May 2021 - Arch-security - lists.archlinux.org

[ASA-202105-9] hedgedoc: cross-site scripting
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-9 ========================================= Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-29503 Package : hedgedoc Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1946 Summary ======= The package hedgedoc before version 1.8.2-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.8.2-1. # pacman -Syu "hedgedoc>=1.8.2-1" The problem has been fixed upstream in version 1.8.2. Workaround ========== In order to prevent unauthenticated attacks it can be useful to disable guest edits until the next update. To do this, set the following to configuration options: { # other configs # … "allowAnonymous": false, "allowAnonymousEdits": false, } Or set the environment variables CMD_ALLOW_ANONYMOUS=false and CMD_ALLOW_ANONYMOUS_EDITS=false. Description =========== HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting (XSS) attack using the YAML-metadata of a note. An attacker with write access to a note can embed HTML tags in the Open Graph metadata section of the note, resulting in the frontend rendering the script tag as part of the <head> section. This vulnerability affects all installations. Unless your instance prevents guests from editing notes, this vulnerability allows unauthenticated attackers to inject JavaScript into notes that allow guest edits. If your instance prevents guests from editing notes, this vulnerability allows authenticated attackers to inject JavaScript into any note pages they have write-access to. Impact ====== A remote attacker with write access to a note can inject arbitrary JavaScript code that is executed through cross-site scripting when the note is viewed. References ========== https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-gjg7-4j2h-94fq https://github.com/hedgedoc/hedgedoc/commit/4a0216096a6aa1ebba9d8b0ada067c7… https://security.archlinux.org/CVE-2021-29503

1 0

[ASA-202105-8] vivaldi: multiple issues
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-8 ========================================= Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-30506 CVE-2021-30507 CVE-2021-30508 CVE-2021-30509 CVE-2021-30510 CVE-2021-30511 CVE-2021-30512 CVE-2021-30513 CVE-2021-30514 CVE-2021-30515 CVE-2021-30516 CVE-2021-30517 CVE-2021-30518 CVE-2021-30519 CVE-2021-30520 Package : vivaldi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1937 Summary ======= The package vivaldi before version 3.8.2259.42-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, incorrect calculation and information disclosure. Resolution ========== Upgrade to 3.8.2259.42-1. # pacman -Syu "vivaldi>=3.8.2259.42-1" The problems have been fixed upstream in version 3.8.2259.42. Workaround ========== None. Description =========== - CVE-2021-30506 (content spoofing) An incorrect security UI security issue has been found in the Web App Installs component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30507 (incorrect calculation) An inappropriate implementation security issue has been found in the Offline component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30508 (arbitrary code execution) A heap buffer overflow security issue has been found in the Media Feeds component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30509 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Strip component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30510 (arbitrary code execution) A race condition security issue has been found in the Aura component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30511 (information disclosure) An out of bounds read security issue has been found in the Tab Groups component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30512 (arbitrary code execution) A use after free security issue has been found in the Notifications component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30513 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30514 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30515 (arbitrary code execution) A use after free security issue has been found in the File API component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30516 (arbitrary code execution) A heap buffer overflow security issue has been found in the History component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30517 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30518 (arbitrary code execution) A heap buffer overflow security issue has been found in the Reader Mode component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30519 (arbitrary code execution) A use after free security issue has been found in the Payments component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30520 (arbitrary code execution) A use after free security issue has been found in the Tab Strip component of the Chromium browser before version 90.0.4430.212. Impact ====== A remote attacker could spoof content, disclose sensitive information, or execute arbitrary code through crafted web pages. References ========== https://vivaldi.com/blog/new-vivaldi-on-android-language-switcher-blocks-co… https://vivaldi.com/blog/desktop/minor-update-for-vivaldi-desktop-browser-3… https://vivaldi.com/blog/desktop/minor-update-2-for-vivaldi-desktop-browser… https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-des… https://crbug.com/1180126 https://crbug.com/1178202 https://crbug.com/1195340 https://crbug.com/1196309 https://crbug.com/1197436 https://crbug.com/1197875 https://crbug.com/1200019 https://crbug.com/1200490 https://crbug.com/1200766 https://crbug.com/1201073 https://crbug.com/1201446 https://crbug.com/1203122 https://crbug.com/1203590 https://crbug.com/1194058 https://crbug.com/1193362 https://security.archlinux.org/CVE-2021-30506 https://security.archlinux.org/CVE-2021-30507 https://security.archlinux.org/CVE-2021-30508 https://security.archlinux.org/CVE-2021-30509 https://security.archlinux.org/CVE-2021-30510 https://security.archlinux.org/CVE-2021-30511 https://security.archlinux.org/CVE-2021-30512 https://security.archlinux.org/CVE-2021-30513 https://security.archlinux.org/CVE-2021-30514 https://security.archlinux.org/CVE-2021-30515 https://security.archlinux.org/CVE-2021-30516 https://security.archlinux.org/CVE-2021-30517 https://security.archlinux.org/CVE-2021-30518 https://security.archlinux.org/CVE-2021-30519 https://security.archlinux.org/CVE-2021-30520

