October 2021 - Arch-security - lists.archlinux.org

[ASA-202110-6] nodejs-lts-erbium: multiple issues
by Jonas Witschel 21 Oct '21

21 Oct '21

Arch Linux Security Advisory ASA-202110-6 ========================================= Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-22939 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960 Package : nodejs-lts-erbium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2285 Summary ======= The package nodejs-lts-erbium before version 12.22.7-1 is vulnerable to multiple issues including arbitrary code execution, url request injection and certificate verification bypass. Resolution ========== Upgrade to 12.22.7-1. # pacman -Syu "nodejs-lts-erbium>=12.22.7-1" The problems have been fixed upstream in version 12.22.7. Workaround ========== None. Description =========== - CVE-2021-22939 (certificate verification bypass) If the Node.js https API in versions before 16.6.2, 14.17.5 and 12.22.5 was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. - CVE-2021-22940 (arbitrary code execution) Node.js before versions 16.6.2, 14.17.5 and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. The issue is a follow on to CVE-2021-22930 as the issue was not completely resolved in the fix for CVE-2021-22930. - CVE-2021-22959 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). - CVE-2021-22960 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. Impact ====== Incorrect use of the https API could lead to expired certificates being accepted. Furthermore a remote attacker could execute arbitrary code or inject HTTP requests through crafted queries. References ========== https://bugs.archlinux.org/task/72412 https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#incomp… https://hackerone.com/reports/1278254 https://github.com/nodejs-private/node-private/pull/276 https://github.com/nodejs/node/commit/6c7fff6f1d53dfb6c2b184ee41809b8d7614c… https://github.com/nodejs/node/commit/35b86110e45083a75d7dc8e6be5a930b26249… https://github.com/nodejs/node/commit/1780bbc3291357f7c3370892eb311fc7a62af… https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-af… https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/pull/39622 https://github.com/nodejs/node/commit/a3c33d4ce78f74d1cf1765704af5b427aa384… https://github.com/nodejs/node/commit/2008c9722fcf7591e39013691f303934b622d… https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-r… https://hackerone.com/reports/1238099 https://hackerone.com/reports/1238709 https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3… https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9f… https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a… https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-r… https://security.archlinux.org/CVE-2021-22939 https://security.archlinux.org/CVE-2021-22940 https://security.archlinux.org/CVE-2021-22959 https://security.archlinux.org/CVE-2021-22960

1 0

[ASA-202110-5] nodejs-lts-fermium: multiple issues
by Jonas Witschel 21 Oct '21

21 Oct '21

Arch Linux Security Advisory ASA-202110-5 ========================================= Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-22939 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960 Package : nodejs-lts-fermium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2284 Summary ======= The package nodejs-lts-fermium before version 14.18.1-1 is vulnerable to multiple issues including arbitrary code execution, url request injection and certificate verification bypass. Resolution ========== Upgrade to 14.18.1-1. # pacman -Syu "nodejs-lts-fermium>=14.18.1-1" The problems have been fixed upstream in version 14.18.1. Workaround ========== None. Description =========== - CVE-2021-22939 (certificate verification bypass) If the Node.js https API in versions before 16.6.2, 14.17.5 and 12.22.5 was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. - CVE-2021-22940 (arbitrary code execution) Node.js before versions 16.6.2, 14.17.5 and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. The issue is a follow on to CVE-2021-22930 as the issue was not completely resolved in the fix for CVE-2021-22930. - CVE-2021-22959 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). - CVE-2021-22960 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. Impact ====== Incorrect use of the https API could lead to expired certificates being accepted. Furthermore a remote attacker could execute arbitrary code or inject HTTP requests through crafted queries. References ========== https://bugs.archlinux.org/task/72413 https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#incomp… https://hackerone.com/reports/1278254 https://github.com/nodejs-private/node-private/pull/276 https://github.com/nodejs/node/commit/6c7fff6f1d53dfb6c2b184ee41809b8d7614c… https://github.com/nodejs/node/commit/35b86110e45083a75d7dc8e6be5a930b26249… https://github.com/nodejs/node/commit/1780bbc3291357f7c3370892eb311fc7a62af… https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-af… https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/pull/39622 https://github.com/nodejs/node/commit/a3c33d4ce78f74d1cf1765704af5b427aa384… https://github.com/nodejs/node/commit/2008c9722fcf7591e39013691f303934b622d… https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-r… https://hackerone.com/reports/1238099 https://hackerone.com/reports/1238709 https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3… https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9f… https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a… https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-r… https://security.archlinux.org/CVE-2021-22939 https://security.archlinux.org/CVE-2021-22940 https://security.archlinux.org/CVE-2021-22959 https://security.archlinux.org/CVE-2021-22960

