reference:
https://access.redhat.com/security/vulnerabilities/tcpsack
https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-11477.html
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md
Primarily Impacted Products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 5
- Red Hat Atomic Host
- Red Hat Enterprise MRG 2
- Red Hat OpenShift Container Platform 4 (RHEL CoreOS)
- Red Hat OpenShift Online
- Red Hat OpenShift Dedicated (and dependent services)
- OpenShift on Azure (ARO)
- Red Hat OpenStack Platform (images shipping kernel)
- Red Hat Virtualization (RHV-H)
Secondarily Impacted Products (underlying platform must be updated)
- Red Hat Virtualization (RHV)
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform 3
Mitigation
To mitigate issue CVE-2019-11477 and CVE-2019-11478 we can either disable the vulnerable component, or use iptables to drop connections with a MSS size that is able to exploit the vulnerability.
Option #1
Disable selective acknowledgments system wide for all newly established TCP connections.
# echo 0 > /proc/sys/net/ipv4/tcp_sack
or
# sudo sysctl -w net.ipv4.tcp_sack=0
This option will disable selective acknowledgements but will likely increase the bandwidth required to correctly complete streams when errors occur.
To make this option persist across reboots, create a file in /etc/sysctl.d/ such as /etc/sysctl.d/99-tcpsack.conf – with content:
# CVE-2019-11477 & CVE-2019-11478 net.ipv4.tcp_sack=0
Option #2
Prevent new connections made with low MSS sizes.
The default firewall configuration on Red Hat Enterprise Linux 7 and 8 is firewalld. To prevent new connections with low MSS sizes using firewalld use the commands.
# FIREWALL-CMD –PERMANENT –DIRECT –ADD-RULE IPV4 FILTER INPUT 0 -P TCP –TCP-FLAGS SYN SYN -M TCPMSS –MSS 1:500 -J DROP # FIREWALL-CMD –PERMANENT –DIRECT –ADD-RULE IPV6 FILTER INPUT 0 -P TCP –TCP-FLAGS SYN SYN -M TCPMSS –MSS 1:500 -J DROP # FIREWALL-CMD –RELOAD # FIREWALL-CMD –PERMANENT –DIRECT –GET-ALL-RULES
This firewall-cmd command will remain persistent through system reboots.
If using the traditional iptables firewalling method on any version of Red Hat Enterprise Linux, iptables equivalent command is:
# IPTABLES -I INPUT -P TCP –TCP-FLAGS SYN SYN -M TCPMSS –MSS 1:500 -J DROP # IP6TABLES -I INPUT -P TCP –TCP-FLAGS SYN SYN -M TCPMSS –MSS 1:500 -J DROP # IPTABLES -NL -V # IP6TABLES -NL -V
Ubuntu
1: CVE-2019-11477: SACK Panic (Linux >= 2.6.29)
Description: A sequence of SACKs may be crafted such that one can trigger an integer overflow, leading to a kernel panic.
Fix: Apply the patch PATCH_net_1_4.patch. Additionally, versions of the Linux kernel up to, and including, 4.14 require a second patch PATCH_net_1a.patch.
Workaround #1: Block connections with a low MSS using one of the supplied filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing sysctl is set to 0, which appears to be the default value for that sysctl).
Workaround #2: Disable SACK processing (/proc/sys/net/ipv4/tcp_sack set to 0).
(Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.)
2: CVE-2019-11478: SACK Slowness (Linux < 4.15) or Excess Resource Usage (all Linux versions)
Description: It is possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. On Linux kernels prior to 4.15, an attacker may be able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.
Fix: Apply the patch PATCH_net_2_4.patch
Workaround #1: Block connections with a low MSS using one of the supplied filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing sysctl is set to 0, which appears to be the default value for that sysctl).
Workaround #2: Disable SACK processing (/proc/sys/net/ipv4/tcp_sack set to 0).
(Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.)
3: CVE-2019-5599: SACK Slowness (FreeBSD 12 using the RACK TCP Stack)
Description: It is possible to send a crafted sequence of SACKs which will fragment the RACK send map. An attacker may be able to further exploit the fragmented send map to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.
Workaround #1: Apply the patch split_limit.patch and set the net.inet.tcp.rack.split_limit sysctl to a reasonable value to limit the size of the SACK table.
Workaround #2: Temporarily disable the RACK TCP stack.
(Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.)
4: CVE-2019-11479: Excess Resource Consumption Due to Low MSS Values (all Linux versions)
Description: An attacker can force the Linux kernel to segment its responses into multiple TCP segments, each of which contains only 8 bytes of data. This drastically increases the bandwidth required to deliver the same amount of data. Further, it consumes additional resources (CPU and NIC processing power). This attack requires continued effort from the attacker and the impacts will end shortly after the attacker stops sending traffic.
