June 2021 - Arch-security - lists.archlinux.org

[ASA-202106-17] rabbitmq: denial of service
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-17 ========================================== Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2021-22116 Package : rabbitmq Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1966 Summary ======= The package rabbitmq before version 3.8.16-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.8.16-1. # pacman -Syu "rabbitmq>=3.8.16-1" The problem has been fixed upstream in version 3.8.16. Workaround ========== None. Description =========== RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. An attacker can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled. Impact ====== A remote attacker could crash the RabbitMQ server through crafted AMQP messages. References ========== https://tanzu.vmware.com/security/cve-2021-22116 https://security.archlinux.org/CVE-2021-22116

1 0

[ASA-202106-16] pam-u2f: authentication bypass
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-16 ========================================== Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2021-31924 Package : pam-u2f Type : authentication bypass Remote : No Link : https://security.archlinux.org/AVG-2001 Summary ======= The package pam-u2f before version 1.1.1-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 1.1.1-1. # pacman -Syu "pam-u2f>=1.1.1-1" The problem has been fixed upstream in version 1.1.1. Workaround ========== None. Description =========== Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature verification to be bypassed, so an attacker would still need to physically possess and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN requirement is bypassed. Impact ====== A local attacker could authenticate with a U2F device without having to enter the correct PIN. References ========== https://www.yubico.com/support/security-advisories/ysa-2021-03/ https://github.com/Yubico/pam-u2f/issues/175 https://github.com/Yubico/pam-u2f/pull/180 https://github.com/Yubico/pam-u2f/commit/6059b057dd9b6d0164fc16f9422c0d728f… https://github.com/Yubico/pam-u2f/commit/1ffd435c9c26e8c3122ea121d3e0b55cb8… https://security.archlinux.org/CVE-2021-31924

1 0

[ASA-202106-15] postgresql: multiple issues
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-15 ========================================== Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2021-32027 CVE-2021-32028 CVE-2021-32029 Package : postgresql Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1956 Summary ======= The package postgresql before version 13.3-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 13.3-1. # pacman -Syu "postgresql>=13.3-1" The problems have been fixed upstream in version 13.3. Workaround ========== None. Description =========== - CVE-2021-32027 (arbitrary code execution) A security issue was found in PostgreSQL before version 13.3. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. - CVE-2021-32028 (information disclosure) A security issue was found in PostgreSQL before version 13.3. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas cannot use this attack at will. - CVE-2021-32029 (information disclosure) A security issue was found in PostgreSQL before version 13.3. Using an UPDATE ... RETURNING on a purpose-crafted partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas typically cannot use this attack at will. Impact ====== An authenticated remote attacker could read the database server memory or execute arbitrary code on the server. References ========== https://www.postgresql.org/support/security/CVE-2021-32027/ https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=467395bf… https://www.postgresql.org/support/security/CVE-2021-32028/ https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=4a8656a7… https://www.postgresql.org/support/security/CVE-2021-32029/ https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=a71cfc56… https://security.archlinux.org/CVE-2021-32027 https://security.archlinux.org/CVE-2021-32028 https://security.archlinux.org/CVE-2021-32029

1 0

[ASA-202106-14] ruby-bundler: insufficient validation
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-14 ========================================== Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2020-36327 Package : ruby-bundler Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1891 Summary ======= The package ruby-bundler before version 2.2.18-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 2.2.18-1. # pacman -Syu "ruby-bundler>=2.2.18-1" The problem has been fixed upstream in version 2.2.18. Workaround ========== None. Description =========== Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. Impact ====== A remote attacker could replace a private gem in a project with a public gem under their control with a higher version number. References ========== https://github.com/rubygems/rubygems/issues/3982 https://github.com/rubygems/rubygems/pull/4609 https://github.com/rubygems/rubygems/commit/d68d3cdb9cc69f648f87e5d3f258816… https://security.archlinux.org/CVE-2020-36327

1 0

[ASA-202106-13] zint: arbitrary code execution
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-13 ========================================== Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2021-27799 Package : zint Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1625 Summary ======= The package zint before version 2.9.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.9.1-2. # pacman -Syu "zint>=2.9.1-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== ean_leading_zeroes in backend/upcean.c in Zint Barcode Generator 2.9.1 has a stack-based buffer overflow that is reachable from the C API through an application that includes the Zint Barcode Generator library code. Impact ====== An attacker could execute arbitrary code by supplying crafted input to generate an EAN barcode. References ========== https://bugs.archlinux.org/task/70051 https://sourceforge.net/p/zint/tickets/218/ https://sourceforge.net/p/zint/code/ci/7f8c8114f31c09a986597e0ba63a49f96150… https://security.archlinux.org/CVE-2021-27799

