the PCS packages as shipped with Red Hat Enterprise Linux and is not applicable to any upstream PCS version or PCS packages of any other vendor that are not directly based on Red Hat Enterprise Linux packages.

For more information about the original flaw, refer to the CVE page or bug linked above.

Comment 3 errata-xmlrpc 2023-05-09 11:35:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2652 https://access.redhat.com/errata/RHSA-2023:2652

Comment 4 Product Security DevOps Team 2023-05-09 19:45:51 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-2319


Note You need to log in before you can comment on or make changes to this bug.