

reference:
https://access.redhat.com/security/vulnerabilities/tcpsack
https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-11477.html
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-001.md
Primarily Impacted Products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 5
- Red Hat Atomic Host
- Red Hat Enterprise MRG 2
- Red Hat OpenShift Container Platform 4 (RHEL CoreOS)
- Red Hat OpenShift Online
- Red Hat OpenShift Dedicated (and dependent services)
- OpenShift on Azure (ARO)
- Red Hat OpenStack Platform (images shipping kernel)
- Red Hat Virtualization (RHV-H)
Secondarily Impacted Products (underlying platform must be updated)
- Red Hat Virtualization (RHV)
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform 3
Mitigation
To mitigate issue CVE-2019-11477 and CVE-2019-11478 we can either disable the vulnerable component, or use iptables to drop connections with a MSS size that is able to exploit the vulnerability.
Option #1
Disable selective acknowledgments system wide for all newly established TCP connections.
# echo 0 > /proc/sys/net/ipv4/tcp_sack
or
# sudo sysctl -w net.ipv4.tcp_sack=0
This option will disable selective acknowledgements but will likely increase the bandwidth required to correctly complete streams when errors occur.
To make this option persist across reboots, create a file in /etc/sysctl.d/ such as /etc/sysctl.d/99-tcpsack.conf – with content:
# CVE-2019-11477 & CVE-2019-11478 net.ipv4.tcp_sack=0
Option #2
Prevent new connections made with low MSS sizes.
The default firewall configuration on Red Hat Enterprise Linux 7 and 8 is firewalld. To prevent new connections with low MSS sizes using firewalld use the commands.
# FIREWALL-CMD –PERMANENT –DIRECT –ADD-RULE IPV4 FILTER INPUT 0 -P TCP –TCP-FLAGS SYN SYN -M TCPMSS –MSS 1:500 -J DROP # FIREWALL-CMD –PERMANENT –DIRECT –ADD-RULE IPV6 FILTER INPUT 0 -P TCP –TCP-FLAGS SYN SYN -M TCPMSS –MSS 1:500 -J DROP # FIREWALL-CMD –RELOAD # FIREWALL-CMD –PERMANENT –DIRECT –GET-ALL-RULES
This firewall-cmd command will remain persistent through system reboots.
If using the traditional iptables firewalling method on any version of Red Hat Enterprise Linux, iptables equivalent command is:
# IPTABLES -I INPUT -P TCP –TCP-FLAGS SYN SYN -M TCPMSS –MSS 1:500 -J DROP # IP6TABLES -I INPUT -P TCP –TCP-FLAGS SYN SYN -M TCPMSS –MSS 1:500 -J DROP # IPTABLES -NL -V # IP6TABLES -NL -V
Ubuntu
1: CVE-2019-11477: SACK Panic (Linux >= 2.6.29)
Description: A sequence of SACKs may be crafted such that one can trigger an integer overflow, leading to a kernel panic.
Fix: Apply the patch PATCH_net_1_4.patch. Additionally, versions of the Linux kernel up to, and including, 4.14 require a second patch PATCH_net_1a.patch.
Workaround #1: Block connections with a low MSS using one of the supplied filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing
sysctl is set to 0, which appears to be the default value for that sysctl).
Workaround #2: Disable SACK processing (/proc/sys/net/ipv4/tcp_sack
set to 0).
(Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.)
2: CVE-2019-11478: SACK Slowness (Linux < 4.15) or Excess Resource Usage (all Linux versions)
Description: It is possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. On Linux kernels prior to 4.15, an attacker may be able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.
Fix: Apply the patch PATCH_net_2_4.patch
Workaround #1: Block connections with a low MSS using one of the supplied filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing
sysctl is set to 0, which appears to be the default value for that sysctl).
Workaround #2: Disable SACK processing (/proc/sys/net/ipv4/tcp_sack
set to 0).
(Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.)
