November 2021 - Arch-security - lists.archlinux.org

[ASA-202111-9] chromium: multiple issues
by Jonas Witschel 19 Nov '21

19 Nov '21

Arch Linux Security Advisory ASA-202111-9 ========================================= Severity: High Date : 2021-11-18 CVE-ID : CVE-2021-38005 CVE-2021-38006 CVE-2021-38007 CVE-2021-38008 CVE-2021-38009 CVE-2021-38010 CVE-2021-38011 CVE-2021-38012 CVE-2021-38013 CVE-2021-38014 CVE-2021-38015 CVE-2021-38016 CVE-2021-38017 CVE-2021-38018 CVE-2021-38019 CVE-2021-38020 CVE-2021-38021 CVE-2021-38022 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2560 Summary ======= The package chromium before version 96.0.4664.45-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, content spoofing, information disclosure, same-origin policy bypass, sandbox escape and denial of service. Resolution ========== Upgrade to 96.0.4664.45-1. # pacman -Syu "chromium>=96.0.4664.45-1" The problems have been fixed upstream in version 96.0.4664.45. Workaround ========== None. Description =========== - CVE-2021-38005 (arbitrary code execution) A use after free security issue has been found in the loader component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38006 (arbitrary code execution) A use after free security issue has been found in the storage foundation component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38007 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38008 (arbitrary code execution) A use after free security issue has been found in the media component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38009 (arbitrary code execution) An inappropriate implementation security issue has been found in the cache component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38010 (arbitrary code execution) An inappropriate implementation security issue has been found in the service workers component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38011 (arbitrary code execution) A use after free security issue has been found in the storage foundation component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38012 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38013 (arbitrary code execution) A heap buffer overflow security issue has been found in the fingerprint recognition component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38014 (arbitrary code execution) An out of bounds write security issue has been found in the Swiftshader component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38015 (arbitrary code execution) An inappropriate implementation security issue has been found in the input component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38016 (access restriction bypass) An insufficient policy enforcement security issue has been found in the background fetch component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38017 (sandbox escape) An insufficient policy enforcement security issue has been found in the iframe sandbox component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38018 (content spoofing) An inappropriate implementation security issue has been found in the navigation component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38019 (same-origin policy bypass) An insufficient policy enforcement security issue has been found in the CORS component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38020 (information disclosure) An insufficient policy enforcement security issue has been found in the contacts picker component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38021 (information disclosure) An inappropriate implementation security issue has been found in the referrer component of the Chromium browser engine before version 96.0.4664.45. - CVE-2021-38022 (denial of service) An inappropriate implementation security issue has been found in the WebAuthentication component of the Chromium browser engine before version 96.0.4664.45. Impact ====== A remote attacker could execute arbitrary code, spoof content, bypass security restrictions or crash the browser through crafted web content. References ========== https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-des… https://crbug.com/1241091 https://crbug.com/1240593 https://crbug.com/1254189 https://crbug.com/1263620 https://crbug.com/1260649 https://crbug.com/1264477 https://crbug.com/1268274 https://crbug.com/1262791 https://crbug.com/1242392 https://crbug.com/1248567 https://crbug.com/957553 https://crbug.com/1244289 https://crbug.com/1256822 https://crbug.com/1197889 https://crbug.com/1251179 https://crbug.com/1259694 https://crbug.com/1233375 https://crbug.com/1248862 https://security.archlinux.org/CVE-2021-38005 https://security.archlinux.org/CVE-2021-38006 https://security.archlinux.org/CVE-2021-38007 https://security.archlinux.org/CVE-2021-38008 https://security.archlinux.org/CVE-2021-38009 https://security.archlinux.org/CVE-2021-38010 https://security.archlinux.org/CVE-2021-38011 https://security.archlinux.org/CVE-2021-38012 https://security.archlinux.org/CVE-2021-38013 https://security.archlinux.org/CVE-2021-38014 https://security.archlinux.org/CVE-2021-38015 https://security.archlinux.org/CVE-2021-38016 https://security.archlinux.org/CVE-2021-38017 https://security.archlinux.org/CVE-2021-38018 https://security.archlinux.org/CVE-2021-38019 https://security.archlinux.org/CVE-2021-38020 https://security.archlinux.org/CVE-2021-38021 https://security.archlinux.org/CVE-2021-38022

