July 2021 - Arch-security - lists.archlinux.org

[ASA-202107-64] lib32-libcurl-gnutls: multiple issues
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-64 ========================================== Severity: Medium Date : 2021-07-21 CVE-ID : CVE-2021-22924 CVE-2021-22925 Package : lib32-libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2199 Summary ======= The package lib32-libcurl-gnutls before version 7.78.0-1 is vulnerable to multiple issues including information disclosure and insufficient validation. Resolution ========== Upgrade to 7.78.0-1. # pacman -Syu "lib32-libcurl-gnutls>=7.78.0-1" The problems have been fixed upstream in version 7.78.0. Workaround ========== CVE-2021-22925 can be mitigated by avoiding to use CURLOPT_TELNETOPTIONS. No known workaround exists for CVE-2021-22924. Description =========== - CVE-2021-22924 (insufficient validation) A security issue has been found in curl before version 7.78.0. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take 'issuer cert' into account and it compared the involved paths case insensitively, which could lead to libcurl reusing wrong connections. File paths are, or can be, case sensitive on many systems but not all, and can even vary depending on used file systems. The comparison also didn't include the 'issuer cert' which a transfer can set to qualify how to verify the server certificate. - CVE-2021-22925 (information disclosure) A security issue has been found in curl before version 7.78.0. curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV variables, libcurl before version 7.78.0 could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. This could happen because curl did not call and use sscanf() correctly when parsing the string provided by the application. The previous curl security vulnerability CVE-2021-22898 is almost identical to this one but the fix was insufficient so this security vulnerability remained. Impact ====== libcurl could disclose potentially sensitive memory contents to a remote server when an uncommon option for TELNET servers is used. Additionally, libcurl did not sufficiently verify the 'issuer cert' when reusing connections. References ========== https://curl.se/docs/CVE-2021-22924.html https://github.com/curl/curl/commit/5ea3145850ebff1dc2b13d17440300a01ca38161 https://curl.se/docs/CVE-2021-22925.html https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a https://security.archlinux.org/CVE-2021-22924 https://security.archlinux.org/CVE-2021-22925

1 0

[ASA-202107-63] libcurl-gnutls: multiple issues
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-63 ========================================== Severity: Medium Date : 2021-07-21 CVE-ID : CVE-2021-22924 CVE-2021-22925 Package : libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2198 Summary ======= The package libcurl-gnutls before version 7.78.0-1 is vulnerable to multiple issues including information disclosure and insufficient validation. Resolution ========== Upgrade to 7.78.0-1. # pacman -Syu "libcurl-gnutls>=7.78.0-1" The problems have been fixed upstream in version 7.78.0. Workaround ========== CVE-2021-22925 can be mitigated by avoiding to use CURLOPT_TELNETOPTIONS. No known workaround exists for CVE-2021-22924. Description =========== - CVE-2021-22924 (insufficient validation) A security issue has been found in curl before version 7.78.0. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take 'issuer cert' into account and it compared the involved paths case insensitively, which could lead to libcurl reusing wrong connections. File paths are, or can be, case sensitive on many systems but not all, and can even vary depending on used file systems. The comparison also didn't include the 'issuer cert' which a transfer can set to qualify how to verify the server certificate. - CVE-2021-22925 (information disclosure) A security issue has been found in curl before version 7.78.0. curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV variables, libcurl before version 7.78.0 could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. This could happen because curl did not call and use sscanf() correctly when parsing the string provided by the application. The previous curl security vulnerability CVE-2021-22898 is almost identical to this one but the fix was insufficient so this security vulnerability remained. Impact ====== libcurl could disclose potentially sensitive memory contents to a remote server when an uncommon option for TELNET servers is used. Additionally, libcurl did not sufficiently verify the 'issuer cert' when reusing connections. References ========== https://curl.se/docs/CVE-2021-22924.html https://github.com/curl/curl/commit/5ea3145850ebff1dc2b13d17440300a01ca38161 https://curl.se/docs/CVE-2021-22925.html https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a https://security.archlinux.org/CVE-2021-22924 https://security.archlinux.org/CVE-2021-22925

