March 2021 - Arch-security - lists.archlinux.org

[ASA-202103-7] ffmpeg: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-7 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2020-35964 Package : ffmpeg Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1649 Summary ======= The package ffmpeg before version 2:4.3.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2:4.3.2-1. # pacman -Syu "ffmpeg>=2:4.3.2-1" The problem has been fixed upstream in version 4.3.2. Workaround ========== None. Description =========== track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of- bounds write because of incorrect extradata packing. The issue is fixed in FFmpeg version 4.3.2. Impact ====== An attacker might be able to execute arbitrary code via a crafted media file. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26622 https://github.com/FFmpeg/FFmpeg/commit/4f0bdff292391cdb96b79b08c5653302916… https://security.archlinux.org/CVE-2020-35964

1 0

[ASA-202103-6] openssh: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-6 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2021-28041 Package : openssh Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1657 Summary ======= The package openssh before version 8.5p1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.5p1-1. # pacman -Syu "openssh>=8.5p1-1" The problem has been fixed upstream in version 8.5p1. Workaround ========== None. Description =========== ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host. Impact ====== A remote attacker with enough privileges to access the socket of the forwarding agent might be able to execute arbitrary code. References ========== https://www.openssh.com/security.html https://www.openssh.com/txt/release-8.5 https://github.com/openssh/openssh-portable/commit/e04fd6dde16de1cdc5a4d994… https://security.archlinux.org/CVE-2021-28041

1 0

[ASA-202103-5] minio: access restriction bypass
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-5 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2021-21362 Package : minio Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-1664 Summary ======= The package minio before version 2021.03.04-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 2021.03.04-1. # pacman -Syu "minio>=2021.03.04-1" The problem has been fixed upstream in version 2021.03.04. Workaround ========== Disabling uploads with `Content-Type: multipart/form-data` as mentioned in the S3 API RESTObjectPOST docs by using a proxy in front of MinIO. Description =========== In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone using MinIO multi-users is impacted. As a workaround, one can disable uploads with `Content-Type: multipart/form-data` as mentioned in the S3 API RESTObjectPOST docs by using a proxy in front of MinIO. Impact ====== A remote attacker can alter a read-only resource via a temporary share upload URL. References ========== https://github.com/minio/minio/security/advisories/GHSA-hq5j-6r98-9m8v https://github.com/minio/minio/pull/11682 https://github.com/minio/minio/commit/039f59b552319fcc2f83631bb421a7d4b82bc… https://security.archlinux.org/CVE-2021-21362

1 0

[ASA-202103-4] flatpak: sandbox escape
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-4 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2021-21381 Package : flatpak Type : sandbox escape Remote : No Link : https://security.archlinux.org/AVG-1678 Summary ======= The package flatpak before version 1.10.2-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 1.10.2-1. # pacman -Syu "flatpak>=1.10.2-1" The problem has been fixed upstream in version 1.10.2. Workaround ========== None. Description =========== Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. Impact ====== A malicious app publisher can escape the sandbox to access sensitive files. References ========== https://github.com/flatpak/flatpak/security/advisories/GHSA-xgh4-387p-hqpp https://github.com/flatpak/flatpak/issues/4146 https://github.com/flatpak/flatpak/pull/4156 https://github.com/flatpak/flatpak/commit/8279c5818425b6812523e3805bbe242fb… https://security.archlinux.org/CVE-2021-21381

1 0

[ASA-202103-3] git: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-3 ========================================= Severity: Low Date : 2021-03-13 CVE-ID : CVE-2021-21300 Package : git Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1665 Summary ======= The package git before version 2.30.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.30.2-1. # pacman -Syu "git>=2.30.2-1" The problem has been fixed upstream in version 2.30.2. Workaround ========== None. Description =========== In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS. Note that clean/smudge filters have to be configured for that. As a workaround, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.62.17.6. Impact ====== Under certain circumstances, a remote attacker might be able to execute arbitrary code by getting a local user to clone a crafted repository. References ========== https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm https://lore.kernel.org/git/xmqqim6019yd.fsf@gitster.c.googlers.com/ https://git.kernel.org/pub/scm/git/git.git/commit/?id=684dd4c2b414bcf648505… https://security.archlinux.org/CVE-2021-21300

