-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   
Red Hat Security Advisory

Synopsis:          Moderate: systemd security, bug fix, and enhancement update
Advisory ID:       RHSA-2021:1611-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:1611
Issue date:        2021-05-18
CVE Names:         CVE-2019-3842 CVE-2020-13776
====================================================================
1. Summary:

An update for systemd is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

The systemd packages contain systemd, a system and service manager for
Linux, compatible with the SysV and LSB init scripts. It provides
aggressive parallelism capabilities, uses socket and D-Bus activation for
starting services, offers on-demand starting of daemons, and keeps track of
processes using Linux cgroups. In addition, it supports snapshotting and
restoring of the system state, maintains mount and automount points, and
implements an elaborate transactional dependency-based service control
logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

* systemd: Spoofing of XDG_SEAT allows for actions to be checked against
"allow_active" instead of "allow_any" (CVE-2019-3842)

* systemd: Mishandles numerical usernames beginning with decimal digits or
0x followed by hexadecimal digits (CVE-2020-13776)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.4 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1668521 - CVE-2019-3842 systemd: Spoofing of XDG_SEAT allows for actions to be checked against "allow_active" instead of "allow_any"
1740657 - [RFE] NUMA aware CPU affinity setting in systemd unit files
1755287 - localectl set-locale should issue an error message when trying to set a nonexistent locale
1764282 - systemd[XXXXX]: Failed to connect to API bus: Connection refused
1812972 - backport request: allow instantiated units to be enabled via presets
1819868 - systemd excessively reads mountinfo and udev is dense OpenShift environments
1845534 - CVE-2020-13776 systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits
1862714 - LIBSYSTEMD_VERSION value format change crashes systemd-python pip install
1865840 - systemd-tmpfiles request for backport
1868831 - FreezerState is incorrectly updated on system running cgroup v1
1868877 - Enabling the smack feature on the host may cause the container to fail to start
1870638 - RFE:  Add an option to Socket units to clear the data before listening again
1871139 - [systemd] systemd-resolved.service:33: Unknown lvalue 'ProtectSystems' in section 'Service'
1880270 - "Failed to start user service, ignoring" when masking user@.service
1885553 - "systemd --user" can dump core upon session closing
1887181 - Backport PassPacketInfo= support into systemd of RHEL 8
1888912 - SELinux policy change not visible to systemd until daemon-reexec
1889996 - backport vconsole-setup: downgrade log message when setting font fails on dummy console

6. Package List:

Red Hat Enterprise Linux BaseOS (v. 8):

Source:
systemd-239-45.el8.src.rpm

aarch64:
systemd-239-45.el8.aarch64.rpm
systemd-container-239-45.el8.aarch64.rpm
systemd-container-debuginfo-239-45.el8.aarch64.rpm
systemd-debuginfo-239-45.el8.aarch64.rpm
systemd-debugsource-239-45.el8.aarch64.rpm
systemd-devel-239-45.el8.aarch64.rpm
systemd-journal-remote-239-45.el8.aarch64.rpm
systemd-journal-remote-debuginfo-239-45.el8.aarch64.rpm
systemd-libs-239-45.el8.aarch64.rpm
systemd-libs-debuginfo-239-45.el8.aarch64.rpm
systemd-pam-239-45.el8.aarch64.rpm
systemd-pam-debuginfo-239-45.el8.aarch64.rpm
systemd-tests-239-45.el8.aarch64.rpm
systemd-tests-debuginfo-239-45.el8.aarch64.rpm
systemd-udev-239-45.el8.aarch64.rpm
systemd-udev-debuginfo-239-45.el8.aarch64.rpm

ppc64le:
systemd-239-45.el8.ppc64le.rpm
systemd-container-239-45.el8.ppc64le.rpm
systemd-container-debuginfo-239-45.el8.ppc64le.rpm
systemd-debuginfo-239-45.el8.ppc64le.rpm
systemd-debugsource-239-45.el8.ppc64le.rpm
systemd-devel-239-45.el8.ppc64le.rpm
systemd-journal-remote-239-45.el8.ppc64le.rpm
systemd-journal-remote-debuginfo-239-45.el8.ppc64le.rpm
systemd-libs-239-45.el8.ppc64le.rpm
systemd-libs-debuginfo-239-45.el8.ppc64le.rpm
systemd-pam-239-45.el8.ppc64le.rpm
systemd-pam-debuginfo-239-45.el8.ppc64le.rpm
systemd-tests-239-45.el8.ppc64le.rpm
systemd-tests-debuginfo-239-45.el8.ppc64le.rpm
systemd-udev-239-45.el8.ppc64le.rpm
systemd-udev-debuginfo-239-45.el8.ppc64le.rpm