1 0

[ASA-202105-7] chromium: multiple issues
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-7 ========================================= Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-30506 CVE-2021-30507 CVE-2021-30508 CVE-2021-30509 CVE-2021-30510 CVE-2021-30511 CVE-2021-30512 CVE-2021-30513 CVE-2021-30514 CVE-2021-30515 CVE-2021-30516 CVE-2021-30517 CVE-2021-30518 CVE-2021-30519 CVE-2021-30520 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1936 Summary ======= The package chromium before version 90.0.4430.212-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, incorrect calculation and information disclosure. Resolution ========== Upgrade to 90.0.4430.212-1. # pacman -Syu "chromium>=90.0.4430.212-1" The problems have been fixed upstream in version 90.0.4430.212. Workaround ========== None. Description =========== - CVE-2021-30506 (content spoofing) An incorrect security UI security issue has been found in the Web App Installs component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30507 (incorrect calculation) An inappropriate implementation security issue has been found in the Offline component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30508 (arbitrary code execution) A heap buffer overflow security issue has been found in the Media Feeds component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30509 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Strip component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30510 (arbitrary code execution) A race condition security issue has been found in the Aura component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30511 (information disclosure) An out of bounds read security issue has been found in the Tab Groups component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30512 (arbitrary code execution) A use after free security issue has been found in the Notifications component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30513 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30514 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30515 (arbitrary code execution) A use after free security issue has been found in the File API component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30516 (arbitrary code execution) A heap buffer overflow security issue has been found in the History component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30517 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30518 (arbitrary code execution) A heap buffer overflow security issue has been found in the Reader Mode component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30519 (arbitrary code execution) A use after free security issue has been found in the Payments component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30520 (arbitrary code execution) A use after free security issue has been found in the Tab Strip component of the Chromium browser before version 90.0.4430.212. Impact ====== A remote attacker could spoof content, disclose sensitive information, or execute arbitrary code through crafted web pages. References ========== https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-des… https://crbug.com/1180126 https://crbug.com/1178202 https://crbug.com/1195340 https://crbug.com/1196309 https://crbug.com/1197436 https://crbug.com/1197875 https://crbug.com/1200019 https://crbug.com/1200490 https://crbug.com/1200766 https://crbug.com/1201073 https://crbug.com/1201446 https://crbug.com/1203122 https://crbug.com/1203590 https://crbug.com/1194058 https://crbug.com/1193362 https://security.archlinux.org/CVE-2021-30506 https://security.archlinux.org/CVE-2021-30507 https://security.archlinux.org/CVE-2021-30508 https://security.archlinux.org/CVE-2021-30509 https://security.archlinux.org/CVE-2021-30510 https://security.archlinux.org/CVE-2021-30511 https://security.archlinux.org/CVE-2021-30512 https://security.archlinux.org/CVE-2021-30513 https://security.archlinux.org/CVE-2021-30514 https://security.archlinux.org/CVE-2021-30515 https://security.archlinux.org/CVE-2021-30516 https://security.archlinux.org/CVE-2021-30517 https://security.archlinux.org/CVE-2021-30518 https://security.archlinux.org/CVE-2021-30519 https://security.archlinux.org/CVE-2021-30520

