July 2021 - Arch-security - lists.archlinux.org

[ASA-202107-44] wireshark-cli: denial of service
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-44 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-22235 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2160 Summary ======= The package wireshark-cli before version 3.4.7-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.4.7-1. # pacman -Syu "wireshark-cli>=3.4.7-1" The problem has been fixed upstream in version 3.4.7. Workaround ========== None. Description =========== It may be possible to make Wireshark before version 3.4.7 crash by injecting a malformed DNP3 packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker could crash Wireshark with crafted DNP3 packets through packet injection or a crafted capture file. References ========== https://www.wireshark.org/security/wnpa-sec-2021-06 https://gitlab.com/wireshark/wireshark/-/issues/17462 https://gitlab.com/wireshark/wireshark/-/merge_requests/3477 https://gitlab.com/wireshark/wireshark/-/commit/490fe2684bf63cf4fe03e6495c9… https://security.archlinux.org/CVE-2021-22235

1 0

[ASA-202107-43] ant: denial of service
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-43 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-36373 CVE-2021-36374 Package : ant Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-2151 Summary ======= The package ant before version 1.10.11-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.10.11-1. # pacman -Syu "ant>=1.10.11-1" The problems have been fixed upstream in version 1.10.11. Workaround ========== None. Description =========== - CVE-2021-36373 (denial of service) When reading a specially crafted TAR archive, Apache Ant before version 1.10.11 can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. - CVE-2021-36374 (denial of service) When reading a specially crafted ZIP archive, or a derived format, Apache Ant before version 1.10.11 can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Impact ====== A crafted TAR or ZIP archive could consume large amounts of memory, leading to denial of service. References ========== https://www.openwall.com/lists/oss-security/2021/07/13/5 https://github.com/apache/ant/commit/6594a2d66f7f060dafcbbf094dd60676db19a8… https://www.openwall.com/lists/oss-security/2021/07/13/6 https://security.archlinux.org/CVE-2021-36373 https://security.archlinux.org/CVE-2021-36374

1 0

[ASA-202107-42] go: denial of service
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-42 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-34558 Package : go Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2147 Summary ======= The package go before version 2:1.16.6-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2:1.16.6-1. # pacman -Syu "go>=2:1.16.6-1" The problem has been fixed upstream in version 1.16.6. Workaround ========== Clients that disable all TLS_RSA cipher suites (that is, TLS 1.0–1.2 cipher suites without ECDHE), as well as TLS 1.3-only clients, are unaffected. Description =========== A security issue has been found in Go before version 1.16.6. crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters. net/http clients performing HTTPS requests are also affected. The panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists (or can be issued), or the client is configured with Config.InsecureSkipVerify. Clients that disable all TLS_RSA cipher suites (that is, TLS 1.0–1.2 cipher suites without ECDHE), as well as TLS 1.3-only clients, are unaffected. Impact ====== A man-in-the-middle attacker able to intercept a TLS negotiation could crash a TLS client by injecting a crafted invalid certificate. References ========== https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ/m/4ZhvTx0dAQAJ https://github.com/golang/go/issues/47143 https://github.com/golang/go/commit/58bc454a11d4b3dbc03f44dfcabb9068a9c076f4 https://security.archlinux.org/CVE-2021-34558

1 0

[ASA-202107-41] nextcloud-app-mail: information disclosure
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-41 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-32707 Package : nextcloud-app-mail Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2145 Summary ======= The package nextcloud-app-mail before version 1.10.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.10.1-1. # pacman -Syu "nextcloud-app-mail>=1.10.1-1" The problem has been fixed upstream in version 1.10.1. Workaround ========== None. Description =========== In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not leak the read state. The privacy filter failed to filter images with `background-image` CSS attribute. Note that the images were still passed through the Nextcloud image proxy, and thus there was no IP leakage. Impact ====== A remote attacker could disclose whether an email message has been read by embedding a remote CSS background image. References ========== https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x… https://hackerone.com/reports/1215251 https://github.com/nextcloud/mail/pull/5189 https://github.com/nextcloud/mail/commit/e54c2331f4b98cc39a5b3899c8ed1468df… https://security.archlinux.org/CVE-2021-32707

1 0

[ASA-202107-40] openvswitch: arbitrary code execution
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-40 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-36980 Package : openvswitch Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-2177 Summary ======= The package openvswitch before version 2.15.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.15.1-1. # pacman -Syu "openvswitch>=2.15.1-1" The problem has been fixed upstream in version 2.15.1. Workaround ========== None. Description =========== Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after- free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. Impact ====== An attacker could execute arbitrary code through crafted Open vSwitch Actions. References ========== https://github.com/google/oss-fuzz-vulns/blob/main/vulns/openvswitch/OSV-20… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851 https://github.com/openvswitch/ovs/commit/38744b1bcb022c611712527f039722115… https://security.archlinux.org/CVE-2021-36980