1 0

[ASA-202111-8] opera: multiple issues
by Jonas Witschel 19 Nov '21

19 Nov '21

Arch Linux Security Advisory ASA-202111-8 ========================================= Severity: High Date : 2021-11-18 CVE-ID : CVE-2021-37997 CVE-2021-37998 CVE-2021-37999 CVE-2021-38000 CVE-2021-38001 CVE-2021-38002 CVE-2021-38003 CVE-2021-38004 Package : opera Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2525 Summary ======= The package opera before version 81.0.4196.54-1 is vulnerable to multiple issues including arbitrary code execution, insufficient validation and access restriction bypass. Resolution ========== Upgrade to 81.0.4196.54-1. # pacman -Syu "opera>=81.0.4196.54-1" The problems have been fixed upstream in version 81.0.4196.54. Workaround ========== None. Description =========== - CVE-2021-37997 (arbitrary code execution) A use after free security issue has been found in the Sign-In component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-37998 (arbitrary code execution) A use after free security issue has been found in the Garbage Collection component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-37999 (insufficient validation) An insufficient data validation security issue has been found in the New Tab Page component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-38000 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Intents component of the Chromium browser engine before version 95.0.4638.69. Google is aware that an exploit for CVE-2021-38000 exists in the wild. - CVE-2021-38001 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-38002 (arbitrary code execution) A use after free security issue has been found in the Web Transport component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-38003 (arbitrary code execution) An inappropriate implementation security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.69. Google is aware that an exploit for CVE-2021-38003 exists in the wild. - CVE-2021-38004 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Autofill component of the Chromium browser engine before version 95.0.4638.69. Impact ====== A remote attacker could execute arbitrary code through crafted web content. Google is aware that exploits for two of the security issues exist in the wild. References ========== https://blogs.opera.com/desktop/changelog-for-81/ https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-des… https://crbug.com/1259864 https://crbug.com/1259587 https://crbug.com/1251541 https://crbug.com/1249962 https://crbug.com/1260577 https://crbug.com/1260940 https://crbug.com/1263462 https://crbug.com/1227170 https://security.archlinux.org/CVE-2021-37997 https://security.archlinux.org/CVE-2021-37998 https://security.archlinux.org/CVE-2021-37999 https://security.archlinux.org/CVE-2021-38000 https://security.archlinux.org/CVE-2021-38001 https://security.archlinux.org/CVE-2021-38002 https://security.archlinux.org/CVE-2021-38003 https://security.archlinux.org/CVE-2021-38004

1 0

[ASA-202111-7] kubectl-ingress-nginx: information disclosure
by Jonas Witschel 19 Nov '21

19 Nov '21

Arch Linux Security Advisory ASA-202111-7 ========================================= Severity: High Date : 2021-11-18 CVE-ID : CVE-2021-25742 Package : kubectl-ingress-nginx Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2490 Summary ======= The package kubectl-ingress-nginx before version 1.0.4-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.0.4-1. # pacman -Syu "kubectl-ingress-nginx>=1.0.4-1" The problem has been fixed upstream in version 1.0.4. Workaround ========== This issue cannot be fixed solely by upgrading kubectl-ingress-nginx. To mitigate, set allow-snippet-annotations to false in your ingress- nginx ConfigMap based on how you deploy ingress-nginx, see the references for more information. Description =========== A security issue was discovered in ingress-nginx before versions 1.0.1 and 0.49.1 where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster. This issue cannot be fixed solely by upgrading ingress-nginx. To mitigate, set allow-snippet-annotations to false in your ingress-nginx ConfigMap based on how you deploy ingress-nginx, see the references for more information. Impact ====== An authenticated remote attacker could disclose all secrets in the cluster. References ========== https://github.com/kubernetes/ingress-nginx/issues/7837 https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/c… https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/c… https://github.com/kubernetes/ingress-nginx/pull/7670 https://github.com/kubernetes/ingress-nginx/commit/4fc57dcc4969cd907c6eeadf… https://security.archlinux.org/CVE-2021-25742