1 0

[ASA-202105-6] keycloak: multiple issues
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-6 ========================================= Severity: High Date : 2021-05-19 CVE-ID : CVE-2020-14302 CVE-2020-27838 CVE-2021-3513 CVE-2021-20202 CVE-2021-20222 Package : keycloak Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1926 Summary ======= The package keycloak before version 13.0.0-1 is vulnerable to multiple issues including cross-site scripting, information disclosure and insufficient validation. Resolution ========== Upgrade to 13.0.0-1. # pacman -Syu "keycloak>=13.0.0-1" The problems have been fixed upstream in version 13.0.0. Workaround ========== None. Description =========== - CVE-2020-14302 (insufficient validation) A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks. - CVE-2020-27838 (information disclosure) A security issue was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. - CVE-2021-3513 (information disclosure) A security issue was found in keycloak before version 13.0.0 where brute force attacks are possible even when the permanent lockout feature is enabled because of the wrong error message that is displayed when wrong credentials are entered. - CVE-2021-20202 (information disclosure) A security issue was found in keycloak before version 13.0.0. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. - CVE-2021-20222 (cross-site scripting) A security issue was found in keycloak before version 13.0.0. The new account console in keycloak can allow malicious code to be executed using the referrer URL. Impact ====== A remote attacker could perform replay attacks, obtain information about CONFIDENTIAL clients, brute force account credentials, or execute arbitrary code through cross-site scripting. A local attacker could access sensitive information stored in temporary directories. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1849584 https://issues.redhat.com/browse/KEYCLOAK-14483 https://github.com/keycloak/keycloak/pull/7807 https://github.com/keycloak/keycloak/commit/41dc94fead4c20560e0dd96c3efbd7b… https://bugzilla.redhat.com/show_bug.cgi?id=1906797 https://issues.redhat.com/browse/KEYCLOAK-16521 https://github.com/keycloak/keycloak/pull/7790 https://github.com/keycloak/keycloak/commit/9356843c6c3d7097d010b3bb6f91e25… https://bugzilla.redhat.com/show_bug.cgi?id=1953439 https://issues.redhat.com/browse/KEYCLOAK-17835 https://github.com/keycloak/keycloak/pull/7976 https://github.com/keycloak/keycloak/commit/315b9e3c2970145e03dfaaddc364d58… https://bugzilla.redhat.com/show_bug.cgi?id=1922128 https://issues.redhat.com/browse/KEYCLOAK-17000 https://github.com/keycloak/keycloak/pull/7859 https://github.com/keycloak/keycloak/commit/853a6d73276849877819f2dc2313355… https://bugzilla.redhat.com/show_bug.cgi?id=1924606 https://issues.redhat.com/browse/KEYCLOAK-17033 https://github.com/keycloak/keycloak/pull/7868 https://github.com/keycloak/keycloak/commit/3b80eee5bfdf2b80c47465c0f2eaf70… https://security.archlinux.org/CVE-2020-14302 https://security.archlinux.org/CVE-2020-27838 https://security.archlinux.org/CVE-2021-3513 https://security.archlinux.org/CVE-2021-20202 https://security.archlinux.org/CVE-2021-20222

1 0

[ASA-202105-5] firefox: arbitrary code execution
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-5 ========================================= Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-29952 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1917 Summary ======= The package firefox before version 88.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 88.0.1-1. # pacman -Syu "firefox>=88.0.1-1" The problem has been fixed upstream in version 88.0.1. Workaround ========== None. Description =========== A security issue has been found in Firefox before version 88.0.1. When Web Render components were destructed, a race condition could have caused undefined behavior, and Mozilla presumes that with enough effort may have been exploitable to run arbitrary code. Impact ====== A remote attacker could execute arbitrary code through a crafted HTML page. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2021-20/#CVE-2021-299… https://bugzilla.mozilla.org/show_bug.cgi?id=1704227 https://security.archlinux.org/CVE-2021-29952

