February 2021 - Arch-security - lists.archlinux.org

[ASA-202102-22] helm: insufficient validation
by Remi Gacogne 12 Feb '21

12 Feb '21

Arch Linux Security Advisory ASA-202102-22 ========================================== Severity: Low Date : 2021-02-07 CVE-ID : CVE-2021-21303 Package : helm Type : insufficient validation Remote : No Link : https://security.archlinux.org/AVG-1539 Summary ======= The package helm before version 3.5.2-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 3.5.2-1. # pacman -Syu "helm>=3.5.2-1" The problem has been fixed upstream in version 3.5.2. Workaround ========== None. Description =========== In Helm from version 3.0 and before version 3.5.2, there are a few cases where data loaded from potentially untrusted sources was not properly sanitized. When a SemVer in the `version` field of a chart is invalid, in some cases Helm allows the string to be used "as is" without sanitizing. Helm fails to properly sanitize some fields present in Helm repository `index.yaml` files. Helm does not properly sanitize some fields in the `plugin.yaml` file for plugins. In some cases, Helm does not properly sanitize the fields in the `Chart.yaml` file. By exploiting these attack vectors, core maintainers were able to send deceptive information to a terminal screen running the `helm` command, as well as obscure or alter information on the screen. In some cases, attackers could send codes that terminals used to execute higher-order logic, like clearing a terminal screen. Further, during evaluation, the Helm maintainers discovered a few other fields that were not properly sanitized when read out of repository index files. This fix remedies all such cases, and once again enforces SemVer2 policies on version fields. All users of Helm 3 should upgrade to the fixed version 3.5.2 or later. Those who use Helm as a library should verify that they either sanitize this data on their own, or use the proper Helm API calls to sanitize the data. Impact ====== An attacker might be able to spoof the contents of the terminal when the user runs the "helm" command on a crafted Helm chart that includes unsanitized terminal input codes. References ========== https://github.com/helm/helm/security/advisories/GHSA-c38g-469g-cmgx https://github.com/helm/helm/commit/2bf5c280d56e0043bf1870f84d63e82d5c5d4230 https://security.archlinux.org/CVE-2021-21303

1 0

[ASA-202102-21] privoxy: denial of service
by Remi Gacogne 12 Feb '21

12 Feb '21

Arch Linux Security Advisory ASA-202102-21 ========================================== Severity: Low Date : 2021-02-07 CVE-ID : CVE-2021-20216 CVE-2021-20217 Package : privoxy Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1524 Summary ======= The package privoxy before version 3.0.31-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.0.31-1. # pacman -Syu "privoxy>=3.0.31-1" The problems have been fixed upstream in version 3.0.31. Workaround ========== None. Description =========== - CVE-2021-20216 (denial of service) A security issue was found in privoxy before version 3.0.31. A memory leak when decompression fails unexpectedly may lead to denial of service. - CVE-2021-20217 (denial of service) A security issue was found in privoxy before version 3.0.31. An assertion failure triggered by a crafted CGI request may lead to denial of service. Impact ====== A remote attacker might cause the privoxy server to crash using a crafted request. References ========== https://www.openwall.com/lists/oss-security/2021/01/31/2 https://bugzilla.redhat.com/show_bug.cgi?id=1923256 https://www.privoxy.org/gitweb/?p=privoxy.git;a=commitdiff;h=f431d61740cc03… https://seclists.org/oss-sec/2021/q1/106 https://bugzilla.redhat.com/show_bug.cgi?id=1923252 https://www.privoxy.org/gitweb/?p=privoxy.git;a=commitdiff;h=5bba5b89193fa2… https://security.archlinux.org/CVE-2021-20216 https://security.archlinux.org/CVE-2021-20217

1 0

[ASA-202102-20] python2-jinja: denial of service
by Remi Gacogne 12 Feb '21

12 Feb '21

Arch Linux Security Advisory ASA-202102-20 ========================================== Severity: Low Date : 2021-02-07 CVE-ID : CVE-2020-28493 Package : python2-jinja Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1523 Summary ======= The package python2-jinja before version 2.11.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.11.3-1. # pacman -Syu "python2-jinja>=2.11.3-1" The problem has been fixed upstream in version 2.11.3. Workaround ========== None. Description =========== A security issue was found in python-jinja before version 2.11.3. The regular expression denial of service vulnerability is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory. Impact ====== A remote user might cause a huge CPU utilization via specially crafted input. References ========== https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994 https://github.com/pallets/jinja/pull/1343 https://github.com/pallets/jinja/commit/ef658dc3b6389b091d608e710a810ce8b87… https://security.archlinux.org/CVE-2020-28493

