-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: ipmitool security update Advisory ID: RHSA-2020:2276-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:2276 Issue date: 2020-05-26 CVE Names: CVE-2020-5208 ==================================================================== 1. Summary: An update for ipmitool is now available for Red Hat Enterprise Linux 7.3 Advanced Update Support, Red Hat Enterprise Linux 7.3 Telco Extended Update Support, and Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 7.3) - x86_64 Red Hat Enterprise Linux Server E4S (v. 7.3) - ppc64le, x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 7.3) - noarch Red Hat Enterprise Linux Server Optional E4S (v. 7.3) - noarch Red Hat Enterprise Linux Server Optional TUS (v. 7.3) - noarch Red Hat Enterprise Linux Server TUS (v. 7.3) - x86_64 3. Description: The ipmitool packages contain a command-line utility for interfacing with devices that support the Intelligent Platform Management Interface (IPMI) specification. IPMI is an open standard for machine health, inventory, and remote power control. Security Fix(es): * ipmitool: Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c (CVE-2020-5208) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the IPMI event daemon (ipmievd) will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1798721 - CVE-2020-5208 ipmitool: Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c 6. Package List: Red Hat Enterprise Linux Server AUS (v. 7.3): Source: ipmitool-1.8.15-8.el7_3.src.rpm x86_64: ipmitool-1.8.15-8.el7_3.x86_64.rpm ipmitool-debuginfo-1.8.15-8.el7_3.x86_64.rpm Red Hat Enterprise Linux Server E4S (v. 7.3): Source: ipmitool-1.8.15-8.el7_3.src.rpm ppc64le: ipmitool-1.8.15-8.el7_3.ppc64le.rpm ipmitool-debuginfo-1.8.15-8.el7_3.ppc64le.rpm x86_64: ipmitool-1.8.15-8.el7_3.x86_64.rpm ipmitool-debuginfo-1.8.15-8.el7_3.x86_64.rpm Red Hat Enterprise Linux Server TUS (v. 7.3): Source: ipmitool-1.8.15-8.el7_3.src.rpm x86_64: ipmitool-1.8.15-8.el7_3.x86_64.rpm ipmitool-debuginfo-1.8.15-8.el7_3.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 7.3): noarch: bmc-snmp-proxy-1.8.15-8.el7_3.noarch.rpm exchange-bmc-os-info-1.8.15-8.el7_3.noarch.rpm Red Hat Enterprise Linux Server Optional E4S (v. 7.3): noarch: bmc-snmp-proxy-1.8.15-8.el7_3.noarch.rpm exchange-bmc-os-info-1.8.15-8.el7_3.noarch.rpm Red Hat Enterprise Linux Server Optional TUS (v. 7.3): noarch: bmc-snmp-proxy-1.8.15-8.el7_3.noarch.rpm exchange-bmc-os-info-1.8.15-8.el7_3.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-5208 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXszkLtzjgjWX9erEAQigxQ//fzB5UthRZ8UNIhLRwdql16JtsZuY53wn CI8Y/HcTzWU/Dv2u6jJrN2OU9sjJuVVsghIkZUAmp0RcqQzUJSIv4VeP+EYMbOgM rzuINZzKzq2y/E52yKzNlhQgYfySxrLw9ixhbTyV8xM+oxi/UsVu+ZvhDHU+1rEF my5zM3M6C1XvxGdE9Mr0kTQG0QzkA30h/QMaXgenS3o9NNk71+kFrXi+b7ONqJjl +ekZtCoiERS9Q4ycrNGQN53sVWu5eMFXzVve4YD+x3LXtnMXvYAf8y58g9XA7Oxc vFxqxSbbHwaoNqo9X5JpdoorAufdsVvIg4btPfoZaovONGRNsU7CrXwI3VLvB7RJ wwOjpoKENJUUa7q0qezkWoWuDvEegNb223aHOIZlceDnaWSKNTpfiKGCUUymjVgR TnQ6TSE3EqLqiAa6kex+t79AKIg6veuEPOS7uXe35vSzibrUH/xlrwAi/FKrKQmP nMk09Ve9u3AQVlKMhm97jLFKISHQ7xcDPj4Vl1R/q1JmwPl9lc/gH4Fhz3A1IWEt XdDoCjDT4yQieqq2OFXYHrVZRHtD1A1NUOU3ooAje1hT+qFRG5tPE4J4O09Z8n8Z qyZeTntg7RxEQrs3soJCybddaBIkCpVZoFBCUpeiVeZDVtFAbPyHghFCSoUo5P5x Bq6qQ+fGOm8=BleC -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce