March 2021 - Arch-security - lists.archlinux.org

[ASA-202103-17] dotnet-sdk: multiple issues
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-17 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-1721 CVE-2021-1723 CVE-2021-24112 Package : dotnet-sdk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1449 Summary ======= The package dotnet-sdk before version 5.0.3.sdk103-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 5.0.3.sdk103-2. # pacman -Syu "dotnet-sdk>=5.0.3.sdk103-2" The problems have been fixed upstream in version 5.0.3.sdk103. Workaround ========== None. Description =========== - CVE-2021-1721 (denial of service) A security issue was found in dotnet-core before version 3.1.12. A denial-of-service vulnerability exists when creating HTTPS web request during X509 certificate chain building. - CVE-2021-1723 (denial of service) A flaw was found in dotnet-core before version 3.1.11. Running callbacks outside of locks results in Krestel deadlock using HTTP2. - CVE-2021-24112 (arbitrary code execution) A remote code execution vulnerability exists in dotnet-core before version 3.1.12 when parsing certain types of graphics files. This vulnerability only exists on systems running on MacOS or Linux. Impact ====== A malicious client can send crafted HTTP requests and crash the server, or execute arbitrary code by reading a crafted file. References ========== https://bugs.archlinux.org/task/69317 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1721 https://github.com/dotnet/announcements/issues/175 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1723 https://github.com/dotnet/announcements/issues/170 https://github.com/dotnet/aspnetcore/commit/20ad9fa5dcde635c13c6c83806c4701… https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24112 https://github.com/dotnet/announcements/issues/176 https://security.archlinux.org/CVE-2021-1721 https://security.archlinux.org/CVE-2021-1723 https://security.archlinux.org/CVE-2021-24112

1 0

[ASA-202103-16] dotnet-runtime: multiple issues
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-16 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-1721 CVE-2021-1723 CVE-2021-24112 Package : dotnet-runtime Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1449 Summary ======= The package dotnet-runtime before version 5.0.3.sdk103-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 5.0.3.sdk103-2. # pacman -Syu "dotnet-runtime>=5.0.3.sdk103-2" The problems have been fixed upstream in version 5.0.3.sdk103. Workaround ========== None. Description =========== - CVE-2021-1721 (denial of service) A security issue was found in dotnet-core before version 3.1.12. A denial-of-service vulnerability exists when creating HTTPS web request during X509 certificate chain building. - CVE-2021-1723 (denial of service) A flaw was found in dotnet-core before version 3.1.11. Running callbacks outside of locks results in Krestel deadlock using HTTP2. - CVE-2021-24112 (arbitrary code execution) A remote code execution vulnerability exists in dotnet-core before version 3.1.12 when parsing certain types of graphics files. This vulnerability only exists on systems running on MacOS or Linux. Impact ====== A malicious client can send crafted HTTP requests and crash the server, or execute arbitrary code by reading a crafted file. References ========== https://bugs.archlinux.org/task/69317 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1721 https://github.com/dotnet/announcements/issues/175 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1723 https://github.com/dotnet/announcements/issues/170 https://github.com/dotnet/aspnetcore/commit/20ad9fa5dcde635c13c6c83806c4701… https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24112 https://github.com/dotnet/announcements/issues/176 https://security.archlinux.org/CVE-2021-1721 https://security.archlinux.org/CVE-2021-1723 https://security.archlinux.org/CVE-2021-24112

1 0

[ASA-202103-15] awstats: directory traversal
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-15 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-35176 Package : awstats Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-1356 Summary ======= The package awstats before version 7.8-3 is vulnerable to directory traversal. Resolution ========== Upgrade to 7.8-3. # pacman -Syu "awstats>=7.8-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf format. This issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600. Impact ====== A malicious user could access files on the filesystem. References ========== https://bugs.archlinux.org/task/69301 https://github.com/eldy/awstats/issues/195 https://github.com/eldy/awstats/pull/196 https://github.com/eldy/AWStats/commit/0d4d4c05f8e73be8f71dd361dc55cbd52858… https://security.archlinux.org/CVE-2020-35176

