June 2021 - Arch-security - lists.archlinux.org

[ASA-202106-57] pigeonhole: denial of service
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-57 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2020-28200 Package : pigeonhole Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2088 Summary ======= The package pigeonhole before version 0.5.15-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.5.15-1. # pacman -Syu "pigeonhole>=0.5.15-1" The problem has been fixed upstream in version 0.5.15. Workaround ========== Disabling the regex sieve extension avoids the worst problems. lmtp_user_concurrency_limit may also be helpful. Description =========== A security issue has been found in Pigeonhole before version 0.5.15. The Sieve interpreter is not protected against abusive scripts that claim excessive resource usage, especially scripts using massive amounts of regexps. This means an attacker can cause a denial of service of the mail delivery system by using excessive amount of CPU and/or reaching the lmtp/lda process limits. Impact ====== A user could consume an excessive amount of CPU resources through crafted Sieve scripts. References ========== https://dovecot.org/pipermail/dovecot-news/2021-June/000458.html https://dovecot.org/pipermail/dovecot-news/2021-June/000460.html https://github.com/dovecot/pigeonhole/commit/68505e444f91ebd784d419a8c11f1b… https://security.archlinux.org/CVE-2020-28200

1 0

[ASA-202106-56] dovecot: information disclosure
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-56 ========================================== Severity: High Date : 2021-06-22 CVE-ID : CVE-2021-29157 CVE-2021-33515 Package : dovecot Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2087 Summary ======= The package dovecot before version 2.3.15-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.3.15-1. # pacman -Syu "dovecot>=2.3.15-1" The problems have been fixed upstream in version 2.3.15. Workaround ========== CVE-2021-29157 can be mitigated by disabling local JWT validation in oauth2, or using a different dict driver than fs:posix. No known workaround exists for CVE-2021-33515. Description =========== - CVE-2021-29157 (information disclosure) A security issue has been found in Dovecot before version 2.3.14.1. The kid and azp fields in JWT tokens are not correctly escaped. This may be used to supply attacker controlled keys to validate tokens in some configurations. The attack requires an attacker to be able to write files to the local disk. As a result, a local attacker can login as any user and access their emails. - CVE-2021-33515 (information disclosure) A security issue has been found in Dovecot before version 2.3.14.1. An on-path attacker could inject plaintext commands before the STARTTLS negotiation that would be executed after STARTTLS finished with the client. Only the SMTP submission service is affected. As a result, an attacker can potentially steal user credentials and emails. The attacker needs to have sending permissions on the submission server (a valid username and password). Impact ====== A remote authenticated attacker or a local attacker with write access to the disk could disclose user credentials and emails. References ========== https://dovecot.org/pipermail/dovecot-news/2021-June/000461.html https://github.com/dovecot/core/commit/7f06f6274437ea97142df1f64f322b3ced44… https://github.com/dovecot/core/commit/7a77e070ddb6a67fe7a40118ba3e3f9b6062… https://github.com/dovecot/core/commit/bae4e44596d6548322665d242b055f44fe1d… https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html https://github.com/dovecot/core/commit/65bd1a27a361545c9ccf405b955c72a9c4d2… https://security.archlinux.org/CVE-2021-29157 https://security.archlinux.org/CVE-2021-33515

1 0

[ASA-202106-55] tpm2-tools: man-in-the-middle
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-55 ========================================== Severity: Low Date : 2021-06-22 CVE-ID : CVE-2021-3565 Package : tpm2-tools Type : man-in-the-middle Remote : No Link : https://security.archlinux.org/AVG-1986 Summary ======= The package tpm2-tools before version 5.1.1-1 is vulnerable to man-in- the-middle. Resolution ========== Upgrade to 5.1.1-1. # pacman -Syu "tpm2-tools>=5.1.1-1" The problem has been fixed upstream in version 5.1.1. Workaround ========== None. Description =========== A security issue was found in tpm2-tools before version 5.1.1. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a man-in-the-middle (MITM) attacker to unwrap the inner portion and reveal the key being imported. Impact ====== A local attacker could disclose the secret portion of a key while it is being imported into the TPM. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1964427 https://github.com/tpm2-software/tpm2-tools/issues/2738 https://github.com/tpm2-software/tpm2-tools/pull/2739 https://github.com/tpm2-software/tpm2-tools/commit/47b3b6e6fffed7080a2f1ce7… https://security.archlinux.org/CVE-2021-3565

