July 2021 - Arch-security - lists.archlinux.org

[ASA-202107-24] ruby2.7: multiple issues
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-24 ========================================== Severity: High Date : 2021-07-14 CVE-ID : CVE-2021-31810 CVE-2021-32066 Package : ruby2.7 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2139 Summary ======= The package ruby2.7 before version 2.7.4-1 is vulnerable to multiple issues including silent downgrade and information disclosure. Resolution ========== Upgrade to 2.7.4-1. # pacman -Syu "ruby2.7>=2.7.4-1" The problems have been fixed upstream in version 2.7.4. Workaround ========== None. Description =========== - CVE-2021-31810 (information disclosure) A security issue has been discovered in Ruby before versions 3.0.2, 2.7.4 and 2.6.8. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes Net::FTP extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). - CVE-2021-32066 (silent downgrade) A security issue has been discovered in Ruby before versions 3.0.2, 2.7.4 and 2.6.8. Net::IMAP does not raise an exception when StartTLS fails with an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack”. Impact ====== A remote man-in-the-middle attacker could strip StartTLS encryption from IMAP connections to disclose authentication credentials and emails. Furthermore, a malicious FTP server could induce connections to an arbitrary IP address and port on a client, leading to potential information disclosure. References ========== https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net… https://hackerone.com/reports/1145454 https://github.com/ruby/net-ftp/commit/5709ece67cf57a94655e34532f8a7899b28d… https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/ https://hackerone.com/reports/1178562 https://github.com/ruby/net-imap/commit/adba6f0c3e5c5607c4822b9120322eb7e9a… https://security.archlinux.org/CVE-2021-31810 https://security.archlinux.org/CVE-2021-32066

1 0

[ASA-202107-23] ruby: multiple issues
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-23 ========================================== Severity: High Date : 2021-07-14 CVE-ID : CVE-2021-31810 CVE-2021-32066 Package : ruby Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2138 Summary ======= The package ruby before version 3.0.2-1 is vulnerable to multiple issues including silent downgrade and information disclosure. Resolution ========== Upgrade to 3.0.2-1. # pacman -Syu "ruby>=3.0.2-1" The problems have been fixed upstream in version 3.0.2. Workaround ========== None. Description =========== - CVE-2021-31810 (information disclosure) A security issue has been discovered in Ruby before versions 3.0.2, 2.7.4 and 2.6.8. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes Net::FTP extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). - CVE-2021-32066 (silent downgrade) A security issue has been discovered in Ruby before versions 3.0.2, 2.7.4 and 2.6.8. Net::IMAP does not raise an exception when StartTLS fails with an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack”. Impact ====== A remote man-in-the-middle attacker could strip StartTLS encryption from IMAP connections to disclose authentication credentials and emails. Furthermore, a malicious FTP server could induce connections to an arbitrary IP address and port on a client, leading to potential information disclosure. References ========== https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net… https://hackerone.com/reports/1145454 https://github.com/ruby/net-ftp/commit/5709ece67cf57a94655e34532f8a7899b28d… https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/ https://hackerone.com/reports/1178562 https://github.com/ruby/net-imap/commit/adba6f0c3e5c5607c4822b9120322eb7e9a… https://security.archlinux.org/CVE-2021-31810 https://security.archlinux.org/CVE-2021-32066