1 0

[ASA-202111-6] grafana: access restriction bypass
by Jonas Witschel 19 Nov '21

19 Nov '21

Arch Linux Security Advisory ASA-202111-6 ========================================= Severity: Medium Date : 2021-11-18 CVE-ID : CVE-2021-41244 Package : grafana Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-2559 Summary ======= The package grafana before version 8.2.4-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 8.2.4-1. # pacman -Syu "grafana>=8.2.4-1" The problem has been fixed upstream in version 8.2.4. Workaround ========== The issue can be mitigated by turning off the fine-grained access control using a feature flag. Description =========== A security issue has been found in Grafana 8.0 before version 8.2.4. When the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, users with the Organization Admin role can list, add, remove, and update users’ roles in other organizations in which they are not an admin. Impact ====== An authenticated remote attacker could change user roles in organizations in which they are not an admin. References ========== https://github.com/grafana/grafana/security/advisories/GHSA-mpwp-42x6-4wmx https://github.com/grafana/grafana/commit/5fb0bd30e88e8c9211c42c94539c5297e… https://security.archlinux.org/CVE-2021-41244

1 0

[ASA-202111-5] grafana: cross-site scripting
by Jonas Witschel 09 Nov '21

09 Nov '21

Arch Linux Security Advisory ASA-202111-5 ========================================= Severity: Medium Date : 2021-11-05 CVE-ID : CVE-2021-41174 Package : grafana Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2517 Summary ======= The package grafana before version 8.2.3-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 8.2.3-1. # pacman -Syu "grafana>=8.2.3-1" The problem has been fixed upstream in version 8.2.3. Workaround ========== To mitigate the issue, a reverse proxy or similar can be used to block access to block the literal string "{{" in the path. Description =========== A security issue has been found in Grafana before version 8.2.3. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. There are two ways an unauthenticated user can open a page in Grafana that contains the login button: - Anonymous authentication is enabled. This means all pages in Grafana would be open for the attack. - The link is to an unauthenticated page. The following pages are vulnerable: - /dashboard-solo/snapshot/* - /dashboard/snapshot/* - /invite/:code The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} An example of an expression would be: "{{constructor.constructor(‘alert(1)’)()}}". This can be included in the link URL like this: https://play.grafana.org/dashboard/snapshot/%7B%7Bconstructor.construct or('alert(1)')()%7D%7D?orgId=1 When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated and the AngularJS rendering engine will execute the JavaScript expression contained in the URL. Impact ====== A remote attacker could execute arbitrary JavaScript code by tricking an unauthenticated victim into opening a crafted URL. References ========== https://github.com/grafana/grafana/security/advisories/GHSA-3j9m-hcv9-rpj8 https://github.com/grafana/grafana/commit/34eda6123d9b21c2c0b2d0c0e6f2fb38e… https://github.com/grafana/grafana/commit/a3dc30546fce2e437d858c140f1ff307a… https://github.com/grafana/grafana/commit/8081dc9ee913a1bf4b98f99e78661db88… https://github.com/grafana/grafana/commit/1c7ce348ce4363c55992ed5772f96981d… https://security.archlinux.org/CVE-2021-41174