3: CVE-2019-5599: SACK Slowness (FreeBSD 12 using the RACK TCP Stack)
Description: It is possible to send a crafted sequence of SACKs which will fragment the RACK send map. An attacker may be able to further exploit the fragmented send map to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.
Workaround #1: Apply the patch split_limit.patch and set the net.inet.tcp.rack.split_limit
sysctl to a reasonable value to limit the size of the SACK table.
Workaround #2: Temporarily disable the RACK TCP stack.
(Note that either workaround should be sufficient on its own. It is not necessary to apply both workarounds.)
4: CVE-2019-11479: Excess Resource Consumption Due to Low MSS Values (all Linux versions)
Description: An attacker can force the Linux kernel to segment its responses into multiple TCP segments, each of which contains only 8 bytes of data. This drastically increases the bandwidth required to deliver the same amount of data. Further, it consumes additional resources (CPU and NIC processing power). This attack requires continued effort from the attacker and the impacts will end shortly after the attacker stops sending traffic.
Fix: Two patches PATCH_net_3_4.patch and PATCH_net_4_4.patch add a sysctl which enforces a minimum MSS, set by the net.ipv4.tcp_min_snd_mss
sysctl. This lets an administrator enforce a minimum MSS appropriate for their applications.
Workaround: Block connections with a low MSS using one of the supplied filters. (The values in the filters are examples. You can apply a higher or lower limit, as appropriate for your environment.) Note that these filters may break legitimate connections which rely on a low MSS. Also, note that this mitigation is only effective if TCP probing is disabled (that is, the net.ipv4.tcp_mtu_probing
sysctl is set to 0, which appears to be the default value for that sysctl).
Note:
Good system and application coding and configuration practices (limiting write buffers to the necessary level, monitoring connection memory consumption via SO_MEMINFO, and aggressively closing misbehaving connections) can help to limit the impact of attacks against these kinds of vulnerabilities.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2019:1479-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:1479 Issue date: 2019-06-17 CVE Names: CVE-2019-9213 CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 ==================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented. Each fragment is about TCP maximum segment size (MSS) bytes. To efficiently process SACK blocks, the Linux kernel merges multiple fragmented SKBs into one, potentially overflowing the variable holding the number of segments. A remote attacker could use this flaw to crash the Linux kernel by sending a crafted sequence of SACK segments on a TCP connection with small value of TCP MSS, resulting in a denial of service (DoS). (CVE-2019-11477) * kernel: lack of check for mmap minimum address in expand_downwards in mm/mmap.c leads to NULL pointer dereferences exploit on non-SMAP platforms (CVE-2019-9213) * Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service (CVE-2019-11478) * Kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service (CVE-2019-11479) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * [HPE 8.0 Bug] nvme drive power button does not turn off drive (BZ#1700288) * RHEL8.0 - hw csum failure seen in dmesg and console (using mlx5/mlx4/Mellanox) (BZ#1700289) * RHEL8.0 - vfio-ap: add subsystem to matrix device to avoid libudev failures (kvm) (BZ#1700290) * [FJ8.1 Bug]: Make Fujitsu Erratum 010001 patch work on A64FX v1r0 (BZ#1700901) * [FJ8.0 Bug]: Fujitsu A64FX processor errata - panic by unknown fault (BZ#1700902) * RHEL 8.0 Snapshot 4 - nvme create-ns command hangs after creating 20 namespaces on Bolt (NVMe) (BZ#1701140) * [Cavium/Marvell 8.0 qed] Fix qed_mcp_halt() and qed_mcp_resume() (backporting bug) (BZ#1704184) * [Intel 8.1 Bug] PBF: Base frequency display fix (BZ#1706739) * [RHEL8]read/write operation not permitted to /sys/kernel/debug/gcov/reset (BZ#1708100) * RHEL8.0 - ISST-LTE:pVM:fleetwood:LPM:raylp85:After lpm seeing the console logs on the the lpar at target side (BZ#1708102) * RHEL8.0 - Backport support