1 0

[ASA-202107-62] lib32-libcurl-compat: multiple issues
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-62 ========================================== Severity: Medium Date : 2021-07-21 CVE-ID : CVE-2021-22924 CVE-2021-22925 Package : lib32-libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2197 Summary ======= The package lib32-libcurl-compat before version 7.78.0-1 is vulnerable to multiple issues including information disclosure and insufficient validation. Resolution ========== Upgrade to 7.78.0-1. # pacman -Syu "lib32-libcurl-compat>=7.78.0-1" The problems have been fixed upstream in version 7.78.0. Workaround ========== CVE-2021-22925 can be mitigated by avoiding to use CURLOPT_TELNETOPTIONS. No known workaround exists for CVE-2021-22924. Description =========== - CVE-2021-22924 (insufficient validation) A security issue has been found in curl before version 7.78.0. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take 'issuer cert' into account and it compared the involved paths case insensitively, which could lead to libcurl reusing wrong connections. File paths are, or can be, case sensitive on many systems but not all, and can even vary depending on used file systems. The comparison also didn't include the 'issuer cert' which a transfer can set to qualify how to verify the server certificate. - CVE-2021-22925 (information disclosure) A security issue has been found in curl before version 7.78.0. curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV variables, libcurl before version 7.78.0 could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. This could happen because curl did not call and use sscanf() correctly when parsing the string provided by the application. The previous curl security vulnerability CVE-2021-22898 is almost identical to this one but the fix was insufficient so this security vulnerability remained. Impact ====== libcurl could disclose potentially sensitive memory contents to a remote server when an uncommon option for TELNET servers is used. Additionally, libcurl did not sufficiently verify the 'issuer cert' when reusing connections. References ========== https://curl.se/docs/CVE-2021-22924.html https://github.com/curl/curl/commit/5ea3145850ebff1dc2b13d17440300a01ca38161 https://curl.se/docs/CVE-2021-22925.html https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a https://security.archlinux.org/CVE-2021-22924 https://security.archlinux.org/CVE-2021-22925

1 0

[ASA-202107-61] libcurl-compat: multiple issues
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-61 ========================================== Severity: Medium Date : 2021-07-21 CVE-ID : CVE-2021-22924 CVE-2021-22925 Package : libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2196 Summary ======= The package libcurl-compat before version 7.78.0-1 is vulnerable to multiple issues including information disclosure and insufficient validation. Resolution ========== Upgrade to 7.78.0-1. # pacman -Syu "libcurl-compat>=7.78.0-1" The problems have been fixed upstream in version 7.78.0. Workaround ========== CVE-2021-22925 can be mitigated by avoiding to use CURLOPT_TELNETOPTIONS. No known workaround exists for CVE-2021-22924. Description =========== - CVE-2021-22924 (insufficient validation) A security issue has been found in curl before version 7.78.0. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take 'issuer cert' into account and it compared the involved paths case insensitively, which could lead to libcurl reusing wrong connections. File paths are, or can be, case sensitive on many systems but not all, and can even vary depending on used file systems. The comparison also didn't include the 'issuer cert' which a transfer can set to qualify how to verify the server certificate. - CVE-2021-22925 (information disclosure) A security issue has been found in curl before version 7.78.0. curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV variables, libcurl before version 7.78.0 could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. This could happen because curl did not call and use sscanf() correctly when parsing the string provided by the application. The previous curl security vulnerability CVE-2021-22898 is almost identical to this one but the fix was insufficient so this security vulnerability remained. Impact ====== libcurl could disclose potentially sensitive memory contents to a remote server when an uncommon option for TELNET servers is used. Additionally, libcurl did not sufficiently verify the 'issuer cert' when reusing connections. References ========== https://curl.se/docs/CVE-2021-22924.html https://github.com/curl/curl/commit/5ea3145850ebff1dc2b13d17440300a01ca38161 https://curl.se/docs/CVE-2021-22925.html https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a https://security.archlinux.org/CVE-2021-22924 https://security.archlinux.org/CVE-2021-22925

1 0

[ASA-202107-60] lib32-curl: multiple issues
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-60 ========================================== Severity: Medium Date : 2021-07-21 CVE-ID : CVE-2021-22924 CVE-2021-22925 Package : lib32-curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2195 Summary ======= The package lib32-curl before version 7.78.0-1 is vulnerable to multiple issues including information disclosure and insufficient validation. Resolution ========== Upgrade to 7.78.0-1. # pacman -Syu "lib32-curl>=7.78.0-1" The problems have been fixed upstream in version 7.78.0. Workaround ========== CVE-2021-22925 can be mitigated by avoiding to use CURLOPT_TELNETOPTIONS. No known workaround exists for CVE-2021-22924. Description =========== - CVE-2021-22924 (insufficient validation) A security issue has been found in curl before version 7.78.0. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take 'issuer cert' into account and it compared the involved paths case insensitively, which could lead to libcurl reusing wrong connections. File paths are, or can be, case sensitive on many systems but not all, and can even vary depending on used file systems. The comparison also didn't include the 'issuer cert' which a transfer can set to qualify how to verify the server certificate. - CVE-2021-22925 (information disclosure) A security issue has been found in curl before version 7.78.0. curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV variables, libcurl before version 7.78.0 could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. This could happen because curl did not call and use sscanf() correctly when parsing the string provided by the application. The previous curl security vulnerability CVE-2021-22898 is almost identical to this one but the fix was insufficient so this security vulnerability remained. Impact ====== libcurl could disclose potentially sensitive memory contents to a remote server when an uncommon option for TELNET servers is used. Additionally, libcurl did not sufficiently verify the 'issuer cert' when reusing connections. References ========== https://curl.se/docs/CVE-2021-22924.html https://github.com/curl/curl/commit/5ea3145850ebff1dc2b13d17440300a01ca38161 https://curl.se/docs/CVE-2021-22925.html https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a https://security.archlinux.org/CVE-2021-22924 https://security.archlinux.org/CVE-2021-22925

1 0

[ASA-202107-59] curl: multiple issues
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-59 ========================================== Severity: Medium Date : 2021-07-21 CVE-ID : CVE-2021-22922 CVE-2021-22923 CVE-2021-22924 CVE-2021-22925 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2194 Summary ======= The package curl before version 7.78.0-1 is vulnerable to multiple issues including information disclosure and insufficient validation. Resolution ========== Upgrade to 7.78.0-1. # pacman -Syu "curl>=7.78.0-1" The problems have been fixed upstream in version 7.78.0. Workaround ========== CVE-2021-22922 and CVE-2021-22923 can be mitigated by making sure not to use metalink with curl. CVE-2021-22925 can be mitigated by avoiding to use the -t command line option and CURLOPT_TELNETOPTIONS. No known workaround exists for CVE-2021-22924. Description =========== - CVE-2021-22922 (insufficient validation) A security issue has been found in curl before version 7.78.0. When curl is instructed to download content using the metalink feature, the contents is verified against a hash provided in the metalink XML file. The metalink XML file points out to the client how to get the same content from a set of different URLs, potentially hosted by different servers and the client can then download the file from one or several of them in a serial or parallel manner. If one of the servers hosting the contents has been breached and the contents of the specific file on that server is replaced with a modified payload, curl should detect this when the hash of the file mismatches after a completed download. It should remove the contents and instead try getting the contents from another URL. This is not done, and instead such a hash mismatch is only mentioned in text and the potentially malicious content is kept in the file on disk. There's a risk the user doesn't notice the message and instead assumes the file is fine. This flaw exists only in the curl tool. libcurl is not affected. - CVE-2021-22923 (information disclosure) A security issue has been found in curl before version 7.78.0 When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from; often contrary to the user's expectations and intentions and without telling the user it happened. This flaw exists only in the curl tool. libcurl is not affected. - CVE-2021-22924 (insufficient validation) A security issue has been found in curl before version 7.78.0. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take 'issuer cert' into account and it compared the involved paths case insensitively, which could lead to libcurl reusing wrong connections. File paths are, or can be, case sensitive on many systems but not all, and can even vary depending on used file systems. The comparison also didn't include the 'issuer cert' which a transfer can set to qualify how to verify the server certificate. - CVE-2021-22925 (information disclosure) A security issue has been found in curl before version 7.78.0. curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV variables, libcurl before version 7.78.0 could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. This could happen because curl did not call and use sscanf() correctly when parsing the string provided by the application. The previous curl security vulnerability CVE-2021-22898 is almost identical to this one but the fix was insufficient so this security vulnerability remained. Impact ====== curl could disclose information credentials or potentially sensitive memory contents to a remote server when the metalink feature or an uncommon option for TELNET servers is used. Additionally, curl did not sufficiently verify the hashes of files downloaded using metalink and the 'issuer cert' when reusing connections. References ========== https://curl.se/docs/CVE-2021-22922.html https://github.com/curl/curl/pull/7176 https://github.com/curl/curl/commit/265b14d6b37c4298bd5556fabcbc37d36f911693 https://curl.se/docs/CVE-2021-22923.html https://curl.se/docs/CVE-2021-22924.html https://github.com/curl/curl/commit/5ea3145850ebff1dc2b13d17440300a01ca38161 https://curl.se/docs/CVE-2021-22925.html https://github.com/curl/curl/commit/894f6ec730597eb243618d33cc84d71add8d6a8a https://security.archlinux.org/CVE-2021-22922 https://security.archlinux.org/CVE-2021-22923 https://security.archlinux.org/CVE-2021-22924 https://security.archlinux.org/CVE-2021-22925