1 0

[ASA-202107-22] nextcloud: multiple issues
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-22 ========================================== Severity: High Date : 2021-07-14 CVE-ID : CVE-2021-32678 CVE-2021-32679 CVE-2021-32680 CVE-2021-32688 CVE-2021-32703 CVE-2021-32705 CVE-2021-32725 CVE-2021-32726 CVE-2021-32733 CVE-2021-32734 CVE-2021-32741 Package : nextcloud Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2144 Summary ======= The package nextcloud before version 21.0.3-1 is vulnerable to multiple issues including authentication bypass, privilege escalation, access restriction bypass, content spoofing, cross-site scripting, incorrect calculation, information disclosure and insufficient validation. Resolution ========== Upgrade to 21.0.3-1. # pacman -Syu "nextcloud>=21.0.3-1" The problems have been fixed upstream in version 21.0.3. Workaround ========== None. Description =========== - CVE-2021-32678 (insufficient validation) In Nextcloud Server versions prior to 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other Nextcloud users. - CVE-2021-32679 (content spoofing) In Nextcloud Server versions prior to 21.0.3, filenames where not escaped by default in controllers using `DownloadResponse`. When a user-supplied filename was passed unsanitized into a `DownloadResponse`, this could be used to trick users into downloading malicious files with a benign file extension. This would show in UI behaviours where Nextcloud applications would display a benign file extension (e.g. JPEG), but the file will actually be downloaded with an executable file extension. Administrators of Nextcloud instances do not have a workaround available, but developers of Nextcloud apps may manually escape the file name before passing it into `DownloadResponse`. - CVE-2021-32680 (incorrect calculation) In Nextcloud Server versions prior to 21.0.3, Nextcloud Server audit logging functionality wasn't properly logging events for the unsetting of a share expiration date. This event is supposed to be logged. - CVE-2021-32688 (privilege escalation) Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 21.0.3. Thus fileystem limited tokens were able to grant themselves access to the filesystem. - CVE-2021-32703 (information disclosure) In Nextcloud Server versions prior to 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. - CVE-2021-32705 (information disclosure) In Nextcloud Server versions prior to 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. - CVE-2021-32725 (access restriction bypass) In Nextcloud Server versions prior to 21.0.3, default share permissions were not being respected for federated reshares of files and folders. - CVE-2021-32726 (authentication bypass) In Nextcloud Server versions prior to 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. - CVE-2021-32733 (cross-site scripting) A cross-site scripting vulnerability is present in Nextcloud Text in versions prior to 21.0.3. The Nextcloud Text application shipped with Nextcloud Server used a `text/html` Content-Type when serving files to users. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content- Security-Policy. - CVE-2021-32734 (information disclosure) In Nextcloud Server versions prior to 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. As a workaround, one may disable the Nextcloud Text application in Nextcloud Server app settings. - CVE-2021-32741 (information disclosure) In Nextcloud Server versions prior to 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. Impact ====== A remote attacker could bypass authentication, escalate privileges, disclose sensitive information or spoof content. References ========== https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4… https://hackerone.com/reports/1214158 https://github.com/nextcloud/server/pull/27329 https://github.com/nextcloud/server/commit/6a6bcdc558ae691b634ca23480562a0b… https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3… https://hackerone.com/reports/1215263 https://github.com/nextcloud/server/pull/27354 https://github.com/nextcloud/server/commit/d838108deaa90a2f2d78af4e608452fb… https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f… https://hackerone.com/reports/1200810 https://github.com/nextcloud/server/pull/27024 https://github.com/nextcloud/server/commit/6300a1b84605b4674c2cee3860eaae17… https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4… https://hackerone.com/reports/1193321 https://github.com/nextcloud/server/pull/27000 https://github.com/nextcloud/server/commit/e3090136b832498042778f81593c6b95… https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3… https://hackerone.com/reports/1173684 https://github.com/nextcloud/server/pull/26945 https://github.com/nextcloud/server/commit/6bc2d6d68e19212ed83a2f3ce51ddbfc… https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f… https://hackerone.com/reports/1192159 https://github.com/nextcloud/server/pull/27610 https://github.com/nextcloud/server/commit/117e466e2051095bb6e9d863faf5f42a… https://github.com/nextcloud/server/commit/ddcb70bd81e99f8bd469019f923bd335… https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6… https://hackerone.com/reports/1178320 https://github.com/nextcloud/server/pull/26946 https://github.com/nextcloud/server/commit/7ca8fd43a6fdbebd1c931ae09a94ab07… https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6… https://hackerone.com/reports/1202590 https://github.com/nextcloud/server/pull/27532 https://github.com/nextcloud/server/commit/e757a5ecfdcddbddc29edf0e61ba60de… https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x… https://hackerone.com/reports/1241460 https://github.com/nextcloud/text/pull/1689 https://github.com/nextcloud/text/commit/e7dcbee067afe95bf13cbe49a9394b540d… https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6… https://hackerone.com/reports/1246721 https://github.com/nextcloud/text/pull/1695 https://github.com/nextcloud/text/commit/6ea959f10039b5b1a79ca5e68eb0a5926f… https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c… https://hackerone.com/reports/1192144 https://github.com/nextcloud/server/pull/26958 https://github.com/nextcloud/server/commit/1ed66f2ac17a2b4effba46a13ed735b6… https://security.archlinux.org/CVE-2021-32678 https://security.archlinux.org/CVE-2021-32679 https://security.archlinux.org/CVE-2021-32680 https://security.archlinux.org/CVE-2021-32688 https://security.archlinux.org/CVE-2021-32703 https://security.archlinux.org/CVE-2021-32705 https://security.archlinux.org/CVE-2021-32725 https://security.archlinux.org/CVE-2021-32726 https://security.archlinux.org/CVE-2021-32733 https://security.archlinux.org/CVE-2021-32734 https://security.archlinux.org/CVE-2021-32741