for software count cache flush Spectre v2 mitigation (BZ#1708112) * [Regression] RHEL8.0 - System crashed with one stress-ng-mremap stressor on Boston (kvm host) (BZ#1708617) * [intel ice Rhel 8 RC1] ethtool -A ethx causes interfaces to go down (BZ#1709433) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1686136 - CVE-2019-9213 kernel: lack of check for mmap minimum address in expand_downwards in mm/mmap.c leads to NULL pointer dereferences exploit on non-SMAP platforms 1719123 - CVE-2019-11477 Kernel: tcp: integer overflow while processing SACK blocks allows remote denial of service 1719128 - CVE-2019-11478 Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service 1719129 - CVE-2019-11479 Kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service 6. Package List: Red Hat Enterprise Linux BaseOS (v. 8): Source: kernel-4.18.0-80.4.2.el8_0.src.rpm aarch64: bpftool-4.18.0-80.4.2.el8_0.aarch64.rpm bpftool-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-core-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-cross-headers-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-debug-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-debug-core-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-debug-devel-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-debug-modules-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-debug-modules-extra-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-debuginfo-common-aarch64-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-devel-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-headers-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-modules-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-modules-extra-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-tools-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-tools-libs-4.18.0-80.4.2.el8_0.aarch64.rpm perf-4.18.0-80.4.2.el8_0.aarch64.rpm perf-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm python3-perf-4.18.0-80.4.2.el8_0.aarch64.rpm python3-perf-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm noarch: kernel-abi-whitelists-4.18.0-80.4.2.el8_0.noarch.rpm kernel-doc-4.18.0-80.4.2.el8_0.noarch.rpm ppc64le: bpftool-4.18.0-80.4.2.el8_0.ppc64le.rpm bpftool-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-core-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-cross-headers-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-debug-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-debug-core-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-debug-devel-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-debug-modules-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-debug-modules-extra-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-debuginfo-common-ppc64le-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-devel-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-headers-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-modules-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-modules-extra-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-tools-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-tools-libs-4.18.0-80.4.2.el8_0.ppc64le.rpm perf-4.18.0-80.4.2.el8_0.ppc64le.rpm perf-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm python3-perf-4.18.0-80.4.2.el8_0.ppc64le.rpm python3-perf-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm s390x: bpftool-4.18.0-80.4.2.el8_0.s390x.rpm bpftool-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm kernel-4.18.0-80.4.2.el8_0.s390x.rpm kernel-core-4.18.0-80.4.2.el8_0.s390x.rpm kernel-cross-headers-4.18.0-80.4.2.el8_0.s390x.rpm kernel-debug-4.18.0-80.4.2.el8_0.s390x.rpm kernel-debug-core-4.18.0-80.4.2.el8_0.s390x.rpm kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm kernel-debug-devel-4.18.0-80.4.2.el8_0.s390x.rpm kernel-debug-modules-4.18.0-80.4.2.el8_0.s390x.rpm kernel-debug-modules-extra-4.18.0-80.4.2.el8_0.s390x.rpm kernel-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm kernel-debuginfo-common-s390x-4.18.0-80.4.2.el8_0.s390x.rpm kernel-devel-4.18.0-80.4.2.el8_0.s390x.rpm kernel-headers-4.18.0-80.4.2.el8_0.s390x.rpm kernel-modules-4.18.0-80.4.2.el8_0.s390x.rpm