1 0

[ASA-202111-4] opera: multiple issues
by Jonas Witschel 09 Nov '21

09 Nov '21

Arch Linux Security Advisory ASA-202111-4 ========================================= Severity: High Date : 2021-11-05 CVE-ID : CVE-2021-37981 CVE-2021-37982 CVE-2021-37983 CVE-2021-37984 CVE-2021-37985 CVE-2021-37986 CVE-2021-37987 CVE-2021-37988 CVE-2021-37989 CVE-2021-37990 CVE-2021-37991 CVE-2021-37992 CVE-2021-37993 CVE-2021-37994 CVE-2021-37995 CVE-2021-37996 Package : opera Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2468 Summary ======= The package opera before version 81.0.4196.31-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and insufficient validation. Resolution ========== Upgrade to 81.0.4196.31-1. # pacman -Syu "opera>=81.0.4196.31-1" The problems have been fixed upstream in version 81.0.4196.31. Workaround ========== None. Description =========== - CVE-2021-37981 (arbitrary code execution) A heap buffer overflow security issue has been found in the Skia component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37982 (arbitrary code execution) A use after free security issue has been found in the Incognito component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37983 (arbitrary code execution) A use after free security issue has been found in the Dev Tools component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37984 (arbitrary code execution) A heap buffer overflow security issue has been found in the PDFium component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37985 (arbitrary code execution) A use after free security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37986 (arbitrary code execution) A heap buffer overflow security issue has been found in the Settings component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37987 (arbitrary code execution) A use after free security issue has been found in the Network APIs component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37988 (arbitrary code execution) A use after free security issue has been found in the Profiles component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37989 (arbitrary code execution) An inappropriate implementation security issue has been found in the Blink component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37990 (arbitrary code execution) An inappropriate implementation security issue has been found in the WebView component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37991 (arbitrary code execution) A race security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37992 (information disclosure) An out of bounds read security issue has been found in the WebAudio component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37993 (arbitrary code execution) A use after free security issue has been found in the PDF Accessibility component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37994 (arbitrary code execution) An inappropriate implementation security issue has been found in the iFrame Sandbox component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37995 (arbitrary code execution) An inappropriate implementation security issue has been found in the WebApp Installer component of the Chromium browser engine before version 95.0.4638.54. - CVE-2021-37996 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Downloads component of the Chromium browser engine before version 95.0.4638.54. Impact ====== A remote attacker could execute arbitrary code or disclose sensitive information through crafted web content. References ========== https://blogs.opera.com/desktop/changelog-for-80/ https://blogs.opera.com/desktop/changelog-for-81/ https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-des… https://crbug.com/1246631 https://crbug.com/1248661 https://crbug.com/1249810 https://crbug.com/1253399 https://crbug.com/1241860 https://crbug.com/1242404 https://crbug.com/1206928 https://crbug.com/1228248 https://crbug.com/1233067 https://crbug.com/1247395 https://crbug.com/1250660 https://crbug.com/1253746 https://crbug.com/1255332 https://crbug.com/1100761 https://crbug.com/1242315 https://crbug.com/1243020 https://security.archlinux.org/CVE-2021-37981 https://security.archlinux.org/CVE-2021-37982 https://security.archlinux.org/CVE-2021-37983 https://security.archlinux.org/CVE-2021-37984 https://security.archlinux.org/CVE-2021-37985 https://security.archlinux.org/CVE-2021-37986 https://security.archlinux.org/CVE-2021-37987 https://security.archlinux.org/CVE-2021-37988 https://security.archlinux.org/CVE-2021-37989 https://security.archlinux.org/CVE-2021-37990 https://security.archlinux.org/CVE-2021-37991 https://security.archlinux.org/CVE-2021-37992 https://security.archlinux.org/CVE-2021-37993 https://security.archlinux.org/CVE-2021-37994 https://security.archlinux.org/CVE-2021-37995 https://security.archlinux.org/CVE-2021-37996

1 0

[ASA-202111-3] thunderbird: multiple issues
by Jonas Witschel 09 Nov '21

09 Nov '21

Arch Linux Security Advisory ASA-202111-3 ========================================= Severity: High Date : 2021-11-05 CVE-ID : CVE-2021-38503 CVE-2021-38504 CVE-2021-38506 CVE-2021-38507 CVE-2021-38508 CVE-2021-38509 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2518 Summary ======= The package thunderbird before version 91.3.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, same-origin policy bypass and sandbox escape. Resolution ========== Upgrade to 91.3.0-1. # pacman -Syu "thunderbird>=91.3.0-1" The problems have been fixed upstream in version 91.3.0. Workaround ========== None. Description =========== - CVE-2021-38503 (sandbox escape) A security issue has been found in Firefox before version 94 and Thunderbird before version 91.3. The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. - CVE-2021-38504 (arbitrary code execution) A security issue has been found in Firefox before version 94 and Thunderbird before version 91.3. When interacting with an HTML input element's file picker dialog with "webkitdirectory" set, a use-after- free could have resulted, leading to memory corruption and a potentially exploitable crash. - CVE-2021-38506 (content spoofing) A security issue has been found in Firefox before version 94 and Thunderbird before version 91.3. Through a series of navigations, Firefox and Thunderbird could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. - CVE-2021-38507 (same-origin policy bypass) A security issue has been found in Firefox before version 94 and Thunderbird before version 91.3. The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on port 80. However, if a second encrypted port on the same IP address (e.g. port 8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin with HTTP. This was resolved by disabling the Opportunistic Encryption feature, which had low usage. - CVE-2021-38508 (content spoofing) A security issue has been found in Firefox before version 94 and Thunderbird before version 91.3. By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permission. - CVE-2021-38509 (content spoofing) A security issue has been found in Firefox before version 94 and Thunderbird before version 91.3. Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the attacker's choosing. Impact ====== A remote attacker could execute arbitrary code, spoof content or bypass same-origin policy through crafted web content. In general, these flaws cannot be exploited through email because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. References ========== https://www.mozilla.org/security/advisories/mfsa2021-48/ https://www.mozilla.org/security/advisories/mfsa2021-50/ https://bugzilla.mozilla.org/show_bug.cgi?id=1729517 https://bugzilla.mozilla.org/show_bug.cgi?id=1730156 https://bugzilla.mozilla.org/show_bug.cgi?id=1730750 https://bugzilla.mozilla.org/show_bug.cgi?id=1730935 https://bugzilla.mozilla.org/show_bug.cgi?id=1366818 https://bugzilla.mozilla.org/show_bug.cgi?id=1718571 https://security.archlinux.org/CVE-2021-38503 https://security.archlinux.org/CVE-2021-38504 https://security.archlinux.org/CVE-2021-38506 https://security.archlinux.org/CVE-2021-38507 https://security.archlinux.org/CVE-2021-38508 https://security.archlinux.org/CVE-2021-38509

