February 2021 - Arch-security - lists.archlinux.org

[ASA-202102-32] mumble: arbitrary code execution
by Morten Linderud 25 Feb '21

25 Feb '21

Arch Linux Security Advisory ASA-202102-32 ========================================== Severity: Medium Date : 2021-02-20 CVE-ID : CVE-2021-27229 Package : mumble Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1576 Summary ======= The package mumble before version 1.3.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.3.4-1. # pacman -Syu "mumble>=1.3.4-1" The problem has been fixed upstream in version 1.3.4. Workaround ========== None. Description =========== Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text. Impact ====== A remote attacker is able to execute arbitrary code by tricking the user into opening the web page text of a server list. References ========== https://github.com/mumble-voip/mumble/pull/4733 https://github.com/mumble-voip/mumble/commit/e59ee87abe249f345908c7d568f687… https://security.archlinux.org/CVE-2021-27229

1 0

[ASA-202102-31] postgresql: information disclosure
by Morten Linderud 25 Feb '21

25 Feb '21

Arch Linux Security Advisory ASA-202102-31 ========================================== Severity: Medium Date : 2021-02-20 CVE-ID : CVE-2021-3393 CVE-2021-20229 Package : postgresql Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1567 Summary ======= The package postgresql before version 13.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 13.2-1. # pacman -Syu "postgresql>=13.2-1" The problems have been fixed upstream in version 13.2. Workaround ========== None. Description =========== - CVE-2021-3393 (information disclosure) A security issue was found in PostgreSQL 11 to 13 before version 13.2. A user having an UPDATE privilege on a partitioned table but lacking the SELECT privilege on some column may be able to acquire denied- column values from an error message. This is similar to CVE-2014-8161, but the conditions to exploit are more rare. - CVE-2021-20229 (information disclosure) A security issue was found in PostgreSQL 13 before version 13.2. A user having a SELECT privilege on an individual column can craft a special query that returns all columns of the table. Additionally, a stored view that uses column-level privileges will have incomplete column-usage bitmaps. In installations that depend on column-level permissions for security, it is recommended to execute CREATE OR REPLACE on all user-defined views to force them to be re-parsed. Impact ====== A remote, authenticated user is able to disclose information by executing crafted SQL queries. References ========== https://www.postgresql.org/about/news/postgresql-132-126-1111-1016-9621-and… https://github.com/postgres/postgres/commit/8e56684d54d44ba4ed737d5847d31fb… https://github.com/postgres/postgres/commit/d525fbcfd167b28818301d0a2d3548a… https://security.archlinux.org/CVE-2021-3393 https://security.archlinux.org/CVE-2021-20229

1 0

[ASA-202102-30] ansible-base: information disclosure
by Morten Linderud 25 Feb '21

25 Feb '21

Arch Linux Security Advisory ASA-202102-30 ========================================== Severity: Medium Date : 2021-02-20 CVE-ID : CVE-2021-20228 Package : ansible-base Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1562 Summary ======= The package ansible-base before version 2.10.6-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.10.6-1. # pacman -Syu "ansible-base>=2.10.6-1" The problem has been fixed upstream in version 2.10.6. Workaround ========== None. Description =========== A flaw was found in the Ansible Engine, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. Impact ====== A local attacker is able to disclose sensitive information when running an Ansible playbook. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1925002 https://github.com/ansible/ansible/pull/73487 https://github.com/ansible/ansible/commit/e41d1f0a3fd6c466192e7e24accd3d1c6… https://security.archlinux.org/CVE-2021-20228

1 0

[ASA-202102-29] keycloak: cross-site scripting
by Morten Linderud 25 Feb '21

25 Feb '21

Arch Linux Security Advisory ASA-202102-29 ========================================== Severity: High Date : 2021-02-20 CVE-ID : CVE-2021-20195 Package : keycloak Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1578 Summary ======= The package keycloak before version 12.0.3-1 is vulnerable to cross- site scripting. Resolution ========== Upgrade to 12.0.3-1. # pacman -Syu "keycloak>=12.0.3-1" The problem has been fixed upstream in version 12.0.3. Workaround ========== None. Description =========== A security issue was found in keycloak before version 12.0.3. A self stored cross-site scripting (XSS) attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. Specifically, the Account page does not HTML-encode the user first name, and last name, which means a malicious HTML code, which executes malicious Javascript code, can be embedded into the Account page. Even though the malicious Javascript code is linked to the attacker user (Self-XSS), it can be exploited on the Keycloak admin browser, using the Impersonation functionality, and thus the attacker is able to compromise Keycloak. Impact ====== A malicious user can execute arbitrary code in Keycloak's account page possibly compromising Keycloak's admin account. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1919143 https://issues.redhat.com/browse/KEYCLOAK-16890 https://github.com/keycloak/keycloak/commit/87422b77aee787c6c55ca22fde31c60… https://security.archlinux.org/CVE-2021-20195

1 0

[ASA-202102-28] python-django: url request injection
by Morten Linderud 22 Feb '21