1 0

[ASA-202103-14] groovy: privilege escalation
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-14 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-17521 Package : groovy Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1325 Summary ======= The package groovy before version 2.5.14-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.5.14-1. # pacman -Syu "groovy>=2.5.14-1" The problem has been fixed upstream in version 2.5.14. Workaround ========== None. Description =========== Groovy before version 2.5.14 may create temporary directories within the OS temporary directory which is shared between all users on affected systems. Groovy will create such directories for internal use when producing Java Stubs or on behalf of user code via two extension methods for creating temporary directories. If Groovy user code uses either of these extension methods, and stores executable code in the resulting temporary directory, this can lead to local privilege escalation. If such Groovy code is making use of the temporary directory to store sensitive information, such information could be exposed or modified. Impact ====== A local attacker is able to obtain and modify sensitive information in Groovy temporary directories leading to privilege escalation if executable code is stored. References ========== https://bugs.archlinux.org/task/68865 https://issues.apache.org/jira/browse/GROOVY-9824 https://github.com/apache/groovy/commit/98dc5d713926cd81b006c510a1546ccd520… https://security.archlinux.org/CVE-2020-17521

1 0

[ASA-202103-13] gitlab: arbitrary code execution
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-13 ========================================== Severity: Critical Date : 2021-03-25 CVE-ID : CVE-2021-22192 Package : gitlab Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1710 Summary ======= The package gitlab before version 13.9.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 13.9.4-1. # pacman -Syu "gitlab>=13.9.4-1" The problem has been fixed upstream in version 13.9.4. Workaround ========== None. Description =========== An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server. Impact ====== An authenticated malicious user is able to execute arbitrary code on the affected server. References ========== https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4… https://hackerone.com/reports/1125425 https://gitlab.com/gitlab-org/gitlab/-/issues/324452 https://gitlab.com/gitlab-org/gitlab/-/commit/179329b5c3c118924fb242dc449d0… https://security.archlinux.org/CVE-2021-22192

1 0

[ASA-202103-12] busybox: denial of service
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-12 ========================================== Severity: Low Date : 2021-03-25 CVE-ID : CVE-2021-28831 Package : busybox Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1707 Summary ======= The package busybox before version 1.32.1-4 is vulnerable to denial of service. Resolution ========== Upgrade to 1.32.1-4. # pacman -Syu "busybox>=1.32.1-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. Impact ====== A local attacker is able to provide a crafted zip file to crash the application. References ========== https://bugs.archlinux.org/task/70075 https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac7… https://security.archlinux.org/CVE-2021-28831

1 0

[ASA-202103-11] mkinitcpio-busybox: denial of service
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-11 ========================================== Severity: Low Date : 2021-03-25 CVE-ID : CVE-2021-28831 Package : mkinitcpio-busybox Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1708 Summary ======= The package mkinitcpio-busybox before version 1.32.1-3 is vulnerable to denial of service. Resolution ========== Upgrade to 1.32.1-3. # pacman -Syu "mkinitcpio-busybox>=1.32.1-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. Impact ====== A local attacker is able to provide a crafted zip file to crash the application. References ========== https://bugs.archlinux.org/task/70075 https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac7… https://security.archlinux.org/CVE-2021-28831

1 0

[ASA-202103-10] openssl: multiple issues
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-10 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-3449 CVE-2021-3450 Package : openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1736 Summary ======= The package openssl before version 1.1.1.k-1 is vulnerable to multiple issues including certificate verification bypass and denial of service. Resolution ========== Upgrade to 1.1.1.k-1. # pacman -Syu "openssl>=1.1.1.k-1" The problems have been fixed upstream in version 1.1.1.k. Workaround ========== None. Description =========== - CVE-2021-3449 (denial of service) An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. - CVE-2021-3450 (certificate verification bypass) The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. Impact ====== A malicious client can crash the server, or a malicious server can serve a crafted certificate to bypass certificate verification routines. References ========== https://www.openssl.org/news/secadv/20210325.txt https://git.openssl.org/?p=openssl.git;a=commitdiff;h=fb9fa6b51defd48157eeb… https://git.openssl.org/?p=openssl.git;a=commitdiff;h=2a40b7bc7b94dd7de897a… https://security.archlinux.org/CVE-2021-3449 https://security.archlinux.org/CVE-2021-3450

