Important: mysql:8.0 security, bug fix, and enhancement update

mysql:8.0 security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql (8.0.32). (BZ#2177734, BZ#2177735, BZ#2177736) Security Fix(es): * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2023) (CVE-2023-21912) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21594) * mysql: Server: Stored Procedure unspecified vulnerability (CPU Oct 2022) (CVE-2022-21599) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21604) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21608) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21611) * mysql: Server: Connection Handling unspecified vulnerability (CPU Oct 2022) (CVE-2022-21617) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21625) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Oct 2022) (CVE-2022-21632) * mysql: Server: Replication unspecified vulnerability (CPU Oct 2022) (CVE-2022-21633) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21637) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21640) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39400) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39408) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39410) * mysql: Server: DML unspecified vulnerability (CPU Jan 2023) (CVE-2023-21836) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21863) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21864) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21865) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21867) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21868) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21869) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21870) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21871) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21873) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2023) (CVE-2023-21875) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21876) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21877) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21878) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21879) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21880) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21881) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21883) * mysql: Server: GIS unspecified vulnerability (CPU Jan 2023) (CVE-2023-21887) * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21917) * mysql: Server: Thread Pooling unspecified vulnerability (CPU Jan 2023) (CVE-2023-21874) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21882) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * AlmaLinux8 AppStream and Devel channels missing mecab-devel rpm (BZ#2180411) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-devel-rpms__8_8_default mecab-devel-0.996-2.module_el8.6.0+3340+d764b636.s390x.rpm 95fbafd6a495d411511dcfabd6b0f0746e44e7a7bcc70330024e0022229ee5d3 ALSA-2023:6933 Moderate: libreoffice security update Copyright 2023 AlmaLinux OS 0 1 Moderate

libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * libreoffice: Empty entry in Java class path (CVE-2022-38745) * libreoffice: Array index underflow in Calc formula parsing (CVE-2023-0950) * libreoffice: Arbitrary file write (CVE-2023-1183) * libreoffice: Remote documents loaded without prompt via IFrame (CVE-2023-2255) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-devel-rpms__8_9_default autocorr-fa-6.4.7.2-15.el8.alma.noarch.rpm 05c485654a9e6d8c693a65dab2989c957a611f1361fbf17e6639fa143ed4ec8f autocorr-vi-6.4.7.2-15.el8.alma.noarch.rpm 076af5a9bbf6064ee7312be5ee950d47c77a1905bb85bb849181998052fce1c8 autocorr-da-6.4.7.2-15.el8.alma.noarch.rpm 0adf59db893ce7b72e90abcc581824b3582a40157b0b5c11d02192ba9eabe31b autocorr-ru-6.4.7.2-15.el8.alma.noarch.rpm 1275ba47144db64a7e7332dc7e894b2726811868bbc0913f7d9170536bb77385 autocorr-bg-6.4.7.2-15.el8.alma.noarch.rpm 144cf03a3aef2d67489581707a82098a3c6f1775a2b444b2afac11208aeb35b5 autocorr-sl-6.4.7.2-15.el8.alma.noarch.rpm 1775041fb319349324feebbb79dd8336a85e0c9d754e90cb4a29838fb8faf8a3 autocorr-tr-6.4.7.2-15.el8.alma.noarch.rpm 1a2b41a223dca97680acd5fc078fbfcca55c9038603a8bbeaa9341fa559b093b autocorr-nl-6.4.7.2-15.el8.alma.noarch.rpm 1bc1b616c65a2a062536bc75a94971e399326aa6274a19521b3ba29c5118da5c autocorr-zh-6.4.7.2-15.el8.alma.noarch.rpm 346f3bcf817ea5d5a481114561a06660b797a62f9367f5332705edda93e57e00 autocorr-de-6.4.7.2-15.el8.alma.noarch.rpm 4d1622dcd4ad1a4ed0a8a234182f4a5b9bbd30436f5d754bd51edb2e2140dd00 autocorr-pt-6.4.7.2-15.el8.alma.noarch.rpm 51a16404c173d1e98e4f0d059dd747368c94a5a5eb482d3f69bc2f0d8699aa1f autocorr-ro-6.4.7.2-15.el8.alma.noarch.rpm 53665faace477ae56bb2d0126d1fc94e3968bd8517c6c48b4502798c4c1fd3b7 autocorr-sr-6.4.7.2-15.el8.alma.noarch.rpm 54bf74535e662b640e3e61f86884cd456089cb69cb87efe9a65075319e872f7d autocorr-sk-6.4.7.2-15.el8.alma.noarch.rpm 5f3734364590ef0c9410daf9efb92706f1f919ffcb183a5de0558b7b22efebec autocorr-es-6.4.7.2-15.el8.alma.noarch.rpm 6634973546248c23236deb56abd650a35b927c3b0dc8a63d21071e48abeed556 autocorr-ko-6.4.7.2-15.el8.alma.noarch.rpm 66efe34b10f28a99a3691e891bf2f065a6208fff9be422a74d58db700a9c865b autocorr-lt-6.4.7.2-15.el8.alma.noarch.rpm 7fc1704cff662fa1033bde79bfeaefe56bc97e5dc9c98998fe7c978d90339650 autocorr-pl-6.4.7.2-15.el8.alma.noarch.rpm 8eef7b6596ae389d795eee94da2327a850fe2c5873b8f393c973b7f7ed97ddce autocorr-hu-6.4.7.2-15.el8.alma.noarch.rpm a88a28cff495a3189acc3e8a50134bca74fe15ae3f6f79176b67fa2eae61413d autocorr-lb-6.4.7.2-15.el8.alma.noarch.rpm b026cb8a830eb6ea12a2d9ff845ee169e4d6e4d3511e012d3ed367ef52ae3faf autocorr-it-6.4.7.2-15.el8.alma.noarch.rpm b088dde35f30aad9eeb05653ca021cd75388572ba5e501b987592e2a8f754ff1 autocorr-ga-6.4.7.2-15.el8.alma.noarch.rpm b0965ea54887ddcec9bb8f2375e954626ad0a0c9a629946fb514d52094740dd1 autocorr-ca-6.4.7.2-15.el8.alma.noarch.rpm c7c58489bc9d01a1c1e7077814d842079eefe94061ba808287a848b633a3dee0 autocorr-is-6.4.7.2-15.el8.alma.noarch.rpm cd8a972dfb6807858340f938f261bff2fa8e0a5b7c12da795f264dad1268ca8f autocorr-mn-6.4.7.2-15.el8.alma.noarch.rpm ce1933a0612f7ee60921f68ce9903e846f443b17d36f8357c6eddfaf2dca56be autocorr-hr-6.4.7.2-15.el8.alma.noarch.rpm ceaaa49abc6d7c4f03db8d45c38430d9b19d900a4ce44085a51aac9e9415149f autocorr-cs-6.4.7.2-15.el8.alma.noarch.rpm deb7f3e5eaf1c78bbca7a1e1b7532b52776c8c66e97bbdb9e290c99501ea51b2 autocorr-sv-6.4.7.2-15.el8.alma.noarch.rpm e2f818f472d654b83cb82b0895f0e60cd049b2380afc1de1f5c9ce42e7ed1f34 autocorr-ja-6.4.7.2-15.el8.alma.noarch.rpm e4fb18d0ff6defc65468a25b78be87f90b1f245dda72739c8b56d474e3bca2f1 autocorr-fi-6.4.7.2-15.el8.alma.noarch.rpm e8e203c377c73640f4fc15d794a5b888892e83b677bcc1e18dceb7d683dc04ca autocorr-fr-6.4.7.2-15.el8.alma.noarch.rpm f116a713532b1938651504ae5731005d84018acddb154f53326579664a1a04fa autocorr-af-6.4.7.2-15.el8.alma.noarch.rpm fe0147632856d65dca53495bb3af85d6cf3d95b1a6ba20829094925b24323104 ALSA-2024:0133 Moderate: fence-agents security update Copyright 2024 AlmaLinux OS 0 1 Moderate