22 Feb '21

Arch Linux Security Advisory ASA-202102-28 ========================================== Severity: Medium Date : 2021-02-20 CVE-ID : CVE-2021-23336 Package : python-django Type : url request injection Remote : Yes Link : https://security.archlinux.org/AVG-1593 Summary ======= The package python-django before version 3.1.7-1 is vulnerable to url request injection. Resolution ========== Upgrade to 3.1.7-1. # pacman -Syu "python-django>=3.1.7-1" The problem has been fixed upstream in version 3.1.7. Workaround ========== None. Description =========== The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. The package python-django contains a copy of urllib.parse.parse_qsl() which was added to backport some security fixes. A further security fix has been issued in versions 3.1.7, 3.0.13 and 2.2.19 such that parse_qsl() no longer allows using ; as a query parameter separator by default. Impact ====== A remote attacker is able to insert malicious requests in the web proxy cache. References ========== https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933 https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/ https://bugs.python.org/issue42967 https://github.com/python/cpython/pull/24297 https://github.com/python/cpython/commit/c9f07813ab8e664d8c34413c4fc2d4f86c… https://www.djangoproject.com/weblog/2021/feb/19/security-releases/ https://github.com/django/django/commit/8f6d431b08cbb418d9144b976e7b9725466… https://security.archlinux.org/CVE-2021-23336

1 0

[ASA-202102-27] roundcubemail: cross-site scripting
by Morten Linderud 22 Feb '21

22 Feb '21

Arch Linux Security Advisory ASA-202102-27 ========================================== Severity: High Date : 2021-02-12 CVE-ID : CVE-2021-26925 Package : roundcubemail Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1551 Summary ======= The package roundcubemail before version 1.4.11-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.4.11-1. # pacman -Syu "roundcubemail>=1.4.11-1" The problem has been fixed upstream in version 1.4.11. Workaround ========== None. Description =========== Roundcube before 1.4.11 allows cross-site scripting (XSS) via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering. Impact ====== A remote attacker might be able to perform cross-site scripting via crafted CSS content in a HTML message. References ========== https://roundcube.net/news/2021/02/08/security-update-1.4.11 https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1b… https://security.archlinux.org/CVE-2021-26925

1 0

[ASA-202102-26] firejail: privilege escalation
by Morten Linderud 22 Feb '21

22 Feb '21

Arch Linux Security Advisory ASA-202102-26 ========================================== Severity: High Date : 2021-02-12 CVE-ID : CVE-2021-26910 Package : firejail Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1545 Summary ======= The package firejail before version 0.9.64.4-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 0.9.64.4-1. # pacman -Syu "firejail>=0.9.64.4-1" The problem has been fixed upstream in version 0.9.64.4. Workaround ========== The issue can be mitigated by setting "overlayfs no" in /etc/firejail/firejail.config. Description =========== Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation. Impact ====== A local unprivileged attacker can obtain arbitrary file system access for an application running within a firejail sandbox, leading to potential privilege escalation. References ========== https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for… https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8… https://security.archlinux.org/CVE-2021-26910

1 0

[ASA-202102-25] wpa_supplicant: arbitrary code execution
by Morten Linderud 22 Feb '21

22 Feb '21

Arch Linux Security Advisory ASA-202102-25 ========================================== Severity: High Date : 2021-02-12 CVE-ID : CVE-2021-0326 Package : wpa_supplicant Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1530 Summary ======= The package wpa_supplicant before version 2:2.9-8 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2:2.9-8. # pacman -Syu "wpa_supplicant>=2:2.9-8" The problem has been fixed upstream but no release is available yet. Workaround ========== The issue can be mitigated by disabling P2P, using the control interface command "P2P_SET disabled 1" or "p2p_disabled=1" in (each, if multiple interfaces used) wpa_supplicant configuration file. Description =========== A security issue was found in hostapd and wpa_supplicant version 2.9. A missing length check in the p2p_copy_client_info function could lead to a buffer overflow. Impact ====== An attacker within radio range of the device running P2P discovery might be able to cause a crash or execute arbitrary code. References ========== https://bugs.archlinux.org/task/69525 https://w1.fi/security/2020-2/wpa_supplicant-p2p-group-info-processing-vuln… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27269 https://w1.fi/cgit/hostap/commit/?id=947272febe24a8f0ea828b5b2f35f13c382190… https://security.archlinux.org/CVE-2021-0326

1 0

[ASA-202102-24] connman: multiple issues
by Morten Linderud 22 Feb '21

22 Feb '21

Arch Linux Security Advisory ASA-202102-24 ========================================== Severity: Critical Date : 2021-02-12 CVE-ID : CVE-2021-26675 CVE-2021-26676 Package : connman Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1543 Summary ======= The package connman before version 1.39-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 1.39-1. # pacman -Syu "connman>=1.39-1" The problems have been fixed upstream in version 1.39. Workaround ========== None. Description =========== - CVE-2021-26675 (arbitrary code execution) A security issue was found in connman 1.38. A stack buffer overflow can be used to execute code by network adjacent attackers. - CVE-2021-26676 (information disclosure) A security issue was found in connman 1.38. A stack information leak from an uninitialised variable can lead to information disclosure to a remote attacker. This information can be used to help exploiting CVE-2021-26675 reliably. Impact ====== A network adjacent attacker can execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/69583 https://www.openwall.com/lists/oss-security/2021/02/08/2 https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=e4079… https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=58d39… https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=a7452… https://security.archlinux.org/CVE-2021-26675 https://security.archlinux.org/CVE-2021-26676

1 0

[ASA-202102-23] linux: arbitrary code execution
by Morten Linderud 22 Feb '21

22 Feb '21

Arch Linux Security Advisory ASA-202102-23 ========================================== Severity: Medium Date : 2021-02-12 CVE-ID : CVE-2021-3347 Package : linux Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1506 Summary ======= The package linux before version 5.10.12.arch1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.10.12.arch1-1. # pacman -Syu "linux>=5.10.12.arch1-1" The problem has been fixed upstream in version 5.10.12.arch1. Workaround ========== None. Description =========== An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458. Impact ====== An attacker can escalate privileges on the system by abusing io_uring descriptor initialization. References ========== https://www.openwall.com/lists/oss-security/2021/01/29/1 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2021-3347

1 0