Fix: Two patches PATCH_net_3_4.patch and PATCH_net_4_4.patch add a sysctl which enforces a minimum MSS, set by the net.ipv4.tcp_min_snd_mss sysctl. This lets an administrator enforce a minimum MSS appropriate for their applications.
Workaround: Block connections with a low MSS using one of the supplied filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing sysctl is set to 0, which appears to be the default value for that sysctl).
Note:
Good system and application coding and configuration practices (limiting write buffers to the necessary level, monitoring connection memory consumption via SO_MEMINFO, and aggressively closing misbehaving connections) can help to limit the impact of attacks against these kinds of vulnerabilities.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Important: kernel security and bug fix update
Advisory ID: RHSA-2019:1479-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2019:1479
Issue date: 2019-06-17
CVE Names: CVE-2019-9213 CVE-2019-11477 CVE-2019-11478
CVE-2019-11479
====================================================================
1. Summary:
An update for kernel is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, x86_64
Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64
3. Description:
The kernel packages contain the Linux kernel, the core of any Linux
operating system.
Security Fix(es):
* An integer overflow flaw was found in the way the Linux kernel's
networking subsystem processed TCP Selective Acknowledgment (SACK)
segments. While processing SACK segments, the Linux kernel's socket buffer
(SKB) data structure becomes fragmented. Each fragment is about TCP maximum
segment size (MSS) bytes. To efficiently process SACK blocks, the Linux
kernel merges multiple fragmented SKBs into one, potentially overflowing
the variable holding the number of segments. A remote attacker could use
this flaw to crash the Linux kernel by sending a crafted sequence of SACK
segments on a TCP connection with small value of TCP MSS, resulting in a
denial of service (DoS). (CVE-2019-11477)
* kernel: lack of check for mmap minimum address in expand_downwards in
mm/mmap.c leads to NULL pointer dereferences exploit on non-SMAP platforms
(CVE-2019-9213)
* Kernel: tcp: excessive resource consumption while processing SACK blocks
allows remote denial of service (CVE-2019-11478)
* Kernel: tcp: excessive resource consumption for TCP connections with low
MSS allows remote denial of service (CVE-2019-11479)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
* [HPE 8.0 Bug] nvme drive power button does not turn off drive
(BZ#1700288)
* RHEL8.0 - hw csum failure seen in dmesg and console (using
mlx5/mlx4/Mellanox) (BZ#1700289)
* RHEL8.0 - vfio-ap: add subsystem to matrix device to avoid libudev
failures (kvm) (BZ#1700290)
* [FJ8.1 Bug]: Make Fujitsu Erratum 010001 patch work on A64FX v1r0
(BZ#1700901)
* [FJ8.0 Bug]: Fujitsu A64FX processor errata - panic by unknown fault
(BZ#1700902)
* RHEL 8.0 Snapshot 4 - nvme create-ns command hangs after creating 20
namespaces on Bolt (NVMe) (BZ#1701140)
* [Cavium/Marvell 8.0 qed] Fix qed_mcp_halt() and qed_mcp_resume()
(backporting bug) (BZ#1704184)
* [Intel 8.1 Bug] PBF: Base frequency display fix (BZ#1706739)
* [RHEL8]read/write operation not permitted to /sys/kernel/debug/gcov/reset
(BZ#1708100)
* RHEL8.0 - ISST-LTE:pVM:fleetwood:LPM:raylp85:After lpm seeing the
console logs on the the lpar at target side (BZ#1708102)
* RHEL8.0 - Backport support for software count cache flush Spectre v2
mitigation (BZ#1708112)
* [Regression] RHEL8.0 - System crashed with one stress-ng-mremap stressor
on Boston (kvm host) (BZ#1708617)
* [intel ice Rhel 8 RC1] ethtool -A ethx causes interfaces to go down
(BZ#1709433)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1686136 - CVE-2019-9213 kernel: lack of check for mmap minimum address in expand_downwards in mm/mmap.c leads to NULL pointer dereferences exploit on non-SMAP platforms
1719123 - CVE-2019-11477 Kernel: tcp: integer overflow while processing SACK blocks allows remote denial of service
1719128 - CVE-2019-11478 Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service
1719129 - CVE-2019-11479 Kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service
6. Package List:
Red Hat Enterprise Linux BaseOS (v. 8):
Source:
kernel-4.18.0-80.4.2.el8_0.src.rpm
aarch64:
bpftool-4.18.0-80.4.2.el8_0.aarch64.rpm
bpftool-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-core-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-cross-headers-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-debug-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-debug-core-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-debug-devel-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-debug-modules-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-debug-modules-extra-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-debuginfo-common-aarch64-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-devel-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-headers-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-modules-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-modules-extra-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-tools-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-tools-libs-4.18.0-80.4.2.el8_0.aarch64.rpm
perf-4.18.0-80.4.2.el8_0.aarch64.rpm
perf-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm
python3-perf-4.18.0-80.4.2.el8_0.aarch64.rpm
python3-perf-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm
noarch:
kernel-abi-whitelists-4.18.0-80.4.2.el8_0.noarch.rpm
kernel-doc-4.18.0-80.4.2.el8_0.noarch.rpm
ppc64le:
bpftool-4.18.0-80.4.2.el8_0.ppc64le.rpm
