Moderate: systemd security update
Summary
ALSA-2024:3203: Moderate: systemd security update. Affects systemd versions < 239-82.el8. Fixed in 239-82.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The systemd package is a system and service manager for Linux that is compatible with SysV and LSB init scripts. It provides various capabilities such as aggressive parallelism, socket and D-Bus activation for starting services, on-demand starting of daemons, process tracking using Linux cgroups, snapshotting and restoring of system state, management of mount and automount points, and transactional dependency-based service control logic. It can also serve as a drop-in replacement for sysvinit.
Vulnerability Detail
The vulnerability (CVE-2023-7008) in systemd-resolved allows unsigned name responses in a signed zone to be accepted when DNSSEC is enabled. This can lead to DNS cache poisoning attacks and potential unauthorized access to sensitive information. The impact of this vulnerability is moderate.
How To Fix
Minimum fixed version
239-82.el8
This is the first release that contains the fix.
sudo dnf update systemdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the systemd package in AlmaLinux:8 is affected by a moderate vulnerability (CVE-2023-7008) that allows unsigned name responses in a signed zone. It is recommended to update the systemd package to version 239-82.el8 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for systemd →
FAQ
Systemd is a system and service manager for Linux that provides various capabilities for managing processes, services, and system state.
The vulnerability allows unsigned name responses in a signed zone to be accepted, which can lead to DNS cache poisoning attacks and potential unauthorized access to sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will provide real-time alerts for open-source vulnerabilities.
Yes, updating the systemd package to version 239-82.el8 or later will address this vulnerability.
You can refer to the CVE page (CVE-2023-7008) listed in the References section of the vulnerability details for more information.
Related vulnerabilities
Recent vulnerabilities recorded for systemd.
