Important: device-mapper-multipath security update
Summary
ALSA-2022:8453: Important: device-mapper-multipath security update. Affects device-mapper-multipath versions < 0.8.7-12.el9_1.1. Fixed in 0.8.7-12.el9_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The device-mapper-multipath package provides tools that utilize the device-mapper multipath kernel module to manage multipath devices. It is commonly used in AlmaLinux 9.
Vulnerability Detail
A regression of CVE-2022-41974 fix in AlmaLinux has been identified in the device-mapper-multipath package. This vulnerability is tracked as CVE-2022-3787. The specific technical details and impact of this vulnerability can be found on the CVE page referenced in the References section.
How To Fix
Minimum fixed version
0.8.7-12.el9_1.1
This is the first release that contains the fix.
sudo dnf update device-mapper-multipathTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The device-mapper-multipath package in AlmaLinux 9 is affected by a regression vulnerability (CVE-2022-3787). It is important to update the package to version 0.8.7-12.el9_1.1 or later to address this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for device-mapper-multipath →
FAQ
Device-mapper-multipath is a package that provides tools for managing multipath devices using the device-mapper multipath kernel module.
The impact of this vulnerability is not explicitly mentioned in the provided information. It is recommended to refer to the CVE page for detailed information on the impact.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application or system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No specific workaround is mentioned in the provided information. It is recommended to update the device-mapper-multipath package to the fixed version.
You can find more information about this vulnerability, including technical details and impact, on the CVE page referenced in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for device-mapper-multipath.