1 0

[ASA-202106-54] exiv2: multiple issues
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-54 ========================================== Severity: Low Date : 2021-06-22 CVE-ID : CVE-2021-3482 CVE-2021-29457 CVE-2021-29458 CVE-2021-29463 CVE-2021-29464 CVE-2021-29470 CVE-2021-29473 CVE-2021-29623 CVE-2021-32617 Package : exiv2 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1772 Summary ======= The package exiv2 before version 0.27.4-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 0.27.4-1. # pacman -Syu "exiv2>=0.27.4-1" The problems have been fixed upstream in version 0.27.4. Workaround ========== None. Description =========== - CVE-2021-3482 (arbitrary code execution) A security issue was found in Exiv2 in versions before version 0.27.4. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. - CVE-2021-29457 (arbitrary code execution) A heap buffer overflow was found in Exiv2 before version 0.27.4. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. - CVE-2021-29458 (denial of service) An out-of-bounds read was found in Exiv2 before version 0.27.4. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. - CVE-2021-29463 (denial of service) An out-of-bounds read was found in Exiv2 before version 0.27.4. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. - CVE-2021-29464 (arbitrary code execution) A heap buffer overflow was found in Exiv2 before version 0.27.4. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. - CVE-2021-29470 (denial of service) An out-of-bounds read was found in Exiv2 before version 0.27.4. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. - CVE-2021-29473 (denial of service) An out-of-bounds read was found in Exiv2 before version 0.27.4. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. - CVE-2021-29623 (information disclosure) A read of uninitialized memory was found in Exiv2 before version 0.27.4. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack memory, if they can trick the victim into running Exiv2 on a crafted image file. - CVE-2021-32617 (denial of service) An inefficient algorithm (quadratic complexity) was found in Exiv2 before version 0.27.4. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as rm. Impact ====== Reading or writing EXIF metadata of a crafted image file could lead to arbitrary code execution. References ========== https://github.com/Exiv2/exiv2/security/advisories/GHSA-9jp9-m3fv-2vg9 https://github.com/Exiv2/exiv2/issues/1522 https://github.com/Exiv2/exiv2/pull/1523 https://github.com/Exiv2/exiv2/commit/22ea582c6b74ada30bec3a6b15de3c3e52f2b… https://github.com/Exiv2/exiv2/security/advisories/GHSA-v74w-h496-cgqm https://github.com/Exiv2/exiv2/issues/1529 https://github.com/Exiv2/exiv2/pull/1534 https://github.com/Exiv2/exiv2/commit/13e5a3e02339b746abcaee6408893ca2fd8e2… https://github.com/Exiv2/exiv2/security/advisories/GHSA-57jj-75fm-9rq5 https://github.com/Exiv2/exiv2/issues/1530 https://github.com/Exiv2/exiv2/pull/1536 https://github.com/Exiv2/exiv2/pull/1539 https://github.com/Exiv2/exiv2/commit/9b7a19f957af53304655ed1efe32253a1b11a… https://github.com/Exiv2/exiv2/security/advisories/GHSA-5p8g-9xf3-gfrr https://github.com/Exiv2/exiv2/pull/1577 https://github.com/Exiv2/exiv2/commit/d639e45c2cdc18b9b49b1307c6e4315277fa8… https://github.com/Exiv2/exiv2/security/advisories/GHSA-jgm9-5fw5-pw9p https://github.com/Exiv2/exiv2/pull/1576 https://github.com/Exiv2/exiv2/commit/0357f341e43f6e14123f227946574231ba379… https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj https://github.com/Exiv2/exiv2/pull/1581 https://github.com/Exiv2/exiv2/commit/f6ee71526eef5649a529ac6da3f2843e3b63e… https://github.com/Exiv2/exiv2/security/advisories/GHSA-7569-phvm-vwc2 https://github.com/Exiv2/exiv2/pull/1587 https://github.com/Exiv2/exiv2/commit/e6a0982f7cd9282052b6e3485a458d60629ff… https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v https://github.com/Exiv2/exiv2/pull/1627 https://github.com/Exiv2/exiv2/commit/0f9eb74c44c908e170a64cab590949d53749a… https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mj https://github.com/Exiv2/exiv2/pull/1657 https://github.com/Exiv2/exiv2/commit/c261fbaa2567687eec6a595d3016212fd6ae6… https://security.archlinux.org/CVE-2021-3482 https://security.archlinux.org/CVE-2021-29457 https://security.archlinux.org/CVE-2021-29458 https://security.archlinux.org/CVE-2021-29463 https://security.archlinux.org/CVE-2021-29464 https://security.archlinux.org/CVE-2021-29470 https://security.archlinux.org/CVE-2021-29473 https://security.archlinux.org/CVE-2021-29623 https://security.archlinux.org/CVE-2021-32617