1 0

[ASA-202103-9] chromium: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-9 ========================================= Severity: High Date : 2021-03-13 CVE-ID : CVE-2021-21191 CVE-2021-21192 CVE-2021-21193 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1683 Summary ======= The package chromium before version 89.0.4389.90-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 89.0.4389.90-1. # pacman -Syu "chromium>=89.0.4389.90-1" The problems have been fixed upstream in version 89.0.4389.90. Workaround ========== None. Description =========== - CVE-2021-21191 (arbitrary code execution) A use after free security issue was found in the WebRTC component of the Chromium browser before version 89.0.4389.90. - CVE-2021-21192 (arbitrary code execution) A heap buffer overflow security issue was found in the tab groups component of the Chromium browser before version 89.0.4389.90. - CVE-2021-21193 (arbitrary code execution) A use after free security issue was found in the Blink component of the Chromium browser before version 89.0.4389.90. Google is aware of reports that an exploit for this issue exists in the wild. Impact ====== A remote attacker can execute arbitrary code on the affected host. Google is aware of reports that an exploit for CVE-2021-21193 exists in the wild. References ========== https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-des… https://crbug.com/1167357 https://crbug.com/1181387 https://crbug.com/1186287 https://security.archlinux.org/CVE-2021-21191 https://security.archlinux.org/CVE-2021-21192 https://security.archlinux.org/CVE-2021-21193

1 0

[ASA-202103-8] opera: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-8 ========================================= Severity: High Date : 2021-03-13 CVE-ID : CVE-2021-21149 CVE-2021-21150 CVE-2021-21151 CVE-2021-21152 CVE-2021-21153 CVE-2021-21154 CVE-2021-21155 CVE-2021-21156 CVE-2021-21157 Package : opera Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1586 Summary ======= The package opera before version 74.0.3911.203-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 74.0.3911.203-1. # pacman -Syu "opera>=74.0.3911.203-1" The problems have been fixed upstream in version 74.0.3911.203. Workaround ========== None. Description =========== - CVE-2021-21149 (arbitrary code execution) A stack overflow security issue was found in the Data Transfer component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21150 (arbitrary code execution) A use after free security issue was found in the Downloads component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21151 (arbitrary code execution) A use after free security issue was found in the Payments component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21152 (arbitrary code execution) A heap buffer overflow security issue was found in the Media component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21153 (arbitrary code execution) A stack overflow security issue was found in the GPU Process component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21154 (arbitrary code execution) A heap buffer overflow security issue was found in the Tab Strip component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21155 (arbitrary code execution) A heap buffer overflow security issue was found in the Tab Strip component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21156 (arbitrary code execution) A heap buffer overflow security issue was found in the V8 component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21157 (arbitrary code execution) A use after free security issue was found in the Web Sockets component of the Chromium browser before version 88.0.4324.182. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://blogs.opera.com/desktop/changelog-for-74/ https://blogs.opera.com/desktop/2021/03/opera-74-0-3911-203-stable-update/ https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-des… https://crbug.com/1138143 https://crbug.com/1172192 https://crbug.com/1165624 https://crbug.com/1166504 https://crbug.com/1155974 https://crbug.com/1173269 https://crbug.com/1177341 https://crbug.com/1170657 https://security.archlinux.org/CVE-2021-21149 https://security.archlinux.org/CVE-2021-21150 https://security.archlinux.org/CVE-2021-21151 https://security.archlinux.org/CVE-2021-21152 https://security.archlinux.org/CVE-2021-21153 https://security.archlinux.org/CVE-2021-21154 https://security.archlinux.org/CVE-2021-21155 https://security.archlinux.org/CVE-2021-21156 https://security.archlinux.org/CVE-2021-21157

1 0