1 0

[ASA-202105-4] gitlab: multiple issues
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-4 ========================================= Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-22206 CVE-2021-22208 CVE-2021-22209 CVE-2021-22210 CVE-2021-22211 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1888 Summary ======= The package gitlab before version 13.10.4-1 is vulnerable to multiple issues including insufficient validation, access restriction bypass, denial of service and information disclosure. Resolution ========== Upgrade to 13.10.4-1. # pacman -Syu "gitlab>=13.10.4-1" The problems have been fixed upstream in version 13.10.4. Workaround ========== None. Description =========== - CVE-2021-22206 (information disclosure) An issue has been discovered in GitLab affecting all versions prior to 11.6. Pull mirror credentials were exposed and could allow other maintainers to view the credentials in plain-text. The issue is fixed in GitLab versions 13.11.2, 13.10.4 and 13.9.7. - CVE-2021-22208 (access restriction bypass) An issue has been discovered in GitLab affecting versions prior to 13.5. Improper permission check could allow the change of timestamp for issue creation or update. The issue is fixed in GitLab versions 13.11.2, 13.10.4 and 13.9.7. - CVE-2021-22209 (insufficient validation) An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted in GraphQL mutation being executed. The issue is fixed in GitLab versions 13.11.2, 13.10.4 and 13.9.7. - CVE-2021-22210 (denial of service) An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring a query parameter and returning a considerable amount of results. The issue is fixed in GitLab versions 13.11.2, 13.10.4 and 13.9.7. - CVE-2021-22211 (access restriction bypass) An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a user resulting in possibly incorrect access handling. The issue is fixed in GitLab versions 13.11.2, 13.10.4 and 13.9.7. Impact ====== A remote attacker could obtain sensitive pull mirror credentials, manipulate issue creation timestamps, execute GraphQL mutations, cause denial of service by generating large API query responses, or impersonate other users. References ========== https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-11-… https://gitlab.com/gitlab-org/gitlab/-/issues/230864 https://hackerone.com/reports/928074 https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-11-… https://gitlab.com/gitlab-org/gitlab/-/issues/301212 https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-11-… https://gitlab.com/gitlab-org/gitlab/-/issues/327155 https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-11-… https://gitlab.com/gitlab-org/gitlab/-/issues/322500 https://about.gitlab.com/releases/2021/04/28/security-release-gitlab-13-11-… https://gitlab.com/gitlab-org/gitlab/-/issues/298847 https://security.archlinux.org/CVE-2021-22206 https://security.archlinux.org/CVE-2021-22208 https://security.archlinux.org/CVE-2021-22209 https://security.archlinux.org/CVE-2021-22210 https://security.archlinux.org/CVE-2021-22211

1 0

[ASA-202105-3] ceph: multiple issues
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-3 ========================================= Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-3509 CVE-2021-3524 CVE-2021-3531 CVE-2021-20288 Package : ceph Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1826 Summary ======= The package ceph before version 15.2.12-1 is vulnerable to multiple issues including insufficient validation, cross-site scripting, denial of service and url request injection. Resolution ========== Upgrade to 15.2.12-1. # pacman -Syu "ceph>=15.2.12-1" The problems have been fixed upstream in version 15.2.12. Workaround ========== None. Description =========== - CVE-2021-3509 (cross-site scripting) A security issue was found in ceph before version 15.2.12. In order to make the JWT token inaccessible through cross-site scripting (XSS), it was moved from localStorage to httpOnly Cookie (CVE-2020-27839). But token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS. - CVE-2021-3524 (url request injection) A security issue was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) before version 15.2.12. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created. - CVE-2021-3531 (denial of service) A security issue was found in the Red Hat Ceph Storage RGW before version 15.2.12. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. - CVE-2021-20288 (insufficient validation) An authentication flaw was found in ceph before version 15.2.11. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. Impact ====== A remote attacker could obtain a user's access token using cross-site scripting, inject headers into requests to bypass CORS, crash the server using a crafted request, or reuse old authentication keys. References ========== https://bugs.archlinux.org/task/70450 https://bugzilla.redhat.com/show_bug.cgi?id=1950116 https://github.com/ceph/ceph/commit/7a1ca8d372da3b6a4fc3d221a0e5f72d1d61c27b https://bugzilla.redhat.com/show_bug.cgi?id=1951674 https://github.com/ceph/ceph/commit/94f7c87a78b05ec856a5ee1ff62af136331776a3 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2021-3531 https://github.com/ceph/ceph/commit/b87e64e3206210580f4a6df2d77f9ae3f1033039 https://www.openwall.com/lists/oss-security/2021/04/14/2 https://bugzilla.redhat.com/show_bug.cgi?id=1938031 https://github.com/ceph/ceph/commit/1f57617d5edb45a8a696eac7c910e8fc44c934a3 https://github.com/ceph/ceph/commit/9f3efe7cd1a780b91e5c8cfee192a0c51d0151dc https://security.archlinux.org/CVE-2021-3509 https://security.archlinux.org/CVE-2021-3524 https://security.archlinux.org/CVE-2021-3531 https://security.archlinux.org/CVE-2021-20288