1 0

[ASA-202106-53] keycloak: certificate verification bypass
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-53 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2020-35509 Package : keycloak Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-2084 Summary ======= The package keycloak before version 14.0.0-1 is vulnerable to certificate verification bypass. Resolution ========== Upgrade to 14.0.0-1. # pacman -Syu "keycloak>=14.0.0-1" The problem has been fixed upstream in version 14.0.0. Workaround ========== None. Description =========== A security issue has been found in Keycloak before version 14.0.0. Depending on the webserver configuration, a malicious user can supply an expired certificate and it would be accepted by Keycloak direct- grant authenticator. This is because Keycloak does not trigger the appropriate timestamp validation. Impact ====== A user could authenticate with an expired certificate. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1912427 https://issues.redhat.com/browse/KEYCLOAK-16450 https://github.com/keycloak/keycloak/pull/8067 https://github.com/keycloak/keycloak/commit/478319348bdfdb9b6d39122f41edf2a… https://security.archlinux.org/CVE-2020-35509

1 0

[ASA-202106-52] helm: information disclosure
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-52 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-32690 Package : helm Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2078 Summary ======= The package helm before version 3.6.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 3.6.1-1. # pacman -Syu "helm>=3.6.1-1" The problem has been fixed upstream in version 3.6.1. Workaround ========== None. Description =========== In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. The index.yaml within a Helm chart repository contains a reference where to get the chart archive for each version of a chart. The reference can be relative to the index.yaml file or a URL to location. The URL can point to any domain and this is a feature leveraged by Helm users. For example, an index.yaml file can be hosted on GitHub pages while the chart archives are hosted as GitHub releases. These are on different domain names and the index.yaml file points to the other domain. When a username and password were associated with a Helm repository the username and password were also passed on to other domains referenced in the index.yaml file. This occurred when Helm went to retrieve a specific chart archive on the other domain. Impact ====== Username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. References ========== https://github.com/helm/helm/security/advisories/GHSA-56hp-xqp3-w2jf https://github.com/helm/helm/commit/61d8e8c4a6f95540c15c6a65f36a6dd0a45e7a2f https://security.archlinux.org/CVE-2021-32690

1 0

[ASA-202106-51] matrix-appservice-irc: insufficient validation
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-51 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-32659 Package : matrix-appservice-irc Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-2076 Summary ======= The package matrix-appservice-irc before version 0.27.0-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 0.27.0-1. # pacman -Syu "matrix-appservice-irc>=0.27.0-1" The problem has been fixed upstream in version 0.27.0. Workaround ========== As a workaround, disabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options. Description =========== In versions 2.6.0 and earlier of matrix-appservice-bridge, as included in matrix-appservice-irc before version 0.27.0, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombstone` event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room `m.room.create` event is not checked to verify if the `predecessor` field contains the previous room. This means that any malicious admin of a bridged room can repoint the traffic to a different room without the new room being aware. Versions 2.6.1 and greater are patched. As a workaround, disabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options. Impact ====== A malicious admin of a bridged room can repoint the traffic to a different room without the new room being aware. References ========== https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/… https://github.com/matrix-org/matrix-appservice-irc/releases/tag/0.27.0 https://github.com/matrix-org/matrix-appservice-bridge/pull/330 https://github.com/matrix-org/matrix-appservice-bridge/commit/b69e745584a34… https://security.archlinux.org/CVE-2021-32659

