March 2021 - Arch-security - lists.archlinux.org

[ASA-202102-40] bind: arbitrary code execution
by Morten Linderud 02 Mar '21

02 Mar '21

Arch Linux Security Advisory ASA-202102-40 ========================================== Severity: High Date : 2021-02-27 CVE-ID : CVE-2020-8625 Package : bind Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1589 Summary ======= The package bind before version 9.16.12-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 9.16.12-1. # pacman -Syu "bind>=9.16.12-1" The problem has been fixed upstream in version 9.16.12. Workaround ========== None. Description =========== A security issue was found in BIND 9.5.0 up to 9.11.27, 9.12.0 up to 9.16.11, and versions BIND 9.11.3-S1 up to 9.11.27-S1 and 9.16.8-S1 up to 9.16.11-S1 of BIND Supported Preview Edition, as well as the release versions 9.17.0 and 9.17.1 of the BIND 9.17 development branch. A vulnerability in BIND's GSSAPI security policy can be targeted by a buffer overflow attack. Impact ====== A malicious server could execute code on the host. References ========== https://kb.isc.org/docs/cve-2020-8625 https://downloads.isc.org/isc/bind9/9.16.12/patches/CVE-2020-8625.patch https://security.archlinux.org/CVE-2020-8625

1 0

[ASA-202102-39] ipmitool: arbitrary code execution
by Morten Linderud 02 Mar '21

02 Mar '21

Arch Linux Security Advisory ASA-202102-39 ========================================== Severity: High Date : 2021-02-27 CVE-ID : CVE-2020-5208 Package : ipmitool Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1596 Summary ======= The package ipmitool before version 1.8.18-7 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.8.18-7. # pacman -Syu "ipmitool>=1.8.18-7" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19. Impact ====== A remote server could execute arbitrary code on the client. References ========== https://bugs.archlinux.org/task/69708 https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac6… https://github.com/ipmitool/ipmitool/commit/840fb1cbb4fb365cb9797300e3374d4… https://github.com/ipmitool/ipmitool/commit/41d7026946fafbd4d1ec0bcaca3ea30… https://github.com/ipmitool/ipmitool/commit/9452be87181a6e83cfcc768b3ed8321… https://github.com/ipmitool/ipmitool/commit/d45572d71e70840e0d4c50bf4821849… https://github.com/ipmitool/ipmitool/commit/7ccea283dd62a05a320c1921e3d8d71… https://security.archlinux.org/CVE-2020-5208

1 0

[ASA-202102-38] isync: directory traversal
by Morten Linderud 02 Mar '21

02 Mar '21

Arch Linux Security Advisory ASA-202102-38 ========================================== Severity: High Date : 2021-02-27 CVE-ID : CVE-2021-20247 Package : isync Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-1598 Summary ======= The package isync before version 1.3.5-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 1.3.5-1. # pacman -Syu "isync>=1.3.5-1" The problem has been fixed upstream in version 1.3.5. Workaround ========== None. Description =========== A security issue was found in isync/mbsync before versions 1.3.5 and 1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur, allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. Impact ====== A compromised server could traverse files on the system. References ========== https://www.openwall.com/lists/oss-security/2021/02/22/1 https://sourceforge.net/p/isync/isync/ci/fe5d59f8e3169944e57eb1c60155c9ebd4… https://security.archlinux.org/CVE-2021-20247

1 0

[ASA-202102-37] python: multiple issues
by Morten Linderud 02 Mar '21

02 Mar '21

Arch Linux Security Advisory ASA-202102-37 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2021-3177 CVE-2021-23336 Package : python Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1465 Summary ======= The package python before version 3.9.2-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========== Upgrade to 3.9.2-1. # pacman -Syu "python>=3.9.2-1" The problems have been fixed upstream in version 3.9.2. Workaround ========== None. Description =========== - CVE-2021-3177 (arbitrary code execution) Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely. - CVE-2021-23336 (url request injection) The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. The package python-django contains a copy of urllib.parse.parse_qsl() which was added to backport some security fixes. A further security fix has been issued in versions 3.1.7, 3.0.13 and 2.2.19 such that parse_qsl() no longer allows using ; as a query parameter separator by default. Impact ====== A malicious format string could execute code and a malicious user could send crafted HTTP queries poisoning the cache. References ========== https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_r… https://bugs.python.org/issue42938 https://github.com/python/cpython/pull/24239 https://github.com/python/cpython/commit/c347cbe694743cee120457aa6626712f77… https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933 https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/ https://bugs.python.org/issue42967 https://github.com/python/cpython/pull/24297 https://github.com/python/cpython/commit/c9f07813ab8e664d8c34413c4fc2d4f86c… https://www.djangoproject.com/weblog/2021/feb/19/security-releases/ https://github.com/django/django/commit/8f6d431b08cbb418d9144b976e7b9725466… https://security.archlinux.org/CVE-2021-3177 https://security.archlinux.org/CVE-2021-23336

1 0

[ASA-202102-36] python-cryptography: incorrect calculation
by Morten Linderud 02 Mar '21