s390x:
systemd-239-45.el8.s390x.rpm
systemd-container-239-45.el8.s390x.rpm
systemd-container-debuginfo-239-45.el8.s390x.rpm
systemd-debuginfo-239-45.el8.s390x.rpm
systemd-debugsource-239-45.el8.s390x.rpm
systemd-devel-239-45.el8.s390x.rpm
systemd-journal-remote-239-45.el8.s390x.rpm
systemd-journal-remote-debuginfo-239-45.el8.s390x.rpm
systemd-libs-239-45.el8.s390x.rpm
systemd-libs-debuginfo-239-45.el8.s390x.rpm
systemd-pam-239-45.el8.s390x.rpm
systemd-pam-debuginfo-239-45.el8.s390x.rpm
systemd-tests-239-45.el8.s390x.rpm
systemd-tests-debuginfo-239-45.el8.s390x.rpm
systemd-udev-239-45.el8.s390x.rpm
systemd-udev-debuginfo-239-45.el8.s390x.rpm

x86_64:
systemd-239-45.el8.i686.rpm
systemd-239-45.el8.x86_64.rpm
systemd-container-239-45.el8.i686.rpm
systemd-container-239-45.el8.x86_64.rpm
systemd-container-debuginfo-239-45.el8.i686.rpm
systemd-container-debuginfo-239-45.el8.x86_64.rpm
systemd-debuginfo-239-45.el8.i686.rpm
systemd-debuginfo-239-45.el8.x86_64.rpm
systemd-debugsource-239-45.el8.i686.rpm
systemd-debugsource-239-45.el8.x86_64.rpm
systemd-devel-239-45.el8.i686.rpm
systemd-devel-239-45.el8.x86_64.rpm
systemd-journal-remote-239-45.el8.x86_64.rpm
systemd-journal-remote-debuginfo-239-45.el8.i686.rpm
systemd-journal-remote-debuginfo-239-45.el8.x86_64.rpm
systemd-libs-239-45.el8.i686.rpm
systemd-libs-239-45.el8.x86_64.rpm
systemd-libs-debuginfo-239-45.el8.i686.rpm
systemd-libs-debuginfo-239-45.el8.x86_64.rpm
systemd-pam-239-45.el8.x86_64.rpm
systemd-pam-debuginfo-239-45.el8.i686.rpm
systemd-pam-debuginfo-239-45.el8.x86_64.rpm
systemd-tests-239-45.el8.x86_64.rpm
systemd-tests-debuginfo-239-45.el8.i686.rpm
systemd-tests-debuginfo-239-45.el8.x86_64.rpm
systemd-udev-239-45.el8.x86_64.rpm
systemd-udev-debuginfo-239-45.el8.i686.rpm
systemd-udev-debuginfo-239-45.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-3842
https://access.redhat.com/security/cve/CVE-2020-13776
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYKPtN9zjgjWX9erEAQh1fw/9G0b1Nor53kXGEjIF5mkaTXpmJWYf1e+f
7fs7L0GIw5ecxzTx0dltY8yR2tLsGoGcCxHFQlTIBULu57RsHbR+cHsTG4iAMCW5
tFC1/CCNftao0Gr8LQu3a/XoIDQX3mKEvjly1Ry0g2nw/C126e0YYJwqPGRn7eIJ
K98tUTD+wYd+UT+DKNBXmbc51+nZ4L+Bt2goBtc0NPxBI8IkpNExUmZV6e9UAxl6
dznK/EIjmCQucrfpEeg1c0DnxZIGU3zIfIM8C+s9vyeyKSfY0tdY++FcOQBMz5ms
8MG3CykDZWxnBJ4w9ta052BV7yYeJFHxpkMKR1q9JkAJj1zhnoDhm3v0l6qkrhrG
oJfwkgZEbZkCXeixa2R7VO7aHhmdcpurv3RaBebRX5OvPdjppjkeKtxW/mp8BeSB
XQPhIUpxPR2KZnjwY9P9AnUFq549BsPs9wHSSxagQaY+GRu7nLs2R0I4QD/KGsvB
CG/Nm0xBCq9brFYTPFyTa9bPpqCMwWDqJlAFuO9+5fhvIiVQLHaovzMlOJOyKBUm
/JMZ2s3azB6pLD/fiG+tmc4dNJ/bhC37n9++9zWG3USy3f33f/m7ELVGG2eVZ2mh
W+vmCuFPoHokguaVkorCXEc5tT6tEKpsYqvPfa80GAEBadEQAjqFyg4AtBL5z4jx
gSR+956dHOo=K4AI
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce