May 2021 - Arch-security - lists.archlinux.org

[ASA-202105-19] matrix-synapse: denial of service
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-19 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-29471 Package : matrix-synapse Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1943 Summary ======= The package matrix-synapse before version 1.33.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.33.2-1. # pacman -Syu "matrix-synapse>=1.33.2-1" The problem has been fixed upstream in version 1.33.2. Workaround ========== A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy. Description =========== In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy. Impact ====== A remote attacker could cause high CPU usage on the server using crafted push rules, leading to denial of service. References ========== https://bugs.archlinux.org/task/70801 https://github.com/matrix-org/synapse/security/advisories/GHSA-x345-32rc-8h… https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c33… https://security.archlinux.org/CVE-2021-29471

1 0

[ASA-202105-18] djvulibre: arbitrary code execution
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-18 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-3500 CVE-2021-32490 CVE-2021-32491 CVE-2021-32492 CVE-2021-32493 Package : djvulibre Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1899 Summary ======= The package djvulibre before version 3.5.28-3 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.5.28-3. # pacman -Syu "djvulibre>=3.5.28-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2021-3500 (arbitrary code execution) A security issue was found in djvulibre. A stack overflow in the function DJVU::DjVuDocument::get_djvu_file() may lead to an application crash and other consequences via a crafted djvu file. - CVE-2021-32490 (arbitrary code execution) A security issue was found in djvulibre. An out of bounds write in the function DJVU::filter_bv() may lead to an application crash and other consequences via a crafted djvu file. - CVE-2021-32491 (arbitrary code execution) A security issue was found in djvulibre. An integer overflow in the function render() in tools/ddjvu may lead to an application crash and other consequences via a crafted djvu file. - CVE-2021-32492 (arbitrary code execution) A security issue was found in djvulibre. An out of bounds read in the function DJVU::DataPool::has_data() may lead to an application crash and other consequences via a crafted djvu file. - CVE-2021-32493 (arbitrary code execution) A security issue was found in djvulibre. A heap buffer overflow in the function DJVU::GBitmap::decode() may lead to an application crash and other consequences via a crafted djvu file. Impact ====== An attacker could cause a crash, or possible execute arbitrary code, using a crafted djvu file. References ========== https://bugs.archlinux.org/task/70787 https://bugzilla.redhat.com/show_bug.cgi?id=1943685 https://bugzilla.redhat.com/show_bug.cgi?id=1943411 https://src.fedoraproject.org/rpms/djvulibre/blob/rawhide/f/djvulibre-3.5.2… https://bugzilla.redhat.com/show_bug.cgi?id=1943693 https://bugzilla.redhat.com/show_bug.cgi?id=1943408 https://bugzilla.redhat.com/attachment.cgi?id=1770184&action=diff https://src.fedoraproject.org/rpms/djvulibre/blob/rawhide/f/djvulibre-3.5.2… https://bugzilla.redhat.com/show_bug.cgi?id=1943684 https://bugzilla.redhat.com/show_bug.cgi?id=1943409 https://bugzilla.redhat.com/attachment.cgi?id=1770218&action=diff https://src.fedoraproject.org/rpms/djvulibre/blob/4b8d9b4bcb10c24739ca2dcd6… https://bugzilla.redhat.com/show_bug.cgi?id=1943686 https://bugzilla.redhat.com/show_bug.cgi?id=1943410 https://bugzilla.redhat.com/attachment.cgi?id=1770220&action=diff https://src.fedoraproject.org/rpms/djvulibre/blob/rawhide/f/djvulibre-3.5.2… https://bugzilla.redhat.com/show_bug.cgi?id=1943690 https://bugzilla.redhat.com/show_bug.cgi?id=1943424 https://bugzilla.redhat.com/attachment.cgi?id=1774554&action=diff https://src.fedoraproject.org/rpms/djvulibre/blob/rawhide/f/djvulibre-3.5.2… https://security.archlinux.org/CVE-2021-3500 https://security.archlinux.org/CVE-2021-32490 https://security.archlinux.org/CVE-2021-32491 https://security.archlinux.org/CVE-2021-32492 https://security.archlinux.org/CVE-2021-32493

1 0

[ASA-202105-17] runc: sandbox escape
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-17 ========================================== Severity: High Date : 2021-05-25 CVE-ID : CVE-2021-30465 Package : runc Type : sandbox escape Remote : No Link : https://security.archlinux.org/AVG-1972 Summary ======= The package runc before version 1.0.0rc95-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 1.0.0rc95-1. # pacman -Syu "runc>=1.0.0rc95-1" The problem has been fixed upstream in version 1.0.0rc95. Workaround ========== Container hardening mechanisms such as LSMs (AppArmor/SELinux) and user namespaces can restrict the amount of damage an attacker could do but they do not block this attack outright. Description =========== runc 1.0.0-rc94 and earlier are vulnerable to a symlink exchange attack where an attacker with the ability to start containers using a custom volume configuration can request a seemingly-innocuous container configuration that results in the host filesystem being bind-mounted into the container (allowing for a container escape). Impact ====== An attacker can escape from a container and access arbitrary files on the host system using a crafted container configuration. References ========== https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-g… https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849… https://security.archlinux.org/CVE-2021-30465

1 0

[ASA-202105-16] websvn: arbitrary command execution
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-16 ========================================== Severity: High Date : 2021-05-25 CVE-ID : CVE-2021-32305 Package : websvn Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1969 Summary ======= The package websvn before version 2.6.1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 2.6.1-1. # pacman -Syu "websvn>=2.6.1-1" The problem has been fixed upstream in version 2.6.1. Workaround ========== None. Description =========== WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. Impact ====== A remote attacker can execute arbitrary shell commands on the server using a crafted search query. References ========== https://github.com/websvnphp/websvn/pull/142 https://github.com/websvnphp/websvn/commit/88fce56b7b9dbfc0fe2629217c3bff2c… https://security.archlinux.org/CVE-2021-32305

1 0

[ASA-202105-15] python-babel: arbitrary code execution
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-15 ========================================== Severity: Medium Date : 2021-05-19 CVE-ID : CVE-2021-20095 Package : python-babel Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1894 Summary ======= The package python-babel before version 2.9.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.9.1-1. # pacman -Syu "python-babel>=2.9.1-1" The problem has been fixed upstream in version 2.9.1. Workaround ========== None. Description =========== Relative Path Traversal in Babel 2.9.0 allows an attacker to load arbitrary locale files on disk and execute arbitrary code. Impact ====== A local attacker could load arbitrary locale files through path traversal using a crafted locale identifier and execute arbitrary code. References ========== https://www.tenable.com/security/research/tra-2021-14 https://github.com/python-babel/babel/pull/782 https://github.com/python-babel/babel/commit/412015ef642bfcc0d8ba8f4d05cdbb… https://security.archlinux.org/CVE-2021-20095

1 0

[ASA-202105-14] mariadb: denial of service
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-14 ========================================== Severity: Medium Date : 2021-05-19 CVE-ID : CVE-2021-2154 CVE-2021-2166 Package : mariadb Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1882 Summary ======= The package mariadb before version 10.5.10-1 is vulnerable to denial of service. Resolution ========== Upgrade to 10.5.10-1. # pacman -Syu "mariadb>=10.5.10-1" The problems have been fixed upstream in version 10.5.10. Workaround ========== None. Description =========== - CVE-2021-2154 (denial of service) A security issue has been found in MariaDB before version 10.5.10. An easily exploitable vulnerability allows high privileged attackers with network access via multiple protocols to compromise the MariaDB server. Successful attacks of this vulnerability can cause a hang or a frequently repeatable crash (complete denial of service) of the server. - CVE-2021-2166 (denial of service) A security issue has been found in MariaDB before version 10.5.10. An easily exploitable vulnerability allows high privileged attackers with network access via multiple protocols to compromise the MariaDB server. Successful attacks of this vulnerability can cause a hang or a frequently repeatable crash (complete denial of service) of the server. Impact ====== A privileged remote attacker could cause the MariaDB server to hang or crash. References ========== https://mariadb.com/kb/en/mariadb-10510-release-notes/ https://security.archlinux.org/CVE-2021-2154 https://security.archlinux.org/CVE-2021-2166