1 0

[ASA-202110-4] nodejs: url request injection
by Jonas Witschel 21 Oct '21

21 Oct '21

Arch Linux Security Advisory ASA-202110-4 ========================================= Severity: Medium Date : 2021-10-21 CVE-ID : CVE-2021-22959 CVE-2021-22960 Package : nodejs Type : url request injection Remote : Yes Link : https://security.archlinux.org/AVG-2460 Summary ======= The package nodejs before version 16.11.1-1 is vulnerable to url request injection. Resolution ========== Upgrade to 16.11.1-1. # pacman -Syu "nodejs>=16.11.1-1" The problems have been fixed upstream in version 16.11.1. Workaround ========== None. Description =========== - CVE-2021-22959 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). - CVE-2021-22960 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. Impact ====== A remote attacker could inject HTTP requests through crafted queries. References ========== https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-r… https://hackerone.com/reports/1238099 https://hackerone.com/reports/1238709 https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3… https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9f… https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a… https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-r… https://security.archlinux.org/CVE-2021-22959 https://security.archlinux.org/CVE-2021-22960

1 0

[ASA-202110-3] virtualbox: multiple issues
by Jonas Witschel 21 Oct '21

21 Oct '21

Arch Linux Security Advisory ASA-202110-3 ========================================= Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-2475 CVE-2021-35538 CVE-2021-35540 CVE-2021-35542 CVE-2021-35545 Package : virtualbox Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2476 Summary ======= The package virtualbox before version 6.1.28-1 is vulnerable to multiple issues including sandbox escape, denial of service and information disclosure. Resolution ========== Upgrade to 6.1.28-1. # pacman -Syu "virtualbox>=6.1.28-1" The problems have been fixed upstream in version 6.1.28. Workaround ========== None. Description =========== - CVE-2021-2475 (denial of service) A security issue has been found in Oracle VM VirtualBox before version 6.1.28. An easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-35538 (sandbox escape) A security issue has been found in Oracle VM VirtualBox before version 6.1.28. An easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2021-35540 (denial of service) A security issue has been found in Oracle VM VirtualBox before version 6.1.28. An easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-35542 (denial of service) A security issue has been found in Oracle VM VirtualBox before version 6.1.28. An easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-35545 (information disclosure) A security issue has been found in Oracle VM VirtualBox before version 6.1.28. An easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. Impact ====== A malicious virtual machine guest could escape its confinement to run arbitrary code on the host system, disclose sensitive information, or crash VirtualBox. References ========== https://www.oracle.com/security-alerts/cpuoct2021verbose.html#OVIR https://security.archlinux.org/CVE-2021-2475 https://security.archlinux.org/CVE-2021-35538 https://security.archlinux.org/CVE-2021-35540 https://security.archlinux.org/CVE-2021-35542 https://security.archlinux.org/CVE-2021-35545