1 0

[ASA-202107-58] nvidia-utils: multiple issues
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-58 ========================================== Severity: Medium Date : 2021-07-21 CVE-ID : CVE-2021-1093 CVE-2021-1094 CVE-2021-1095 Package : nvidia-utils Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2193 Summary ======= The package nvidia-utils before version 470.57.02-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 470.57.02-1. # pacman -Syu "nvidia-utils>=470.57.02-1" The problems have been fixed upstream in version 470.57.02. Workaround ========== None. Description =========== - CVE-2021-1093 (denial of service) The NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in firmware where the driver contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary, and may lead to denial of service or system crash. - CVE-2021-1094 (information disclosure) The NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape where an out of bounds array access may lead to denial of service or information disclosure. - CVE-2021-1095 (denial of service) The NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer handlers for all control calls with embedded parameters where dereferencing an untrusted pointer may lead to denial of service. Impact ====== A local attacker could disclose sensitive memory contents or crash the system through crafted system calls to the graphics driver. References ========== https://nvidia.custhelp.com/app/answers/detail/a_id/5211 https://security.archlinux.org/CVE-2021-1093 https://security.archlinux.org/CVE-2021-1094 https://security.archlinux.org/CVE-2021-1095

1 0

[ASA-202107-57] systemd: denial of service
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-57 ========================================== Severity: Medium Date : 2021-07-21 CVE-ID : CVE-2021-33910 Package : systemd Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-2179 Summary ======= The package systemd before version 249.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 249.1-1. # pacman -Syu "systemd>=249.1-1" The problem has been fixed upstream in version 249.1. Workaround ========== None. Description =========== A denial of service security issue has been found in systemd before version 249.1. A local attacker who is able to mount a filesystem with a very long path can crash systemd and the whole system through an attacker-controlled alloca(). Impact ====== A local unprivileged attacker who is able to mount a filesystem with a very long path can crash systemd and therefore the whole system. References ========== https://www.qualys.com/2021/07/20/cve-2021-33910/denial-of-service-systemd.… https://www.qualys.com/2021/07/20/cve-2021-33910/cve-2021-33910-crasher.c https://bugzilla.redhat.com/show_bug.cgi?id=1970887 https://github.com/systemd/systemd/pull/20256 https://github.com/systemd/systemd/commit/441e0115646d54f080e5c3bb0ba477c89… https://github.com/systemd/systemd-stable/commit/764b74113e36ac5219a4b82a05… https://security.archlinux.org/CVE-2021-33910

1 0

[ASA-202107-56] impacket: directory traversal
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-56 ========================================== Severity: Medium Date : 2021-07-21 CVE-ID : CVE-2021-31800 Package : impacket Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-1916 Summary ======= The package impacket before version 0.9.23-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 0.9.23-1. # pacman -Syu "impacket>=0.9.23-1" The problem has been fixed upstream in version 0.9.23. Workaround ========== None. Description =========== Multiple path traversal vulnerabilities exist in smbserver.py in Impacket before version 0.9.23. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key. Impact ====== A malicious SMB client connecting to the example SMB server provided by Impacket could read or modify arbitrary files on the server through directory traversal. References ========== https://bugs.archlinux.org/task/70714 https://github.com/SecureAuthCorp/impacket/pull/1066 https://github.com/SecureAuthCorp/impacket/commit/99bd29e3995c254e2d6f6c2e3… https://security.archlinux.org/CVE-2021-31800

1 0

[ASA-202107-55] libpano13: arbitrary code execution
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-55 ========================================== Severity: Medium Date : 2021-07-21 CVE-ID : CVE-2021-20307 Package : libpano13 Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1774 Summary ======= The package libpano13 before version 2.9.20-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.9.20-1. # pacman -Syu "libpano13>=2.9.20-1" The problem has been fixed upstream in version 2.9.20. Workaround ========== None. Description =========== A format string vulnerability in panoFileOutputNamesCreate() in libpano13 before version 2.9.20 can lead to reading and writing of arbitrary memory values. Impact ====== An attacker could disclose memory contents, or possibly execute arbitrary code, by specifying a crafted output file name. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1946284 https://sourceforge.net/projects/panotools/files/libpano13/libpano13-2.9.20/ https://sourceforge.net/p/panotools/libpano13/ci/f02459498cb44c0087900616a7… https://security.archlinux.org/CVE-2021-20307

1 0