1 0

[ASA-202102-19] python-jinja: denial of service
by Remi Gacogne 12 Feb '21

12 Feb '21

Arch Linux Security Advisory ASA-202102-19 ========================================== Severity: Low Date : 2021-02-07 CVE-ID : CVE-2020-28493 Package : python-jinja Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1523 Summary ======= The package python-jinja before version 2.11.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.11.3-1. # pacman -Syu "python-jinja>=2.11.3-1" The problem has been fixed upstream in version 2.11.3. Workaround ========== None. Description =========== A security issue was found in python-jinja before version 2.11.3. The regular expression denial of service vulnerability is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory. Impact ====== A remote user might cause a huge CPU utilization via specially crafted input. References ========== https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994 https://github.com/pallets/jinja/pull/1343 https://github.com/pallets/jinja/commit/ef658dc3b6389b091d608e710a810ce8b87… https://security.archlinux.org/CVE-2020-28493

1 0

[ASA-202102-18] python-django: directory traversal
by Remi Gacogne 12 Feb '21

12 Feb '21

Arch Linux Security Advisory ASA-202102-18 ========================================== Severity: Low Date : 2021-02-07 CVE-ID : CVE-2021-3281 Package : python-django Type : directory traversal Remote : No Link : https://security.archlinux.org/AVG-1518 Summary ======= The package python-django before version 3.1.6-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 3.1.6-1. # pacman -Syu "python-django>=3.1.6-1" The problem has been fixed upstream in version 3.1.6. Workaround ========== None. Description =========== In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments. Impact ====== An attacker might be able to write files in arbitrary file system locations by tricking the user to select a crafted template file that leads to directory traversal. References ========== https://www.djangoproject.com/weblog/2021/feb/01/security-releases/ https://github.com/django/django/commit/02e6592835b4559909aa3aaaf67988fef43… https://security.archlinux.org/CVE-2021-3281

1 0

[ASA-202102-17] glibc: denial of service
by Remi Gacogne 12 Feb '21

12 Feb '21

Arch Linux Security Advisory ASA-202102-17 ========================================== Severity: Low Date : 2021-02-07 CVE-ID : CVE-2019-25013 CVE-2020-27618 CVE-2020-29562 CVE-2021-3326 Package : glibc Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1320 Summary ======= The package glibc before version 2.33-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.33-1. # pacman -Syu "glibc>=2.33-1" The problems have been fixed upstream in version 2.33. Workaround ========== None. Description =========== - CVE-2019-25013 (denial of service) The iconv feature in glibc up to version 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. The issue is fixed in glibc version 2.33. - CVE-2020-27618 (denial of service) A flaw was found in glibc up to version 2.32. If an attacker provides the iconv function with invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, IBM1399 encodings, it fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service. The issue is fixed in glibc version 2.33. - CVE-2020-29562 (denial of service) The iconv function in glibc version 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. The issue is fixed in glibc version 2.33. - CVE-2021-3326 (denial of service) The iconv function in glibc version 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. The issue is fixed in glibc version 2.33. Impact ====== A local attacker might cause a crash via specially crafted input. References ========== https://sourceware.org/pipermail/libc-alpha/2021-February/122207.html https://sourceware.org/bugzilla/show_bug.cgi?id=24973 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=ee7a3144c99228081810… https://bugzilla.redhat.com/show_bug.cgi?id=1893708 https://sourceware.org/bugzilla/show_bug.cgi?id=26224 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=9a99c682144bdbd40792… https://sourceware.org/bugzilla/show_bug.cgi?id=26923 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=228edd356f03bf62dcf2… https://www.openwall.com/lists/oss-security/2021/01/27/3 https://sourceware.org/bugzilla/show_bug.cgi?id=27256 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=7d88c6142c6efc160c0e… https://security.archlinux.org/CVE-2019-25013 https://security.archlinux.org/CVE-2020-27618 https://security.archlinux.org/CVE-2020-29562 https://security.archlinux.org/CVE-2021-3326