1 0

[ASA-202110-2] chromium: multiple issues
by Jonas Witschel 21 Oct '21

21 Oct '21

Arch Linux Security Advisory ASA-202110-2 ========================================= Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-37981 CVE-2021-37982 CVE-2021-37983 CVE-2021-37984 CVE-2021-37985 CVE-2021-37986 CVE-2021-37987 CVE-2021-37988 CVE-2021-37989 CVE-2021-37990 CVE-2021-37991 CVE-2021-37992 CVE-2021-37993 CVE-2021-37994 CVE-2021-37995 CVE-2021-37996 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2474 Summary ======= The package chromium before version 95.0.4638.54-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and insufficient validation. Resolution ========== Upgrade to 95.0.4638.54-1. # pacman -Syu "chromium>=95.0.4638.54-1" The problems have been fixed upstream in version 95.0.4638.54. Workaround ========== None. Description =========== - CVE-2021-37981 (arbitrary code execution) A heap buffer overflow security issue has been found in the Skia component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37982 (arbitrary code execution) A use after free security issue has been found in the Incognito component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37983 (arbitrary code execution) A use after free security issue has been found in the Dev Tools component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37984 (arbitrary code execution) A heap buffer overflow security issue has been found in the PDFium component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37985 (arbitrary code execution) A use after free security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37986 (arbitrary code execution) A heap buffer overflow security issue has been found in the Settings component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37987 (arbitrary code execution) A use after free security issue has been found in the Network APIs component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37988 (arbitrary code execution) A use after free security issue has been found in the Profiles component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37989 (arbitrary code execution) An inappropriate implementation security issue has been found in the Blink component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37990 (arbitrary code execution) An inappropriate implementation security issue has been found in the WebView component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37991 (arbitrary code execution) A race security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37992 (information disclosure) An out of bounds read security issue has been found in the WebAudio component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37993 (arbitrary code execution) A use after free security issue has been found in the PDF Accessibility component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37994 (arbitrary code execution) An inappropriate implementation security issue has been found in the iFrame Sandbox component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37995 (arbitrary code execution) An inappropriate implementation security issue has been found in the WebApp Installer component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37996 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Downloads component of the Chromium browser engine before version 95.0.4638.54. Impact ====== A remote attacker could execute arbitrary code or disclose sensitive information through crafted web content. References ========== https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-des… https://crbug.com/1246631 https://crbug.com/1248661 https://crbug.com/1249810 https://crbug.com/1253399 https://crbug.com/1241860 https://crbug.com/1242404 https://crbug.com/1206928 https://crbug.com/1228248 https://crbug.com/1233067 https://crbug.com/1247395 https://crbug.com/1250660 https://crbug.com/1253746 https://crbug.com/1255332 https://crbug.com/1100761 https://crbug.com/1242315 https://crbug.com/1243020 https://security.archlinux.org/CVE-2021-37981 https://security.archlinux.org/CVE-2021-37982 https://security.archlinux.org/CVE-2021-37983 https://security.archlinux.org/CVE-2021-37984 https://security.archlinux.org/CVE-2021-37985 https://security.archlinux.org/CVE-2021-37986 https://security.archlinux.org/CVE-2021-37987 https://security.archlinux.org/CVE-2021-37988 https://security.archlinux.org/CVE-2021-37989 https://security.archlinux.org/CVE-2021-37990 https://security.archlinux.org/CVE-2021-37991 https://security.archlinux.org/CVE-2021-37992 https://security.archlinux.org/CVE-2021-37993 https://security.archlinux.org/CVE-2021-37994 https://security.archlinux.org/CVE-2021-37995 https://security.archlinux.org/CVE-2021-37996

1 0

[ASA-202110-1] apache: directory traversal
by Jonas Witschel 21 Oct '21

21 Oct '21

Arch Linux Security Advisory ASA-202110-1 ========================================= Severity: Critical Date : 2021-10-21 CVE-ID : CVE-2021-42013 Package : apache Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2450 Summary ======= The package apache before version 2.4.51-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 2.4.51-1. # pacman -Syu "apache>=2.4.51-1" The problem has been fixed upstream in version 2.4.51. Workaround ========== None. Description =========== It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions. Impact ====== A remote attacker could trick the HTTP server into executing arbitrary executables in its file system through path traversal. References ========== https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-42013 https://twitter.com/roman_soft/status/1446252280597078024 https://github.com/icing/blog/blob/main/httpd-2.4.50.md https://svn.apache.org/viewvc?view=revision&revision=1893971 https://security.archlinux.org/CVE-2021-42013

1 0