1 0

[ASA-202106-12] redis: arbitrary code execution
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-12 ========================================== Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-32625 Package : redis Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2022 Summary ======= The package redis before version 6.2.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 6.2.4-1. # pacman -Syu "redis>=6.2.4-1" The problem has been fixed upstream in version 6.2.4. Workaround ========== A workaround to mitigate the problem is to use an ACL configuration to prevent clients from using the STRALGO LCS command. On systems running Redis version 6.2.3, it is sufficient to make sure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB). Description =========== An integer overflow bug in Redis versions 6.0 up to 6.2.3 can be exploited using the STRALGO LCS command to corrupt the heap and potentially result in remote code execution. This is a result of an incomplete fix of CVE-2021-29477. Impact ====== A remote attacker could execute arbitrary code on the database server through a crafted STRALGO LCS command. References ========== https://github.com/redis/redis/security/advisories/GHSA-46cp-x4x9-6pfq https://github.com/redis/redis/pull/9011 https://github.com/redis/redis/pull/9019 https://github.com/redis/redis/commit/e9a1438ac4c52aa68dfa2a8324b6419356842… https://security.archlinux.org/CVE-2021-32625

1 0

[ASA-202106-11] dhcp: arbitrary code execution
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-11 ========================================== Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-25217 Package : dhcp Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2004 Summary ======= The package dhcp before version 4.4.2.P1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.4.2.P1-1. # pacman -Syu "dhcp>=4.4.2.P1-1" The problem has been fixed upstream in version 4.4.2.P1. Workaround ========== None. Description =========== A buffer overrun in the lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient before version 4.4.2-P1. Impact ====== An attacker could crash the DHCP server, or potentially execute arbitrary code, through a crafted lease file. References ========== https://kb.isc.org/docs/cve-2021-25217 https://downloads.isc.org/isc/dhcp/4.4.2-P1/patches/4.4.2.CVE-2021-25217.pa… https://security.archlinux.org/CVE-2021-25217

1 0

[ASA-202106-10] dhclient: arbitrary code execution
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-10 ========================================== Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-25217 Package : dhclient Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2004 Summary ======= The package dhclient before version 4.4.2.P1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.4.2.P1-1. # pacman -Syu "dhclient>=4.4.2.P1-1" The problem has been fixed upstream in version 4.4.2.P1. Workaround ========== None. Description =========== A buffer overrun in the lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient before version 4.4.2-P1. Impact ====== An attacker could crash the DHCP client, or potentially execute arbitrary code, through a crafted lease file. References ========== https://kb.isc.org/docs/cve-2021-25217 https://downloads.isc.org/isc/dhcp/4.4.2-P1/patches/4.4.2.CVE-2021-25217.pa… https://security.archlinux.org/CVE-2021-25217

1 0

[ASA-202106-9] lib32-libcurl-gnutls: information disclosure
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-9 ========================================= Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2021-22898 Package : lib32-libcurl-gnutls Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2000 Summary ======= The package lib32-libcurl-gnutls before version 7.77.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.77.0-1. # pacman -Syu "lib32-libcurl-gnutls>=7.77.0-1" The problem has been fixed upstream in version 7.77.0. Workaround ========== The issue can be mitigated by avoiding to use the -t command line option and CURLOPT_TELNETOPTIONS. Description =========== A security issue has been found in curl before version 7.77.0. curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. Impact ====== curl could disclose potentially sensitive memory information to a remote server over Telnet when an uncommon option is used. References ========== https://curl.se/docs/CVE-2021-22898.html https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde https://security.archlinux.org/CVE-2021-22898

1 0

[ASA-202106-8] libcurl-gnutls: information disclosure
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-8 ========================================= Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2021-22898 Package : libcurl-gnutls Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1999 Summary ======= The package libcurl-gnutls before version 7.77.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.77.0-1. # pacman -Syu "libcurl-gnutls>=7.77.0-1" The problem has been fixed upstream in version 7.77.0. Workaround ========== The issue can be mitigated by avoiding to use the -t command line option and CURLOPT_TELNETOPTIONS. Description =========== A security issue has been found in curl before version 7.77.0. curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. Impact ====== curl could disclose potentially sensitive memory information to a remote server over Telnet when an uncommon option is used. References ========== https://curl.se/docs/CVE-2021-22898.html https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde https://security.archlinux.org/CVE-2021-22898

1 0