May 2021 - Arch-security - lists.archlinux.org

[ASA-202105-29] thunderbird: multiple issues
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-29 ========================================== Severity: Low Date : 2021-05-25 CVE-ID : CVE-2021-29956 CVE-2021-29957 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1964 Summary ======= The package thunderbird before version 78.10.2-1 is vulnerable to multiple issues including content spoofing and information disclosure. Resolution ========== Upgrade to 78.10.2-1. # pacman -Syu "thunderbird>=78.10.2-1" The problems have been fixed upstream in version 78.10.2. Workaround ========== None. Description =========== - CVE-2021-29956 (information disclosure) OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird < 78.10.2. - CVE-2021-29957 (content spoofing) If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird < 78.10.2. Impact ====== OpenPGP secret keys were store unencrypted on disk, allowing for potential local exfiltration. Additionally, a remote attacker could inject unprotected parts into OpenPGP signed or encrypted messages in order to spoof content. References ========== https://www.mozilla.org/security/advisories/mfsa2021-22/ https://bugzilla.mozilla.org/show_bug.cgi?id=1710290 https://bugzilla.mozilla.org/show_bug.cgi?id=1673241 https://security.archlinux.org/CVE-2021-29956 https://security.archlinux.org/CVE-2021-29957

1 0

[ASA-202105-28] hivex: denial of service
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-28 ========================================== Severity: Low Date : 2021-05-25 CVE-ID : CVE-2021-3504 Package : hivex Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1907 Summary ======= The package hivex before version 1.3.20-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.3.20-1. # pacman -Syu "hivex>=1.3.20-1" The problem has been fixed upstream in version 1.3.20. Workaround ========== None. Description =========== A security issue was found in the hivex library before version 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. Impact ====== A crafted Windows Registry (hive) file could lead to an application crash. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1949687 https://github.com/libguestfs/hivex/commit/8f1935733b10d974a1a4176d38dd151e… https://security.archlinux.org/CVE-2021-3504

1 0

[ASA-202105-27] lz4: denial of service
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-27 ========================================== Severity: Low Date : 2021-05-25 CVE-ID : CVE-2021-3520 Package : lz4 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1889 Summary ======= The package lz4 before version 1:1.9.3-2 is vulnerable to denial of service. Resolution ========== Upgrade to 1:1.9.3-2. # pacman -Syu "lz4>=1:1.9.3-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A vulnerability was found in lz4, where a potential memory corruption due to an integer overflow bug caused one of the memmove arguments to become negative. Depending on how the library was compiled this will hit an assert() inside the library and dump core, leaving a 4GB core file, or it wil go into libc and crash inside the memmove() function. Impact ====== A crafted lz4 file can lead to an application crash, potentially creating a large core dump file. References ========== https://bugs.archlinux.org/task/70970 https://bugzilla.redhat.com/show_bug.cgi?id=1954559 https://github.com/lz4/lz4/pull/972 https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7 https://security.archlinux.org/CVE-2021-3520

1 0

[ASA-202105-26] gupnp: information disclosure
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-26 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-33516 Package : gupnp Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1985 Summary ======= The package gupnp before version 1.2.6-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.2.6-1. # pacman -Syu "gupnp>=1.2.6-1" The problem has been fixed upstream in version 1.2.6. Workaround ========== None. Description =========== An issue was discovered in GUPnP before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tampering, etc. Impact ====== A remote attacker can use DNS rebinding to trick a victim's browser into triggering actions against local UPnP services. References ========== https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cv… https://gitlab.gnome.org/GNOME/gupnp/-/issues/24 https://gitlab.gnome.org/GNOME/gupnp/-/merge_requests/13 https://gitlab.gnome.org/GNOME/gupnp/-/commit/ca6ec9dcb26fd7a2a630eb6a68118… https://security.archlinux.org/CVE-2021-33516

1 0

[ASA-202105-25] prometheus: open redirect
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-25 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-29622 Package : prometheus Type : open redirect Remote : Yes Link : https://security.archlinux.org/AVG-1971 Summary ======= The package prometheus before version 2.27.1-1 is vulnerable to open redirect. Resolution ========== Upgrade to 2.27.1-1. # pacman -Syu "prometheus>=2.27.1-1" The problem has been fixed upstream in version 2.27.1. Workaround ========== The issue can be mitigated by using the --web.external-url= flag with a path (e.g. --web.external-url=http://example.com/prometheus). Description =========== A security issue has been found in Prometheus before version 2.27.1. In 2.23.0, Prometheus changed its default UI to the New UI. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL in the /new endpoint. If a user visits a Prometheus server with a specially crafted address (e.g. http://127.0.0.1:9090/new/new<url>), they can be redirected to an arbitrary URL. E.g. if a user visits http://127.0.0.1:9090/new/newhttp://www.google.com/, they will be redirected to http://google.com. Note: Users who use a --web.external-url= flag with a path (e.g. --web.external-url=http://example.com/prometheus) are not affected. Impact ====== A remote attacker can use crafted URLs to redirect victims from a Prometheus server instance to an arbitrary address. References ========== https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q… https://github.com/prometheus/prometheus/commit/db7f0bcec27bd8aeebad6b08ac8… https://security.archlinux.org/CVE-2021-29622