1 0

[ASA-202105-13] opendmarc: multiple issues
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-13 ========================================== Severity: Medium Date : 2021-05-19 CVE-ID : CVE-2019-20790 CVE-2020-12272 Package : opendmarc Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1375 Summary ======= The package opendmarc before version 1.4.1.1-1 is vulnerable to multiple issues including content spoofing and authentication bypass. Resolution ========== Upgrade to 1.4.1.1-1. # pacman -Syu "opendmarc>=1.4.1.1-1" The problems have been fixed upstream in version 1.4.1.1. Workaround ========== None. Description =========== - CVE-2019-20790 (authentication bypass) OpenDMARC before 1.4.1, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO field is inconsistent with the MAIL FROM field. - CVE-2020-12272 (content spoofing) OpenDMARC before 1.4.1 allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring. OpenDMARC has added checking to validate that the domain element in both SPF and DKIM header fields being inspected argument contains only valid domain name characters. This has been fixed as of OpenDMARC 1.4.1 (March 2021). Impact ====== A remote attacker could spoof SPF, DMARC and DKIM authentication results. References ========== https://github.com/trusteddomainproject/OpenDMARC/blob/develop/SECURITY/CVE… https://bugs.launchpad.net/pypolicyd-spf/+bug/1838816 https://sourceforge.net/p/opendmarc/tickets/235/ https://www.usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf https://github.com/trusteddomainproject/OpenDMARC/issues/49 https://github.com/trusteddomainproject/OpenDMARC/issues/158 https://github.com/trusteddomainproject/OpenDMARC/commit/d72e1ec0ae6ed3a982… https://github.com/trusteddomainproject/OpenDMARC/commit/9c0db8c12e4488fbf9… https://github.com/trusteddomainproject/OpenDMARC/commit/5f980792546d11bc16… https://github.com/trusteddomainproject/OpenDMARC/blob/develop/SECURITY/CVE… https://sourceforge.net/p/opendmarc/tickets/237/ https://github.com/trusteddomainproject/OpenDMARC/commit/f3a9a9d4edfaa05102… https://security.archlinux.org/CVE-2019-20790 https://security.archlinux.org/CVE-2020-12272

1 0

[ASA-202105-12] libx11: insufficient validation
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-12 ========================================== Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-31535 Package : libx11 Type : insufficient validation Remote : No Link : https://security.archlinux.org/AVG-1968 Summary ======= The package libx11 before version 1.7.1-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 1.7.1-1. # pacman -Syu "libx11>=1.7.1-1" The problem has been fixed upstream in version 1.7.1. Workaround ========== None. Description =========== A security issue has been found in libx11 before version 1.7.1. XLookupColor() and other X libraries function lack proper validation of the length of their string parameters. If those parameters can be controlled by an external application (for instance a color name that can be emitted via a terminal control sequence) it can lead to the emission of extra X protocol requests to the X server. Impact ====== An attacker could emit arbitrary X protocol requests to the X server through crafted string parameters. References ========== https://unparalleled.eu/publications/2021/advisory-unpar-2021-1.txt https://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge… https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8d2e02ae650f00c4a53… https://security.archlinux.org/CVE-2021-31535