1 0

[ASA-202107-21] thunderbird: multiple issues
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-21 ========================================== Severity: High Date : 2021-07-14 CVE-ID : CVE-2021-29969 CVE-2021-29970 CVE-2021-29976 CVE-2021-30547 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2152 Summary ======= The package thunderbird before version 78.12.0-1 is vulnerable to multiple issues including arbitrary code execution and content spoofing. Resolution ========== Upgrade to 78.12.0-1. # pacman -Syu "thunderbird>=78.12.0-1" The problems have been fixed upstream in version 78.12.0. Workaround ========== None. Description =========== - CVE-2021-29969 (content spoofing) If Thunderbird before version 78.12 was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for example the attacker could have tricked Thunderbird to show folders that didn't exist on the IMAP server. - CVE-2021-29970 (arbitrary code execution) A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. This bug only affected Firefox before version 90 and Thunderbird before version 78.12 when accessibility was enabled. - CVE-2021-29976 (arbitrary code execution) Mozilla developers reported memory safety bugs present in Firefox 89 and Thunderbird 78.11. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2021-30547 (arbitrary code execution) An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash in the Chromium browser engine before version 91.0.4472.101, Firefox before version 90 and Thunderbird before version 78.12. Impact ====== A remote man-in-the-middle attacker could spoof content by injecting server responses into an IMAP connection that is using STARTTLS. Furthermore, a remote attacker could execute arbitrary code in a browsing context using a crafted web page. References ========== https://www.mozilla.org/security/advisories/mfsa2021-30/ https://bugzilla.mozilla.org/show_bug.cgi?id=1682370 https://www.mozilla.org/security/advisories/mfsa2021-28/ https://bugzilla.mozilla.org/show_bug.cgi?id=1709976 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1700895%2C1703334%2C1706910… https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1210414 https://bugzilla.mozilla.org/show_bug.cgi?id=1715766 https://security.archlinux.org/CVE-2021-29969 https://security.archlinux.org/CVE-2021-29970 https://security.archlinux.org/CVE-2021-29976 https://security.archlinux.org/CVE-2021-30547

1 0

[ASA-202107-20] firefox: multiple issues
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-20 ========================================== Severity: High Date : 2021-07-14 CVE-ID : CVE-2021-29970 CVE-2021-29972 CVE-2021-29974 CVE-2021-29975 CVE-2021-29976 CVE-2021-29977 CVE-2021-30547 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2148 Summary ======= The package firefox before version 90.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and insufficient validation. Resolution ========== Upgrade to 90.0-1. # pacman -Syu "firefox>=90.0-1" The problems have been fixed upstream in version 90.0. Workaround ========== None. Description =========== - CVE-2021-29970 (arbitrary code execution) A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. This bug only affected Firefox before version 90 and Thunderbird before version 78.12 when accessibility was enabled. - CVE-2021-29972 (arbitrary code execution) A user-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library resolved the issue, and may have remediated other, unknown security vulnerabilities as well. - CVE-2021-29974 (insufficient validation) When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security (which implies that the error should not be override-able.) This issue did not affect the network connections, and they were correctly upgraded to HTTPS automatically. - CVE-2021-29975 (content spoofing) Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overlaid on top of another domain (with the new domain correctly shown in the address bar) resulting in possible user confusion. - CVE-2021-29976 (arbitrary code execution) Mozilla developers reported memory safety bugs present in Firefox 89 and Thunderbird 78.11. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2021-29977 (arbitrary code execution) Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2021-30547 (arbitrary code execution) An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash in the Chromium browser engine before version 91.0.4472.101, Firefox before version 90 and Thunderbird before version 78.12. Impact ====== A remote attacker could execute arbitrary code or spoof content using a crafted web page. References ========== https://www.mozilla.org/security/advisories/mfsa2021-28/ https://www.mozilla.org/security/advisories/mfsa2021-30/ https://bugzilla.mozilla.org/show_bug.cgi?id=1709976 https://bugzilla.mozilla.org/show_bug.cgi?id=1696816 https://bugzilla.mozilla.org/show_bug.cgi?id=1704843 https://bugzilla.mozilla.org/show_bug.cgi?id=1713259 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1700895%2C1703334%2C1706910… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1665836%2C1686138%2C1704316… https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1210414 https://bugzilla.mozilla.org/show_bug.cgi?id=1715766 https://security.archlinux.org/CVE-2021-29970 https://security.archlinux.org/CVE-2021-29972 https://security.archlinux.org/CVE-2021-29974 https://security.archlinux.org/CVE-2021-29975 https://security.archlinux.org/CVE-2021-29976 https://security.archlinux.org/CVE-2021-29977 https://security.archlinux.org/CVE-2021-30547