1 0

[ASA-202107-39] racket: sandbox escape
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-39 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-32773 Package : racket Type : sandbox escape Remote : Yes Link : https://security.archlinux.org/AVG-2175 Summary ======= The package racket before version 8.2-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 8.2-1. # pacman -Syu "racket>=8.2-1" The problem has been fixed upstream in version 8.2. Workaround ========== None. Description =========== In Racket versions prior to 8.2, code evaluated using the Racket sandbox could cause system modules to incorrectly use attacker-created modules instead of their intended dependencies. This could allow system functions to be controlled by the attacker, giving access to facilities intended to be restricted. Impact ====== Code executed in the Racket sandbox could escape its confinement through attacker-created modules. References ========== https://github.com/racket/racket/security/advisories/GHSA-cgrw-p7p7-937c https://github.com/racket/racket/commit/9877b84eaadd14e54e555b9f0ac8d784474… https://security.archlinux.org/CVE-2021-32773

1 0

[ASA-202107-38] firefox-ublock-origin: denial of service
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-38 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-36773 Package : firefox-ublock-origin Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2172 Summary ======= The package firefox-ublock-origin before version 1.36.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.36.2-1. # pacman -Syu "firefox-ublock-origin>=1.36.2-1" The problem has been fixed upstream in version 1.36.2. Workaround ========== None. Description =========== uBlock Origin before 1.36.2 supports an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cause a denial of service (unbounded recursion that can trigger memory consumption and a loss of all blocking functionality). Impact ====== A crafted web site could consume a lot of memory, disabling all blocking functionality. References ========== https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and… https://github.com/uBlockOrigin/uBlock-issues/issues/1649 https://github.com/gorhill/uBlock/commit/365b20e8cc27cd776ef3868b02ea739ba3… https://security.archlinux.org/CVE-2021-36773

1 0

[ASA-202107-37] putty: content spoofing
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-37 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-36367 Package : putty Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-2143 Summary ======= The package putty before version 0.76-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 0.76-1. # pacman -Syu "putty>=0.76-1" The problem has been fixed upstream in version 0.76. Workaround ========== None. Description =========== PuTTY before version 0.76 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user). Impact ====== A remote SSH server could present a spoofed authentication prompt. References ========== https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=1dc5659aa62848f0… https://security.archlinux.org/CVE-2021-36367

1 0

[ASA-202107-36] libuv: information disclosure
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-36 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-22918 Package : libuv Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2131 Summary ======= The package libuv before version 1.41.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.41.1-1. # pacman -Syu "libuv>=1.41.1-1" The problem has been fixed upstream in version 1.41.1. Workaround ========== None. Description =========== libuv before version 1.14.1, as bundled by Node.js before versions 16.4.1, 14.17.2 and 12.22.2, is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. Impact ====== Attempting to look up a crafted domain name could disclose sensitive information or crash an application using libuv. References ========== https://github.com/libuv/libuv/issues/3147 https://hackerone.com/reports/1209681 https://github.com/libuv/libuv/commit/86dbeb4bd665749d6234ae90d30923e210de2… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv… https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631… https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac… https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc09… https://security.archlinux.org/CVE-2021-22918

1 0

[ASA-202107-35] dino: directory traversal
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-35 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-33896 Package : dino Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2043 Summary ======= The package dino before version 0.2.1-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 0.2.1-1. # pacman -Syu "dino>=0.2.1-1" The problem has been fixed upstream in version 0.2.1. Workaround ========== None. Description =========== It was discovered that when a user receives and downloads a file in Dino before version 0.2.1, URI-encoded path separators in the file name will be decoded, allowing an attacker to traverse directories and create arbitrary files in the context of the user. This vulnerability does not allow to overwrite or modify existing files and the attacker cannot control the executable flag of created files. However, third-party software may be affected by newly created configuration files, potentially allowing for code execution. The file name, including path separators, is displayed to the user, however, long file names are ellipsized in the middle of the file name, allowing the attacker to hide the malicious path separators, as long as the resulting file name has sufficient length. Impact ====== A remote attacker could create files in arbitrary locations in the context of the user by tricking the user into downloading a file with a crafted file name. References ========== https://dino.im/security/cve-2021-33896/ https://github.com/dino/dino/commit/1eaad1ccfbd00c6e76650535496531c172453994 https://security.archlinux.org/CVE-2021-33896

1 0