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920) * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-devel-rpms__8_9_default fence-agents-zvm-4.2.1-121.el8_9.2.noarch.rpm 18353da3e67927a86700fe33e87ca2f57528b87a59adec0061228d0ca4bf49d7 ALSA-2024:0827 Important: .NET 8.0 security update Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

fence-agents security and bug fix update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803) * pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323) * jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-devel-rpms__8_9_default fence-agents-lpar-4.2.1-129.el8.noarch.rpm 136828317eba081b48657d31f951b44b0280d3ea3bfdd737a0e811ea398732ab fence-agents-aws-4.2.1-129.el8.noarch.rpm 4c6736c06d44a17575fd6f648aca2e1c2a2e820891c1654702a2f4a191dfa30e ALSA-2024:3345 Important: .NET 8.0 security update Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

dotnet8.0 security update

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.108 and .NET Runtime 8.0.8. Security Fix(es): * dotnet: Information disclosure vulnerability in TlsStream (CVE-2024-38167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * EMBARGOED CVE-2024-38167 dotnet8.0: Information disclosure vulnerability in TlsStream (CVE-2024-38167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-devel-rpms__8_10_default dotnet-runtime-dbg-8.0-8.0.8-1.el8_10.s390x.rpm 904ad6c6ff2b6a48022c3ad281aa532deb2e3c533c700c25d1f7f5a411405cb6 aspnetcore-runtime-dbg-8.0-8.0.8-1.el8_10.s390x.rpm 9105ca2ae980bbb8c6e6a76f759b3c680cbe652ebb99d4ddd06497473df89cfa dotnet-sdk-dbg-8.0-8.0.108-1.el8_10.s390x.rpm dabd6e222260ecc48a07b0cc266ced7553eb7288957832269f5172d5ac496fa7 ALSA-2024:6309 Moderate: fence-agents security update Copyright 2024 AlmaLinux OS 0 1 Moderate

fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891) * pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-devel-rpms__8_10_default fence-agents-lpar-4.2.1-129.el8_10.4.noarch.rpm 205135ff58c1d58c0b02beba0ac3663756dbc2b5d826f0bbf04919c400432431 fence-agents-aws-4.2.1-129.el8_10.4.noarch.rpm 56c91a605a010fe43299ecf2596888ed7d641c849997fd647ca3942cc420407d fence-agents-zvm-4.2.1-129.el8_10.4.noarch.rpm d17e0ee4261933fbac3765cb871589142a177e2c1805f0d717366387945f6002 ALSA-2024:7868 Important: .NET 8.0 security update Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.110 and .NET Runtime 8.0.10. Security Fix(es): * dotnet: kestrel: closing an HTTP/3 stream can cause a race condition and lead to remote code execution (CVE-2024-38229) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) * dotnet: kestrel: closing an HTTP/3 stream can cause a race condition and lead to remote code execution (CVE-2024-38229) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-devel-rpms__8_10_default dotnet-sdk-dbg-8.0-8.0.110-1.el8_10.s390x.rpm 403abf12b218454f40494d017afdbc0aef657bc9557df13a756006a1c78e4f36 aspnetcore-runtime-dbg-8.0-8.0.10-1.el8_10.s390x.rpm b0fbcffb0390aad67fdf8b5fdc13be48ea8666a30229056f12b158493693d0a2 dotnet-runtime-dbg-8.0-8.0.10-1.el8_10.s390x.rpm e4a660987e30f3898d2d79260e70944239faabdd3b9ebec3edb05f3469251ce1 ALSA-2025:0381 Important: .NET 8.0 security update Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.112 and .NET Runtime 8.0.1.12. Security Fix(es): * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172) * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173) * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173) * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176) * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-8-for-s390x-devel-rpms__8_10_default aspnetcore-runtime-dbg-8.0-8.0.12-1.el8_10.s390x.rpm 0f65ce2bf2ad4a950e464a494b3eb3b7a136797961b9b32dca56c2a14c46e206 dotnet-sdk-dbg-8.0-8.0.112-1.el8_10.s390x.rpm 86123e0553e9959abc19fb17a971d764e40f1b978a87f4ff80c00c2c7367fb0b dotnet-runtime-dbg-8.0-8.0.12-1.el8_10.s390x.rpm e3af14403912f94c3556e51871b2c12dbaa5e603590a1d121be86bc00901dce3