1 0

[ASA-202105-11] prosody: multiple issues
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-11 ========================================== Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-32917 CVE-2021-32918 CVE-2021-32919 CVE-2021-32920 CVE-2021-32921 Package : prosody Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1955 Summary ======= The package prosody before version 1:0.11.9-1 is vulnerable to multiple issues including denial of service, authentication bypass, information disclosure and insufficient validation. Resolution ========== Upgrade to 1:0.11.9-1. # pacman -Syu "prosody>=1:0.11.9-1" The problems have been fixed upstream in version 0.11.9. Workaround ========== - CVE-2021-32917 can be mitigated by configuring 'proxy65_acl' to a list of XMPP domains that should be allowed to use the file transfer proxy. - CVE-2021-32918 can be partly mitigated using stricter settings for stanza size limits, rate limits and garbage collection parameters, see the referenced upstream advisory for more details. - CVE-2021-32919 can be mitigated by removing or disabling the ‘dialback_without_dialback’ option. - CVE-2021-32920 can be mitigated by setting the following ssl option (or add to your existing one if you have one): ssl = { options = { no_renegotiation = true; } } - CVE-2021-32921 can partly be mitigated by enabling and configuring rate limits through mod_limits in order to lengthen the amount of time required to successfully complete a timing attack. Description =========== - CVE-2021-32917 (insufficient validation) A security issue was found in the Prosody.im XMPP server software before version 0.11.9. mod_proxy65 is a file transfer proxy provided with Prosody to facilitate the transfer of files and other data between XMPP clients. It was discovered that the proxy65 component of Prosody allows open access by default, even if neither of the users have an XMPP account on the local server, allowing unrestricted use of the server's bandwidth. The default configuration does not enable mod_proxy65 and is not affected. With mod_proxy65 enabled, all configurations without a 'proxy65_acl' setting configured are affected. - CVE-2021-32918 (denial of service) A security issue was found in the Prosody.im XMPP server software before version 0.11.9. It was discovered that default settings leave Prosody susceptible to remote unauthenticated denial-of-service (DoS) attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3. - CVE-2021-32919 (authentication bypass) A security issue was found in the Prosody.im XMPP server software before version 0.11.9. The undocumented option ‘dialback_without_dialback’ enabled an experimental feature for server- to-server authentication. A flaw in this feature meant it did not correctly authenticate remote servers, allowing a remote server to impersonate another server when this option is enabled. - CVE-2021-32920 (denial of service) A security issue was found in the Prosody.im XMPP server software before version 0.11.9. It was discovered that Prosody does not disable SSL/TLS renegotiation, even though this is not used in XMPP. A malicious client may flood a connection with renegotiation requests to consume excessive CPU resources on the server. - CVE-2021-32921 (information disclosure) A security issue was found in the Prosody.im XMPP server software before version 0.11.9. It was discovered that Prosody does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker. Impact ====== A remote attacker could cause excessive use of the server's bandwidth and resources, leading to denial of service, impersonate other servers, or leak secret strings through timing attacks. References ========== https://prosody.im/security/advisory_20210512/#use-of-mod_proxy65-is-unrest… https://hg.prosody.im/trunk/rev/65dcc175ef5b https://prosody.im/security/advisory_20210512/#dos-via-insufficient-memory-… https://hg.prosody.im/trunk/rev/db8e41eb6eff https://hg.prosody.im/trunk/rev/b0d8920ed5e5 https://hg.prosody.im/trunk/rev/929de6ade6b6 https://hg.prosody.im/trunk/rev/63fd4c8465fb https://hg.prosody.im/trunk/rev/1937b3c3efb5 https://hg.prosody.im/trunk/rev/3413fea9e6db https://prosody.im/security/advisory_20210512/#undocumented-dialback-withou… https://hg.prosody.im/trunk/rev/6be890ca492e https://hg.prosody.im/trunk/rev/d0e9ffccdef9 https://prosody.im/security/advisory_20210512/#dos-via-repeated-tls-renegot… https://hg.prosody.im/trunk/rev/55ef50d6cf65 https://hg.prosody.im/trunk/rev/5a484bd050a7 https://hg.prosody.im/trunk/rev/aaf9c6b6d18d https://prosody.im/security/advisory_20210512/#use-of-timing-dependent-stri… https://hg.prosody.im/trunk/rev/c98aebe601f9 https://hg.prosody.im/trunk/rev/13b84682518e https://hg.prosody.im/trunk/rev/6f56170ea986 https://security.archlinux.org/CVE-2021-32917 https://security.archlinux.org/CVE-2021-32918 https://security.archlinux.org/CVE-2021-32919 https://security.archlinux.org/CVE-2021-32920 https://security.archlinux.org/CVE-2021-32921

1 0

[ASA-202105-10] squid: denial of service
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-10 ========================================== Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-28651 CVE-2021-28652 CVE-2021-28662 Package : squid Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1949 Summary ======= The package squid before version 4.15-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.15-1. # pacman -Syu "squid>=4.15-1" The problems have been fixed upstream in version 4.15. Workaround ========== - CVE-2021-28651 can be mitigated by disabling URN processing by the proxy, by adding these lines to squid.conf: acl URN proto URN http_access deny URN - CVE-2021-28652 can be mitigated by either disabling Cache Manager access entirely if not needed, by placing the following line in squid.conf before lines containing "allow": http_access deny manager or by hardening Cache Manager access privileges, for example: require authentication or other access controls in http_access beyond the default IP address restriction. - No known mitigations exist for CVE-2021-28662. Description =========== - CVE-2021-28651 (denial of service) Due to a buffer management bug Squid before version 4.15 is vulnerable to a denial of service attack against the server it is operating on. This attack is limited to proxies which attempt to resolve a "urn:" resource identifier. Support for this resolving is enabled by default in all Squid. - CVE-2021-28652 (denial of service) Due to an incorrect parser validation bug Squid before version 4.15 is vulnerable to a denial of Service attack against the Cache Manager API. - CVE-2021-28662 (denial of service) Due to an input validation bug Squid before version 4.15 is vulnerable to a denial of service against all clients using the proxy. Impact ====== A remote attacker can cause denial of service through crafted requests. References ========== https://github.com/squid-cache/squid/security/advisories/GHSA-ch36-9jhx-phm4 http://www.squid-cache.org/Versions/v4/changesets/squid-4-a975fd5aedc866629… https://github.com/squid-cache/squid/security/advisories/GHSA-m47m-9hvw-7447 http://www.squid-cache.org/Versions/v4/changesets/squid-4-0003e3518dc95e4b5… https://github.com/squid-cache/squid/security/advisories/GHSA-jjq6-mh2h-g39h http://www.squid-cache.org/Versions/v4/changesets/squid-4-b1c37c9e7b30d0efb… https://security.archlinux.org/CVE-2021-28651 https://security.archlinux.org/CVE-2021-28652 https://security.archlinux.org/CVE-2021-28662

1 0