1 0

[ASA-202105-2] python-flask-security-too: cross-site request forgery
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-2 ========================================= Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-21241 Package : python-flask-security-too Type : cross-site request forgery Remote : Yes Link : https://security.archlinux.org/AVG-1434 Summary ======= The package python-flask-security-too before version 4.0.1-1 is vulnerable to cross-site request forgery. Resolution ========== Upgrade to 4.0.1-1. # pacman -Syu "python-flask-security-too>=4.0.1-1" The problem has been fixed upstream in version 4.0.1. Workaround ========== If you aren't using authentication tokens, you can set SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. Description =========== In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. Impact ====== A remote attacker could obtain a user's authentication token from a cross-site request. References ========== https://bugs.archlinux.org/task/70041 https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA… https://github.com/Flask-Middleware/flask-security/issues/421 https://github.com/Flask-Middleware/flask-security/pull/422 https://github.com/Flask-Middleware/flask-security/commit/c05afe837e83f20f5… https://security.archlinux.org/CVE-2021-21241

1 0

[ASA-202105-1] redmine: multiple issues
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-1 ========================================= Severity: Critical Date : 2021-05-19 CVE-ID : CVE-2021-29274 CVE-2021-30163 CVE-2021-30164 CVE-2021-31863 CVE-2021-31864 CVE-2021-31865 CVE-2021-31866 Package : redmine Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1743 Summary ======= The package redmine before version 4.2.1-1 is vulnerable to multiple issues including arbitrary filesystem access, access restriction bypass, cross-site scripting, arbitrary file upload and information disclosure. Resolution ========== Upgrade to 4.2.1-1. # pacman -Syu "redmine>=4.2.1-1" The problems have been fixed upstream in version 4.2.1. Workaround ========== None. Description =========== - CVE-2021-29274 (cross-site scripting) Redmine 4.1.x before 4.1.2 allows cross-site scripting (XSS) because an issue's subject is mishandled in the auto complete tip. - CVE-2021-30163 (information disclosure) Redmine before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values. - CVE-2021-30164 (access restriction bypass) Redmine before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API. - CVE-2021-31863 (arbitrary filesystem access) Insufficient input validation in the Git repository integration of Redmine before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process. - CVE-2021-31864 (access restriction bypass) Redmine before 4.2.1 allows attackers to bypass the add_issue_notes permission requirement by leveraging the incoming mail handler. - CVE-2021-31865 (arbitrary file upload) Redmine before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded attachments. - CVE-2021-31866 (information disclosure) Redmine before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController. Impact ====== A remote attacker could disclose private information, perform actions without having the required permissions, or execute arbitrary JavaScript code by leveraging cross-site scripting. References ========== https://bugs.archlinux.org/task/70203 https://www.redmine.org/projects/redmine/wiki/Security_Advisories https://www.redmine.org/issues/33846 https://github.com/redmine/redmine/commit/bbfade972865e78e4d865af2cdb93e6cb… https://www.redmine.org/issues/33360 https://github.com/redmine/redmine/commit/0d96c4ebdb1cceeb6cac8f940a11b5407… https://www.redmine.org/issues/33689 https://github.com/redmine/redmine/commit/a7b9fa99966e8d59bd88548248ab11400… https://www.redmine.org/issues/35085 https://github.com/redmine/redmine/commit/45461bfe51e9492d607f7204120f49ce3… https://www.redmine.org/issues/35045 https://github.com/redmine/redmine/commit/d03a718e6efca0493d8b42bd4ba356d73… https://www.redmine.org/issues/34367 https://github.com/redmine/redmine/commit/56979912c9bb041aac3fc5b88bf8275b7… https://www.redmine.org/issues/34950 https://github.com/redmine/redmine/commit/23e09ef64e26d6f63dcdcd624827440d9… https://security.archlinux.org/CVE-2021-29274 https://security.archlinux.org/CVE-2021-30163 https://security.archlinux.org/CVE-2021-30164 https://security.archlinux.org/CVE-2021-31863 https://security.archlinux.org/CVE-2021-31864 https://security.archlinux.org/CVE-2021-31865 https://security.archlinux.org/CVE-2021-31866

1 0