bpftool-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-core-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-cross-headers-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-debug-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-debug-core-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-debug-devel-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-debug-modules-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-debug-modules-extra-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-debuginfo-common-ppc64le-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-devel-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-headers-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-modules-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-modules-extra-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-tools-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-tools-libs-4.18.0-80.4.2.el8_0.ppc64le.rpm
perf-4.18.0-80.4.2.el8_0.ppc64le.rpm
perf-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm
python3-perf-4.18.0-80.4.2.el8_0.ppc64le.rpm
python3-perf-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm
s390x:
bpftool-4.18.0-80.4.2.el8_0.s390x.rpm
bpftool-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-core-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-cross-headers-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-debug-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-debug-core-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-debug-devel-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-debug-modules-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-debug-modules-extra-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-debuginfo-common-s390x-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-devel-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-headers-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-modules-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-modules-extra-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-tools-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-zfcpdump-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-zfcpdump-core-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-zfcpdump-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-zfcpdump-devel-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-zfcpdump-modules-4.18.0-80.4.2.el8_0.s390x.rpm
kernel-zfcpdump-modules-extra-4.18.0-80.4.2.el8_0.s390x.rpm
perf-4.18.0-80.4.2.el8_0.s390x.rpm
perf-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm
python3-perf-4.18.0-80.4.2.el8_0.s390x.rpm
python3-perf-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm
x86_64:
bpftool-4.18.0-80.4.2.el8_0.x86_64.rpm
bpftool-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-core-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-cross-headers-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-debug-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-debug-core-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-debug-devel-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-debug-modules-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-debug-modules-extra-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-debuginfo-common-x86_64-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-devel-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-headers-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-modules-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-modules-extra-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-tools-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-tools-libs-4.18.0-80.4.2.el8_0.x86_64.rpm
perf-4.18.0-80.4.2.el8_0.x86_64.rpm
perf-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm
python3-perf-4.18.0-80.4.2.el8_0.x86_64.rpm
python3-perf-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 8):
aarch64:
bpftool-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-debuginfo-common-aarch64-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm
kernel-tools-libs-devel-4.18.0-80.4.2.el8_0.aarch64.rpm
perf-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm
python3-perf-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm
ppc64le:
bpftool-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-debuginfo-common-ppc64le-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm
kernel-tools-libs-devel-4.18.0-80.4.2.el8_0.ppc64le.rpm
perf-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm
python3-perf-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm
x86_64:
bpftool-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-debuginfo-common-x86_64-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm
kernel-tools-libs-devel-4.18.0-80.4.2.el8_0.x86_64.rpm
perf-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm
python3-perf-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-9213
https://access.redhat.com/security/cve/CVE-2019-11477
https://access.redhat.com/security/cve/CVE-2019-11478
https://access.redhat.com/security/cve/CVE-2019-11479
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/tcpsack
8. Contact:
The Red Hat security contact is <[email protected]>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXQfVZNzjgjWX9erEAQgLoA/9GIfagfPFKGZbzBrrj0u6ql3dtHsfhHsn
pWGZULspXnR/k3np3STGthnvri1ptkk3/IVmc1Iz9IiAE7A7yhK/Trbg4pIapZ4t
7NUeskkhfnpP+6ocPbEGnfjaJ5zieMERVUTcrZ+CKhds1YYnJ0ih1ekj+P12UacN
l1R5Ga79XhwnGT5Alfm0ATZIx+idKuhVp4b6uLAKeMCBwsmDZwe98oCmDSvpAPQ9
kire5H61hvSd/GfsGrVeA8ohs/8b7iw2UslcdZ1uYoLxPpz1I24/i1OXeElMVp3l
4TDthnn3Djd19fp77gSuBbxxh8ismPDL+jBAhsq0TNdzG88PhJK1h/qbO6t39F9z
hBf+eALXggOLEm8UFuuyInmVJjqc/Wt1zGHiLBgr0UhlfVOa5fzhG8NfoQ6bJ56O
mXcS6cmndf0barL4bse6XsyCGQZbLB2jI7cUByeZxlg0d9akpKeuHmI5NnuZJDGx
VhJ1u/6VNBLryEIQs916RdQGJ4EOQfVGhwE0WufW4Zu8Fs0d2P4c/zOY/hZwQRYk
NyhJTR49iD3qmi0mPd+MyeMvY2bSkChmDTscnzSeq6ASGrxoPJg1Pc9Aa5o+ZT3N
bel0/RacnVWzMs5q3kiZTu7ovCt+2UfiTmRQVfcgsp1WXBgRI8uUeCWX5hd0yl+t
ZAqvPPSmBPY=qId3
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/rhsa-announce