kernel-modules-extra-4.18.0-80.4.2.el8_0.s390x.rpm kernel-tools-4.18.0-80.4.2.el8_0.s390x.rpm kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm kernel-zfcpdump-4.18.0-80.4.2.el8_0.s390x.rpm kernel-zfcpdump-core-4.18.0-80.4.2.el8_0.s390x.rpm kernel-zfcpdump-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm kernel-zfcpdump-devel-4.18.0-80.4.2.el8_0.s390x.rpm kernel-zfcpdump-modules-4.18.0-80.4.2.el8_0.s390x.rpm kernel-zfcpdump-modules-extra-4.18.0-80.4.2.el8_0.s390x.rpm perf-4.18.0-80.4.2.el8_0.s390x.rpm perf-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm python3-perf-4.18.0-80.4.2.el8_0.s390x.rpm python3-perf-debuginfo-4.18.0-80.4.2.el8_0.s390x.rpm x86_64: bpftool-4.18.0-80.4.2.el8_0.x86_64.rpm bpftool-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-core-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-cross-headers-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-debug-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-debug-core-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-debug-devel-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-debug-modules-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-debug-modules-extra-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-debuginfo-common-x86_64-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-devel-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-headers-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-modules-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-modules-extra-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-tools-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-tools-libs-4.18.0-80.4.2.el8_0.x86_64.rpm perf-4.18.0-80.4.2.el8_0.x86_64.rpm perf-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm python3-perf-4.18.0-80.4.2.el8_0.x86_64.rpm python3-perf-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm Red Hat CodeReady Linux Builder (v. 8): aarch64: bpftool-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-debuginfo-common-aarch64-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm kernel-tools-libs-devel-4.18.0-80.4.2.el8_0.aarch64.rpm perf-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm python3-perf-debuginfo-4.18.0-80.4.2.el8_0.aarch64.rpm ppc64le: bpftool-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-debuginfo-common-ppc64le-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm kernel-tools-libs-devel-4.18.0-80.4.2.el8_0.ppc64le.rpm perf-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm python3-perf-debuginfo-4.18.0-80.4.2.el8_0.ppc64le.rpm x86_64: bpftool-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-debug-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-debuginfo-common-x86_64-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-tools-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm kernel-tools-libs-devel-4.18.0-80.4.2.el8_0.x86_64.rpm perf-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm python3-perf-debuginfo-4.18.0-80.4.2.el8_0.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-9213 https://access.redhat.com/security/cve/CVE-2019-11477 https://access.redhat.com/security/cve/CVE-2019-11478 https://access.redhat.com/security/cve/CVE-2019-11479 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/tcpsack 8. Contact: The Red Hat security contact is <[email protected]>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXQfVZNzjgjWX9erEAQgLoA/9GIfagfPFKGZbzBrrj0u6ql3dtHsfhHsn pWGZULspXnR/k3np3STGthnvri1ptkk3/IVmc1Iz9IiAE7A7yhK/Trbg4pIapZ4t 7NUeskkhfnpP+6ocPbEGnfjaJ5zieMERVUTcrZ+CKhds1YYnJ0ih1ekj+P12UacN l1R5Ga79XhwnGT5Alfm0ATZIx+idKuhVp4b6uLAKeMCBwsmDZwe98oCmDSvpAPQ9 kire5H61hvSd/GfsGrVeA8ohs/8b7iw2UslcdZ1uYoLxPpz1I24/i1OXeElMVp3l 4TDthnn3Djd19fp77gSuBbxxh8ismPDL+jBAhsq0TNdzG88PhJK1h/qbO6t39F9z hBf+eALXggOLEm8UFuuyInmVJjqc/Wt1zGHiLBgr0UhlfVOa5fzhG8NfoQ6bJ56O mXcS6cmndf0barL4bse6XsyCGQZbLB2jI7cUByeZxlg0d9akpKeuHmI5NnuZJDGx VhJ1u/6VNBLryEIQs916RdQGJ4EOQfVGhwE0WufW4Zu8Fs0d2P4c/zOY/hZwQRYk NyhJTR49iD3qmi0mPd+MyeMvY2bSkChmDTscnzSeq6ASGrxoPJg1Pc9Aa5o+ZT3N bel0/RacnVWzMs5q3kiZTu7ovCt+2UfiTmRQVfcgsp1WXBgRI8uUeCWX5hd0yl+t ZAqvPPSmBPY=qId3 -----END PGP SIGNATURE----- -- RHSA-announce mailing list [email protected] https://www.redhat.com/mailman/listinfo/rhsa-announce