1 0

[ASA-202105-24] python-pydantic: denial of service
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-24 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-29510 Package : python-pydantic Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1951 Summary ======= The package python-pydantic before version 1.8.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.8.2-1. # pacman -Syu "python-pydantic>=1.8.2-1" The problem has been fixed upstream in version 1.8.2. Workaround ========== None. Description =========== A security issue has been found in pydantic before version 1.8.2. Passing either 'infinity', 'inf' or float('inf') (or their negatives) to datetime or date fields causes validation to run forever with 100% CPU usage (on one CPU). Impact ====== An attacker could cause high CPU usage using invalid datetime or date fields, leading to denial of service. References ========== https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6… https://github.com/samuelcolvin/pydantic/commit/1c24f1d74ba95ea985b50bdc001… https://security.archlinux.org/CVE-2021-29510

1 0

[ASA-202105-23] dotnet-sdk-3.1: privilege escalation
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-23 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-31204 Package : dotnet-sdk-3.1 Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1945 Summary ======= The package dotnet-sdk-3.1 before version 3.1.15.sdk115-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 3.1.15.sdk115-1. # pacman -Syu "dotnet-sdk-3.1>=3.1.15.sdk115-1" The problem has been fixed upstream in version 3.1.15.sdk115. Workaround ========== None. Description =========== An elevation of privilege vulnerability exists in .NET 5.0 and .NET Core 3.1 when a user runs a single file application on operating systems based on Linux or macOS. The issue is fixed in .NET 5.0, Runtime 5.0.6 and SDK 5.0.203, as well as .NET Core 3.1, Runtime 3.1.15 and SDK 3.1.115. Impact ====== An attacker could elevate privileges from a crafted single file application. References ========== https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31204 https://github.com/dotnet/announcements/issues/185 https://security.archlinux.org/CVE-2021-31204

1 0

[ASA-202105-22] dotnet-runtime-3.1: privilege escalation
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-22 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-31204 Package : dotnet-runtime-3.1 Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1945 Summary ======= The package dotnet-runtime-3.1 before version 3.1.15.sdk115-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 3.1.15.sdk115-1. # pacman -Syu "dotnet-runtime-3.1>=3.1.15.sdk115-1" The problem has been fixed upstream in version 3.1.15.sdk115. Workaround ========== None. Description =========== An elevation of privilege vulnerability exists in .NET 5.0 and .NET Core 3.1 when a user runs a single file application on operating systems based on Linux or macOS. The issue is fixed in .NET 5.0, Runtime 5.0.6 and SDK 5.0.203, as well as .NET Core 3.1, Runtime 3.1.15 and SDK 3.1.115. Impact ====== An attacker could elevate privileges from a crafted single file application. References ========== https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31204 https://github.com/dotnet/announcements/issues/185 https://security.archlinux.org/CVE-2021-31204

1 0

[ASA-202105-21] dotnet-runtime: privilege escalation
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-21 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-31204 Package : dotnet-runtime Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1944 Summary ======= The package dotnet-runtime before version 5.0.6.sdk203-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.0.6.sdk203-1. # pacman -Syu "dotnet-runtime>=5.0.6.sdk203-1" The problem has been fixed upstream in version 5.0.6.sdk203. Workaround ========== None. Description =========== An elevation of privilege vulnerability exists in .NET 5.0 and .NET Core 3.1 when a user runs a single file application on operating systems based on Linux or macOS. The issue is fixed in .NET 5.0, Runtime 5.0.6 and SDK 5.0.203, as well as .NET Core 3.1, Runtime 3.1.15 and SDK 3.1.115. Impact ====== An attacker could elevate privileges from a crafted single file application. References ========== https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31204 https://github.com/dotnet/announcements/issues/185 https://security.archlinux.org/CVE-2021-31204

1 0

[ASA-202105-20] dotnet-sdk: privilege escalation
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-20 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-31204 Package : dotnet-sdk Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1944 Summary ======= The package dotnet-sdk before version 5.0.6.sdk203-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.0.6.sdk203-1. # pacman -Syu "dotnet-sdk>=5.0.6.sdk203-1" The problem has been fixed upstream in version 5.0.6.sdk203. Workaround ========== None. Description =========== An elevation of privilege vulnerability exists in .NET 5.0 and .NET Core 3.1 when a user runs a single file application on operating systems based on Linux or macOS. The issue is fixed in .NET 5.0, Runtime 5.0.6 and SDK 5.0.203, as well as .NET Core 3.1, Runtime 3.1.15 and SDK 3.1.115. Impact ====== An attacker could elevate privileges from a crafted single file application. References ========== https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31204 https://github.com/dotnet/announcements/issues/185 https://security.archlinux.org/CVE-2021-31204

1 0