1 0

[ASA-202111-2] firefox: multiple issues
by Jonas Witschel 09 Nov '21

09 Nov '21

Arch Linux Security Advisory ASA-202111-2 ========================================= Severity: High Date : 2021-11-05 CVE-ID : CVE-2021-38503 CVE-2021-38504 CVE-2021-38506 CVE-2021-38507 CVE-2021-38508 CVE-2021-38509 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2511 Summary ======= The package firefox before version 94.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, same- origin policy bypass and sandbox escape. Resolution ========== Upgrade to 94.0-1. # pacman -Syu "firefox>=94.0-1" The problems have been fixed upstream in version 94.0. Workaround ========== None. Description =========== - CVE-2021-38503 (sandbox escape) A security issue has been found in Firefox before version 94 and Thunderbird before version 91.3. The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. - CVE-2021-38504 (arbitrary code execution) A security issue has been found in Firefox before version 94 and Thunderbird before version 91.3. When interacting with an HTML input element's file picker dialog with "webkitdirectory" set, a use-after- free could have resulted, leading to memory corruption and a potentially exploitable crash. - CVE-2021-38506 (content spoofing) A security issue has been found in Firefox before version 94 and Thunderbird before version 91.3. Through a series of navigations, Firefox and Thunderbird could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. - CVE-2021-38507 (same-origin policy bypass) A security issue has been found in Firefox before version 94 and Thunderbird before version 91.3. The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on port 80. However, if a second encrypted port on the same IP address (e.g. port 8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin with HTTP. This was resolved by disabling the Opportunistic Encryption feature, which had low usage. - CVE-2021-38508 (content spoofing) A security issue has been found in Firefox before version 94 and Thunderbird before version 91.3. By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permission. - CVE-2021-38509 (content spoofing) A security issue has been found in Firefox before version 94 and Thunderbird before version 91.3. Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the attacker's choosing. Impact ====== A remote attacker could execute arbitrary code, spoof content or bypass same-origin policy through crafted web content. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2021-48/ https://www.mozilla.org/security/advisories/mfsa2021-48/ https://www.mozilla.org/security/advisories/mfsa2021-50/ https://bugzilla.mozilla.org/show_bug.cgi?id=1729517 https://bugzilla.mozilla.org/show_bug.cgi?id=1730156 https://bugzilla.mozilla.org/show_bug.cgi?id=1730750 https://bugzilla.mozilla.org/show_bug.cgi?id=1730935 https://bugzilla.mozilla.org/show_bug.cgi?id=1366818 https://bugzilla.mozilla.org/show_bug.cgi?id=1718571 https://security.archlinux.org/CVE-2021-38503 https://security.archlinux.org/CVE-2021-38504 https://security.archlinux.org/CVE-2021-38506 https://security.archlinux.org/CVE-2021-38507 https://security.archlinux.org/CVE-2021-38508 https://security.archlinux.org/CVE-2021-38509