1 0

[ASA-202103-2] wireshark-qt: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-2 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2021-22191 Package : wireshark-qt Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1669 Summary ======= The package wireshark-qt before version 3.4.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.4.4-1. # pacman -Syu "wireshark-qt>=3.4.4-1" The problem has been fixed upstream in version 3.4.4. Workaround ========== None. Description =========== A security issue has been found in Wireshark before version 3.4.4. Some fields in the Wireshark proto_tree are double-clickable and pass URLs with arbitrary schemes to the QDesktopServices::openUrl function. http and https URLs passed to this function are opened by the browser which is generally safe. For some other schemes like dav and file however, referenced files will be opened by the system's standard application associated with their file type. By preparing internet-hosted file shares and executable files, arbitrary code execution can be achieved via malicious pcap(ng) files or captured live-traffic and some user interaction. Impact ====== A remote attacker might be able to execute arbitrary code via a crafted network packet, or a crafted packet trace file. References ========== https://www.wireshark.org/security/wnpa-sec-2021-03.html https://gitlab.com/wireshark/wireshark/-/issues/17232 https://gitlab.com/wireshark/wireshark/-/merge_requests/2074 https://gitlab.com/wireshark/wireshark/-/commit/b2c58d020c100958beb59d9e624… https://security.archlinux.org/CVE-2021-22191

1 0

[ASA-202103-1] gnutls: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-1 ========================================= Severity: Low Date : 2021-03-13 CVE-ID : CVE-2021-20231 CVE-2021-20232 Package : gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1674 Summary ======= The package gnutls before version 3.7.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.7.1-1. # pacman -Syu "gnutls>=3.7.1-1" The problems have been fixed upstream in version 3.7.1. Workaround ========== None. Description =========== - CVE-2021-20231 (arbitrary code execution) A security issue was found in GnuTLS before version 3.7.1. It was found that the client sending a "key_share" extension may result in dereferencing a pointer no longer valid after realloc(). This only happens in TLS 1.3 and only when the client sends a large Client Hello message, e.g., when HRR is sent in a resumed session previously negotiated large FFDHE parameters, because the initial allocation of the buffer is large enough without having to call realloc(). - CVE-2021-20232 (arbitrary code execution) A security issue was found in GnuTLS before version 3.7.1. It was found that the client sending a "pre_share_key" extension may result in dereferencing a pointer no longer valid after realloc(). This only happens in TLS 1.3 and only when the client sends a large Client Hello message, e.g., when HRR is sent in a resumed session previously negotiated large FFDHE parameters, because the initial allocation of the buffer is large enough without having to call realloc(). Impact ====== A remote attacker might be able to cause a denial of service or possibly execute arbitrary code when a TLS client is resuming a TLS 1.3 session. References ========== https://www.gnutls.org/security-new.html#GNUTLS-SA-2021-03-10 https://gitlab.com/gnutls/gnutls/-/issues/1151 https://gitlab.com/gnutls/gnutls/-/merge_requests/1399 https://gitlab.com/gnutls/gnutls/-/commit/15beb4b193b2714d88107e7dffca78179… https://gitlab.com/gnutls/gnutls/-/commit/75a937d97f4fefc6f9b08e3791f151445… https://security.archlinux.org/CVE-2021-20231 https://security.archlinux.org/CVE-2021-20232

1 0

[ASA-202102-43] thrift: denial of service
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-43 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2020-13949 Package : thrift Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1568 Summary ======= The package thrift before version 0.14.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.14.0-1. # pacman -Syu "thrift>=0.14.0-1" The problem has been fixed upstream in version 0.14.0. Workaround ========== None. Description =========== Applications using Thrift before version 0.14.0 would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. Impact ====== Malicious clients could send crafted messages crashing the server. References ========== https://www.openwall.com/lists/oss-security/2021/02/11/2 https://security.archlinux.org/CVE-2020-13949

1 0

[ASA-202102-42] openssl: multiple issues
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-42 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2021-23840 CVE-2021-23841 Package : openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1581 Summary ======= The package openssl before version 1.1.1.j-1 is vulnerable to multiple issues including denial of service and incorrect calculation. Resolution ========== Upgrade to 1.1.1.j-1. # pacman -Syu "openssl>=1.1.1.j-1" The problems have been fixed upstream in version 1.1.1.j. Workaround ========== None. Description =========== - CVE-2021-23840 (incorrect calculation) Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). - CVE-2021-23841 (denial of service) The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Impact ====== A malicious certificate can be crafted to crash the application, or behave in some incorrect way. References ========== https://www.openssl.org/news/secadv/20210216.txt https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a51b9e1d0cf0b… https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9b1129239f3ebb… https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8130d654d1de92… https://security.archlinux.org/CVE-2021-23840 https://security.archlinux.org/CVE-2021-23841

1 0

[ASA-202102-41] tar: denial of service
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-41 ========================================== Severity: Low Date : 2021-02-27 CVE-ID : CVE-2021-20193 Package : tar Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1462 Summary ======= The package tar before version 1.34-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.34-1. # pacman -Syu "tar>=1.34-1" The problem has been fixed upstream in version 1.34. Workaround ========== None. Description =========== An issue was discovered in GNU Tar before version 1.34. There is a memory leak in read_header() in list.c in the tar application. Impact ====== A crafted tar archive can crash the application. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1917565 https://savannah.gnu.org/bugs/?59897 https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1… https://security.archlinux.org/CVE-2021-20193

1 0