1 0

[ASA-202106-50] tor: denial of service
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-50 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-34548 CVE-2021-34549 CVE-2021-34550 Package : tor Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2075 Summary ======= The package tor before version 0.4.5.9-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.4.5.9-1. # pacman -Syu "tor>=0.4.5.9-1" The problems have been fixed upstream in version 0.4.5.9. Workaround ========== None. Description =========== - CVE-2021-34548 (denial of service) A security issue has been found in Tor before version 0.4.5.9. Relays could spoof RELAY_END or RELAY_RESOLVED cell on half-closed streams because clients failed to validate which hop sent these cells. This would allow a relay on a circuit to end a stream that wasn't actually built with it. - CVE-2021-34549 (denial of service) A security issue has been found in Tor before version 0.4.5.9 that could be exploited for a hashtable-based CPU denial-of-service attack against relays. Previously a naive unkeyed hash function to look up circuits in a circuitmux object was used. An attacker could exploit this to construct circuits with chosen circuit IDs, to create collisions and make the hash table inefficient. Now a SipHash construction is used instead. - CVE-2021-34550 (denial of service) A security issue has been found in Tor before version 0.4.5.9. An out- of-bounds memory access in the v3 onion service descriptor parsing could be exploited by crafting an onion service descriptor that would crash any client that tried to visit it. Impact ====== A malicious relay could terminate client connections through crafted cells, leading to denial of service. A malicious client could cause denial of service on a relay through high resource usage using crafted circuit IDs. Lastly, clients could be crashed through crafted onion service descriptors. References ========== https://blog.torproject.org/node/2041 https://gitlab.torproject.org/tpo/core/tor/-/issues/40389 https://gitlab.torproject.org/tpo/core/tor/-/commit/adb248b6d6e0779719e6b87… https://gitlab.torproject.org/tpo/core/tor/-/issues/40391 https://gitlab.torproject.org/tpo/core/tor/-/commit/4c06c619faceb5d158a725d… https://gitlab.torproject.org/tpo/core/tor/-/issues/40392 https://gitlab.torproject.org/tpo/core/tor/-/commit/f57b5c48e0aa01acd84a194… https://security.archlinux.org/CVE-2021-34548 https://security.archlinux.org/CVE-2021-34549 https://security.archlinux.org/CVE-2021-34550

1 0

[ASA-202106-49] libslirp: information disclosure
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-49 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 Package : libslirp Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-2073 Summary ======= The package libslirp before version 4.6.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 4.6.0-1. # pacman -Syu "libslirp>=4.6.0-1" The problems have been fixed upstream in version 4.6.0. Workaround ========== None. Description =========== - CVE-2021-3592 (information disclosure) An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU before version 4.6.0. The flaw exists in the bootp_input() function and could occur while processing a UDP packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. - CVE-2021-3593 (information disclosure) An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU before version 4.6.0. The flaw exists in the udp6_input() function and could occur while processing a UDP packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. - CVE-2021-3594 (information disclosure) An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU before version 4.6.0. The flaw exists in the udp_input() function and could occur while processing a UDP packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. - CVE-2021-3595 (information disclosure) An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU before version 4.6.0. The flaw exists in the tftp_input() function and could occur while processing a UDP packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. Impact ====== A malicious guest could disclose contents of the host's memory using crafted UDP packets. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1970484 https://gitlab.freedesktop.org/slirp/libslirp/-/issues/44 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/93e645e72a056ec0b2c1… https://gitlab.freedesktop.org/slirp/libslirp/-/commit/f13cad45b25d92760bb0… https://gitlab.freedesktop.org/slirp/libslirp/-/commit/2eca0838eee1da962045… https://bugzilla.redhat.com/show_bug.cgi?id=1970487 https://gitlab.freedesktop.org/slirp/libslirp/-/issues/45 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/de71c15de66ba9350bf6… https://bugzilla.redhat.com/show_bug.cgi?id=1970491 https://gitlab.freedesktop.org/slirp/libslirp/-/issues/47 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/74572be49247c8c5feae… https://bugzilla.redhat.com/show_bug.cgi?id=1970489 https://gitlab.freedesktop.org/slirp/libslirp/-/issues/46 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3f17948137155f025f78… https://gitlab.freedesktop.org/slirp/libslirp/-/commit/990163cf3ac86b787555… https://security.archlinux.org/CVE-2021-3592 https://security.archlinux.org/CVE-2021-3593 https://security.archlinux.org/CVE-2021-3594 https://security.archlinux.org/CVE-2021-3595

1 0

[ASA-202106-48] nginx-mainline: arbitrary code execution
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-48 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-23017 Package : nginx-mainline Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1987 Summary ======= The package nginx-mainline before version 1.21.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.21.0-1. # pacman -Syu "nginx-mainline>=1.21.0-1" The problem has been fixed upstream in version 1.21.0. Workaround ========== The issue can be mitigated by removing the "resolver" directive from the configuration file. Description =========== A security issue in nginx resolver was identified, which might allow an attacker to cause 1-byte memory overwrite by using a specially crafted DNS response, resulting in worker process crash or, potentially, in arbitrary code execution. The issue only affects nginx if the "resolver" directive is used in the configuration file. Further, the attack is only possible if an attacker is able to forge UDP packets from the DNS server. Impact ====== A remote attacker could crash the nginx server, or potentially execute arbitrary code, using a crafted DNS server response. References ========== https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html http://nginx.org/download/patch.2021.resolver.txt https://github.com/nginx/nginx/commit/7199ebc203f74fd9e44595474de6bdc41740c… https://security.archlinux.org/CVE-2021-23017

1 0