1 0

[ASA-202102-16] lib32-glibc: denial of service
by Remi Gacogne 12 Feb '21

12 Feb '21

Arch Linux Security Advisory ASA-202102-16 ========================================== Severity: Low Date : 2021-02-07 CVE-ID : CVE-2019-25013 CVE-2020-27618 CVE-2020-29562 CVE-2021-3326 Package : lib32-glibc Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1320 Summary ======= The package lib32-glibc before version 2.33-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.33-1. # pacman -Syu "lib32-glibc>=2.33-1" The problems have been fixed upstream in version 2.33. Workaround ========== None. Description =========== - CVE-2019-25013 (denial of service) The iconv feature in glibc up to version 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. The issue is fixed in glibc version 2.33. - CVE-2020-27618 (denial of service) A flaw was found in glibc up to version 2.32. If an attacker provides the iconv function with invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, IBM1399 encodings, it fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service. The issue is fixed in glibc version 2.33. - CVE-2020-29562 (denial of service) The iconv function in glibc version 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. The issue is fixed in glibc version 2.33. - CVE-2021-3326 (denial of service) The iconv function in glibc version 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. The issue is fixed in glibc version 2.33. Impact ====== A local attacker might cause a crash via specially crafted input. References ========== https://sourceware.org/pipermail/libc-alpha/2021-February/122207.html https://sourceware.org/bugzilla/show_bug.cgi?id=24973 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=ee7a3144c99228081810… https://bugzilla.redhat.com/show_bug.cgi?id=1893708 https://sourceware.org/bugzilla/show_bug.cgi?id=26224 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=9a99c682144bdbd40792… https://sourceware.org/bugzilla/show_bug.cgi?id=26923 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=228edd356f03bf62dcf2… https://www.openwall.com/lists/oss-security/2021/01/27/3 https://sourceware.org/bugzilla/show_bug.cgi?id=27256 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=7d88c6142c6efc160c0e… https://security.archlinux.org/CVE-2019-25013 https://security.archlinux.org/CVE-2020-27618 https://security.archlinux.org/CVE-2020-29562 https://security.archlinux.org/CVE-2021-3326

1 0

[ASA-202102-15] php: denial of service
by Remi Gacogne 12 Feb '21

12 Feb '21

Arch Linux Security Advisory ASA-202102-15 ========================================== Severity: Medium Date : 2021-02-07 CVE-ID : CVE-2021-21702 Package : php Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1531 Summary ======= The package php before version 8.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 8.0.2-1. # pacman -Syu "php>=8.0.2-1" The problem has been fixed upstream in version 8.0.2. Workaround ========== None. Description =========== A security issue was found in PHP before versions 8.0.2, 7.4.15 and 7.3.27. PHP will crash with a SIGSEGV via null-pointer dereference whenever an XML is provided to the SoapClient query() function without an existing field. The issue is fixed in versions 8.0.2, 7.4.15 and 7.3.27. Impact ====== A remote attacker might be able to crash PHP via a specially crafted XML payload. References ========== https://bugs.php.net/bug.php?id=80672 https://git.php.net/?p=php-src.git;a=commitdiff;h=f733ee195462201b2cbd1d17d… https://git.php.net/?p=php-src.git;a=commitdiff;h=91655b45ea0a81f2d3003a7e6… https://git.php.net/?p=php-src.git;a=commitdiff;h=3c939e3f69955d087e0bb6718… https://security.archlinux.org/CVE-2021-21702

1 0

[ASA-202102-14] php7: denial of service
by Remi Gacogne 12 Feb '21

12 Feb '21

Arch Linux Security Advisory ASA-202102-14 ========================================== Severity: Medium Date : 2021-02-06 CVE-ID : CVE-2021-21702 Package : php7 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1532 Summary ======= The package php7 before version 7.4.15-1 is vulnerable to denial of service. Resolution ========== Upgrade to 7.4.15-1. # pacman -Syu "php7>=7.4.15-1" The problem has been fixed upstream in version 7.4.15. Workaround ========== None. Description =========== A security issue was found in PHP before versions 8.0.2, 7.4.15 and 7.3.27. PHP will crash with a SIGSEGV via null-pointer dereference whenever an XML is provided to the SoapClient query() function without an existing field. The issue is fixed in versions 8.0.2, 7.4.15 and 7.3.27. Impact ====== A remote attacker might be able to crash PHP via a specially crafted XML payload. References ========== https://bugs.php.net/bug.php?id=80672 https://git.php.net/?p=php-src.git;a=commitdiff;h=f733ee195462201b2cbd1d17d… https://git.php.net/?p=php-src.git;a=commitdiff;h=91655b45ea0a81f2d3003a7e6… https://git.php.net/?p=php-src.git;a=commitdiff;h=3c939e3f69955d087e0bb6718… https://security.archlinux.org/CVE-2021-21702

1 0

[ASA-202102-13] cups: information disclosure
by Remi Gacogne 12 Feb '21

12 Feb '21

Arch Linux Security Advisory ASA-202102-13 ========================================== Severity: Medium Date : 2021-02-06 CVE-ID : CVE-2020-10001 Package : cups Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1529 Summary ======= The package cups before version 1:2.3.3op2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1:2.3.3op2-1. # pacman -Syu "cups>=1:2.3.3op2-1" The problem has been fixed upstream in version 2.3.3op2. Workaround ========== None. Description =========== A security issue was found in cups before version 2.3.3op2. A missing length check in the ippReadIO function could lead to a buffer over- read. Impact ====== A remote attacker might be able to cause a denial of service or access sensitive information. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1921680 https://bugzilla.redhat.com/attachment.cgi?id=1752147 https://github.com/OpenPrinting/cups/commit/efbea1742bd30f842fbbfb87a473e5c… https://security.archlinux.org/CVE-2020-10001

1 0