1 0

[ASA-202111-1] jenkins: multiple issues
by Jonas Witschel 09 Nov '21

09 Nov '21

Arch Linux Security Advisory ASA-202111-1 ========================================= Severity: Critical Date : 2021-11-05 CVE-ID : CVE-2021-21685 CVE-2021-21686 CVE-2021-21687 CVE-2021-21688 CVE-2021-21689 CVE-2021-21690 CVE-2021-21691 CVE-2021-21692 CVE-2021-21693 CVE-2021-21694 CVE-2021-21695 CVE-2021-21696 CVE-2021-21697 Package : jenkins Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2526 Summary ======= The package jenkins before version 2.319-1 is vulnerable to multiple issues including arbitrary filesystem access and sandbox escape. Resolution ========== Upgrade to 2.319-1. # pacman -Syu "jenkins>=2.319-1" The problems have been fixed upstream in version 2.319. Workaround ========== If you are unable to immediately upgrade to Jenkins 2.319 right away, you can install the Remoting Security Workaround Plugin. It will prevent all agent-to-controller file access using FilePath APIs. Because it is more restrictive than Jenkins 2.319, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it. Description =========== - CVE-2021-21685 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. FilePath#mkdirs does not check permission to create parent directories. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21686 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. File path filters do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21687 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. FilePath#untar does not check permission to create symbolic links when unarchiving a symbolic link. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21688 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. FilePath#reading(FileVisitor) does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, #copyRecursiveTo). This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21689 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. FilePath#unzip and FilePath#untar were not subject to any access control. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21690 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21691 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. Creating symbolic links is possible without the symlink permission. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21692 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. The operations FilePath#renameTo and FilePath#moveAllChildrenTo only check read permission on the source path. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21693 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. When creating temporary files, permission to create files is only checked after they’ve been created. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21694 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21695 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. FilePath#listFiles lists files outside directories with agent read access when following symbolic links. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21696 (sandbox escape) Jenkins before version 2.319 does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs. This directory is used by the "Pipeline: Shared Groovy Libraries" Plugin to store copies of shared libraries. This allows attackers in control of agent processes to replace the code of a trusted library with a modified variant, resulting in unsandboxed code execution in the Jenkins controller process. Jenkins 2.319 prohibits agent read/write access to the libs/ directory inside build directories. - CVE-2021-21697 (arbitrary filesystem access) Agents are allowed some limited access to files on the Jenkins controller file system. The directories agents are allowed to access in Jenkins before 2.319 include the directories storing build-related information, intended to allow agents to store build-related metadata during build execution. As a consequence, this allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions (build.xml and some Pipeline-related metadata). Jenkins 2.319 prevents agents from accessing contents of build directories unless it’s for builds currently running on the agent attempting to access the directory. Impact ====== Agent processes could read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. References ========== https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2423 https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2428 https://security.archlinux.org/CVE-2021-21685 https://security.archlinux.org/CVE-2021-21686 https://security.archlinux.org/CVE-2021-21687 https://security.archlinux.org/CVE-2021-21688 https://security.archlinux.org/CVE-2021-21689 https://security.archlinux.org/CVE-2021-21690 https://security.archlinux.org/CVE-2021-21691 https://security.archlinux.org/CVE-2021-21692 https://security.archlinux.org/CVE-2021-21693 https://security.archlinux.org/CVE-2021-21694 https://security.archlinux.org/CVE-2021-21695 https://security.archlinux.org/CVE-2021-21696 https://security.archlinux.org/CVE-2021-21697

1 0

[ASA-202110-12] bind: denial of service
by Jonas Witschel 01 Nov '21

01 Nov '21

Arch Linux Security Advisory ASA-202110-12 ========================================== Severity: Medium Date : 2021-10-29 CVE-ID : CVE-2021-25219 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2502 Summary ======= The package bind before version 9.16.22-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.16.22-1. # pacman -Syu "bind>=9.16.22-1" The problem has been fixed upstream in version 9.16.22. Workaround ========== Setting "lame-ttl 0;" in the BIND configuration prevents the performance issue. Description =========== In BIND before version 9.16.22, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing. Impact ====== A malicious DNS client could trigger queries to broken authoritative DNS servers, resulting in high CPU usage and service degradation of the BIND server. References ========== https://kb.isc.org/v1/docs/cve-2021-25219 https://github.com/isc-projects/bind9/commit/8fe18c0566c41228a568157287f5a4… https://security.archlinux.org/CVE-2021-25219

1 0