02 Mar '21

Arch Linux Security Advisory ASA-202102-36 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2020-36242 Package : python-cryptography Type : incorrect calculation Remote : No Link : https://security.archlinux.org/AVG-1541 Summary ======= The package python-cryptography before version 3.4-1 is vulnerable to incorrect calculation. Resolution ========== Upgrade to 3.4-1. # pacman -Syu "python-cryptography>=3.4-1" The problem has been fixed upstream in version 3.4. Workaround ========== None. Description =========== In python-cryptography before version 3.3.2, certain sequences of update calls to symmetrically encrypt multiple gigabytes of data could result in an integer overflow, leading to mishandling of buffers. Impact ====== Unintentional use of the API could lead to buffer mishandling, causing application crashes or incorrectly encrypted data. References ========== https://github.com/pyca/cryptography/security/advisories/GHSA-rhm9-p9w5-fwm7 https://github.com/pyca/cryptography/issues/5615 https://github.com/pyca/cryptography/pull/5747 https://github.com/pyca/cryptography/commit/82b6ce28389f0a317bc55ba2091a74b… https://security.archlinux.org/CVE-2020-36242

1 0

[ASA-202102-35] python-httplib2: denial of service
by Morten Linderud 02 Mar '21

02 Mar '21

Arch Linux Security Advisory ASA-202102-35 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2021-21240 Package : python-httplib2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1546 Summary ======= The package python-httplib2 before version 0.19.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.19.0-1. # pacman -Syu "python-httplib2>=0.19.0-1" The problem has been fixed upstream in version 0.19.0. Workaround ========== The issue can be mitigated by using "httplib2.USE_WWW_AUTH_STRICT_PARSING = True". Description =========== In python-httplib2 before version 0.19.0, a malicious server which responds with a long series of "\xa0" characters in the "www- authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library. Impact ====== A malicious server can crash the application with crafted HTTP responses. References ========== https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m https://github.com/httplib2/httplib2/pull/182 https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d70… https://security.archlinux.org/CVE-2021-21240

1 0

[ASA-202102-34] intel-ucode: information disclosure
by Morten Linderud 02 Mar '21

02 Mar '21

Arch Linux Security Advisory ASA-202102-34 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2020-8696 CVE-2020-8698 Package : intel-ucode Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1588 Summary ======= The package intel-ucode before version 20210216-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 20210216-1. # pacman -Syu "intel-ucode>=20210216-1" The problems have been fixed upstream in version 20210216. Workaround ========== None. Description =========== - CVE-2020-8696 (information disclosure) Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. - CVE-2020-8698 (information disclosure) Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Impact ====== An authenticated attacker could disclose information. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/release… https://security.archlinux.org/CVE-2020-8696 https://security.archlinux.org/CVE-2020-8698

1 0

[ASA-202102-33] salt: multiple issues
by Morten Linderud 02 Mar '21

02 Mar '21

Arch Linux Security Advisory ASA-202102-33 ========================================== Severity: High Date : 2021-02-27 CVE-ID : CVE-2020-28243 CVE-2020-28972 CVE-2020-35662 CVE-2021-3144 CVE-2021-3148 CVE-2021-3197 CVE-2021-25281 CVE-2021-25282 CVE-2021-25283 CVE-2021-25284 Package : salt Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1624 Summary ======= The package salt before version 3002.5-3 is vulnerable to multiple issues including access restriction bypass, arbitrary command execution, certificate verification bypass, cross-site scripting, insufficient validation, privilege escalation, directory traversal and information disclosure. Resolution ========== Upgrade to 3002.5-3. # pacman -Syu "salt>=3002.5-3" The problems have been fixed upstream in version 3002.5. Workaround ========== None. Description =========== - CVE-2020-28243 (privilege escalation) An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create files on the minion in a non-blacklisted directory. - CVE-2020-28972 (certificate verification bypass) In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate. - CVE-2020-35662 (certificate verification bypass) In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. - CVE-2021-3144 (insufficient validation) In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) - CVE-2021-3148 (arbitrary command execution) An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py. - CVE-2021-3197 (arbitrary command execution) An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request. - CVE-2021-25281 (access restriction bypass) An issue was discovered in SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master. - CVE-2021-25282 (directory traversal) An issue was discovered in SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. - CVE-2021-25283 (cross-site scripting) An issue was discovered in SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. - CVE-2021-25284 (information disclosure) An issue was discovered in SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. Impact ====== A remote unauthenticated attacker could execute commands, bypass TLS verification, traverse directories and disclose credentials. References ========== https://saltproject.io/security_announcements/active-saltstack-cve-release-… https://security.archlinux.org/CVE-2020-28243 https://security.archlinux.org/CVE-2020-28972 https://security.archlinux.org/CVE-2020-35662 https://security.archlinux.org/CVE-2021-3144 https://security.archlinux.org/CVE-2021-3148 https://security.archlinux.org/CVE-2021-3197 https://security.archlinux.org/CVE-2021-25281 https://security.archlinux.org/CVE-2021-25282 https://security.archlinux.org/CVE-2021-25283 https://security.archlinux.org/CVE-2021-25284

1 0