redis-7.0.14-1.fc37
Redis 7.0.14 Released Wed 18 Oct 2023 10:33:40 IDT
Upgrade urgency SECURITY: See security fixes below.
Security fixes
(CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a
race condition that can be used by another process to bypass desired Unix
socket permissions on startup.
redis-7.2.2-1.fc39
Redis 7.2.2 Released Wed 18 Oct 2023 10:33:40 IDT
Upgrade urgency SECURITY: See security fixes below.
Security fixes
(CVE-2023-45145) The wrong order of listen(2) and chmod(2) calls creates a
race condition that can be used by another process to bypass desired Unix
socket permissions on startup.
Bug fixes
WAITAOF could timeout in the absence of write traffic in case a new AOF is
created and an AOF rewrite can’t immediately start (#12620)
Redis cluster
Fix crash when running rebalance command in a mixed cluster of 7.0 and 7.2
nodes (#12604)
Fix the return type of the slot number in cluster shards to integer, which
makes it consistent with past behavior (#12561)
Fix CLUSTER commands are called from modules or scripts to return TLS info
appropriately (#12569)
Changes in CLI tools
redis-cli, fix crash on reconnect when in SUBSCRIBE mode (#12571)
Module API changes
Fix overflow calculation for next timer event (#12474)
Cybercriminals are harvesting sensitive medical data from plastic surgery offices as leverage for extortion demands
This vulnerability allows remote attackers to execute arbitrary code on affected installations of F5 BIG-IP OS. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2023-41373.
It was discovered that the FRR did not properly check the attribute length
in NRLI. A remote attacker could possibly use this issue to cause a denial
of service. (CVE-2023-41358)
It was discovered that the FRR did not properly manage memory when reading
initial bytes of ORF header. A remote attacker could possibly use this
issue to cause a denial of service. (CVE-2023-41360)
It was discovered that FRR did not properly validate the attributes in the
BGP FlowSpec functionality. A remote attacker could possibly use this issue
to cause a denial of service. (CVE-2023-41909)
iperf3-3.15-1.fc40
Automatic update for iperf3-3.15-1.fc40.
* Tue Oct 17 2023 Jonathan Wright <jonathan@almalinux.org> – 3.15-1
– Update to 3.15 rhbz#2239199 rhbz#2244708
Multiple vulnerabilities have been discovered in Oracle products, which could allow for remote code execution.
Amir Golestan, the 40-year-old CEO of the Charleston, S.C. based technology company Micfo LLC, has been sentenced to five years in prison for wire fraud. Golestan’s sentencing comes nearly two years after he pleaded guilty to using an elaborate network of phony companies to secure more than 735,000 Internet Protocol (IP) addresses from the American Registry for Internet Numbers (ARIN), the nonprofit which oversees IP addresses assigned to entities in the U.S., Canada, and parts of the Caribbean.
Amir Golestan, the former CEO of Micfo.
In 2018, ARIN sued Golestan and Micfo, alleging they had obtained hundreds of thousands of IP addresses under false pretenses. ARIN and Micfo settled that dispute in arbitration, with Micfo returning most of the addresses that it hadn’t already sold.
ARIN’s civil case caught the attention of federal prosecutors in South Carolina, who in May 2019 filed criminal wire fraud charges against Golestan, alleging he’d orchestrated a network of shell companies and fake identities to prevent ARIN from knowing the addresses were all going to the same buyer.
Prosecutors showed that each of those shell companies involved the production of notarized affidavits in the names of people who didn’t exist. As a result, the government was able to charge Golestan with 20 counts of wire fraud — one for each payment made by the phony companies that bought the IP addresses from ARIN.
Golestan initially sought to fight those charges. But on just the second day of his trial in November 2021, Golestan changed his mind and pleaded guilty to 20 counts of wire fraud in connection with the phantom companies he used to secure the IP addresses. Prosecutors estimated those addresses were valued at between $10 million and $14 million.
ARIN says the 5-year sentence handed down by the South Carolina judge “sends an important message of deterrence to other parties contemplating fraudulent schemes to obtain or transfer Internet resources.”
“Those who seek to defraud ARIN (or other Regional Internet Registries) are subject to costly and serious civil litigation, criminal charges, and, ultimately, a lengthy term of incarceration,” reads a statement from ARIN on Golestan’s sentencing.
By 2013, a number of Micfo’s customers had landed on the radar of Spamhaus, a group that many network operators rely upon to stem the tide of junk email. Shortly after Spamhaus started blocking Micfo’s IP address ranges, Micfo shifted gears and began reselling IP addresses mainly to companies marketing “virtual private networking” or VPN services that help customers hide their real IP addresses online.
Golestan did not respond to a request for comment. But in a 2020 interview with KrebsOnSecurity, Golestan claimed that Micfo was at one point responsible for brokering roughly 40 percent of the IP addresses used by the world’s largest VPN providers. Throughout that conversation, Golestan maintained his innocence, even as he explained that the creation of the phony companies was necessary to prevent entities like Spamhaus from interfering with his business going forward.
There are fewer than four billion so-called “Internet Protocol version 4” or IPv4 addresses available for use, but the vast majority of them have already been allocated. The global dearth of available IP addresses has turned them into a commodity wherein each IPv4 address can fetch between $15-$25 on the open market.
This has led to boom times for those engaged in the acquisition and sale of IP address blocks, but it has likewise emboldened those who specialize in absconding with and spamming from dormant IP address blocks without permission from the rightful owners.
The U.S Department of Justice says Golestan will serve 60 months in prison, followed by a 2-year term of court-ordered supervision. The Micfo CEO also was ordered to pay nearly $77,000 in restitution to ARIN for its work in assisting federal prosecutors.
Kaspersky said the campaign exploiting USB drives first came to light in early 2023