1 0

[ASA-202107-19] ruby-addressable: denial of service
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-19 ========================================== Severity: Medium Date : 2021-07-06 CVE-ID : CVE-2021-32740 Package : ruby-addressable Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2136 Summary ======= The package ruby-addressable before version 2.8.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.8.0-1. # pacman -Syu "ruby-addressable>=2.8.0-1" The problem has been fixed upstream in version 2.8.0. Workaround ========== As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking. Description =========== An uncontrolled resource consumption vulnerability exists in ruby- addressable after version 2.3.0 and before version 2.8.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. Impact ====== A crafted URI template from an untrusted source could cause high resource consumption during matching, leading to denial of service. References ========== https://github.com/sporkmonger/addressable/security/advisories/GHSA-jxhc-q8… https://github.com/sporkmonger/addressable/commit/b48ff03347a6d46e8dc674e24… https://security.archlinux.org/CVE-2021-32740

1 0

[ASA-202107-18] gitlab: multiple issues
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-18 ========================================== Severity: High Date : 2021-07-06 CVE-ID : CVE-2021-22223 CVE-2021-22224 CVE-2021-22225 CVE-2021-22226 CVE-2021-22227 CVE-2021-22228 CVE-2021-22229 CVE-2021-22230 CVE-2021-22231 CVE-2021-22232 CVE-2021-31799 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2125 Summary ======= The package gitlab before version 14.0.3-1 is vulnerable to multiple issues including cross-site request forgery, access restriction bypass, arbitrary code execution, arbitrary command execution, cross-site scripting, information disclosure, content spoofing and denial of service. Resolution ========== Upgrade to 14.0.3-1. # pacman -Syu "gitlab>=14.0.3-1" The problems have been fixed upstream in version 14.0.3. Workaround ========== None. Description =========== - CVE-2021-22223 (cross-site scripting) Client-Side code injection through a Feature Flag name in GitLab CE/EE starting with 11.9 and before version 14.0.2 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link. - CVE-2021-22224 (cross-site request forgery) A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before version 14.0.2 allowed an attacker to call mutations as the victim. - CVE-2021-22225 (cross-site scripting) Insufficient input sanitization in markdown in GitLab version 13.11 and up before version 14.0.2 allows an attacker to exploit a stored cross- site scripting vulnerability via specially-crafted markdown. - CVE-2021-22226 (access restriction bypass) Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in GitLab CE/EE since version 13.9 and before version 14.0.2. - CVE-2021-22227 (cross-site scripting) A reflected cross-site script vulnerability in GitLab before version 14.0.2 allowed an attacker to send a malicious link to a victim and trigger actions on their behalf if they clicked it. - CVE-2021-22228 (information disclosure) An issue has been discovered in GitLab affecting all versions before 14.0.2. Improper access control allows unauthorised users to access project details using Graphql. - CVE-2021-22229 (information disclosure) An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8 and before 14.0.2. Under a special condition it was possible to access data of an internal repository through a project fork done by a project member. - CVE-2021-22230 (arbitrary code execution) Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later up to 14.0.2. - CVE-2021-22231 (denial of service) A denial of service on the user's profile page is found starting with GitLab CE/EE 8.0 and before 14.0.2 that allows an attacker to reject access to their profile page by using a specially crafted username. - CVE-2021-22232 (content spoofing) HTML injection was possible via the full name field before version 14.0.2 in GitLab CE. - CVE-2021-31799 (arbitrary command execution) RDoc before version 6.3.1, as bundled with Ruby before version 2.7.4 and 2.6.8 as well as GitLab before version 14.0.2, used to call Kernel#open to open a local file. If a Ruby project has a file whose name starts with "|" and ends with "tags", the command following the pipe character is executed. A malicious Ruby project could exploit it to run an arbitrary command execution against a user who attempts to run the rdoc command. Impact ====== A remote attacker could execute arbitrary code, disclose sensitive information, bypass access restrictions, or spoof content. References ========== https://about.gitlab.com/releases/2021/07/01/security-release-gitlab-14-0-2… https://gitlab.com/gitlab-org/gitlab/-/issues/293946 https://hackerone.com/reports/1059557 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22223.json https://gitlab.com/gitlab-org/gitlab/-/issues/324397 https://hackerone.com/reports/1122408 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22224.json https://gitlab.com/gitlab-org/gitlab/-/issues/331051 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22225.json https://gitlab.com/gitlab-org/gitlab/-/issues/326684 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22226.json https://gitlab.com/gitlab-org/gitlab/-/issues/212887 https://hackerone.com/reports/834555 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22227.json https://gitlab.com/gitlab-org/gitlab/-/issues/332605 https://hackerone.com/reports/1192460 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22228.json https://gitlab.com/gitlab-org/gitlab/-/issues/332609 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22229.json https://gitlab.com/gitlab-org/gitlab/-/issues/211976 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22230.json https://gitlab.com/gitlab-org/gitlab/-/issues/26295 https://hackerone.com/reports/475098 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22231.json https://gitlab.com/gitlab-org/gitlab/-/issues/300713 https://hackerone.com/reports/1090634 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22232.json https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/ https://github.com/ruby/rdoc/commit/a7f5d6ab88632b3b482fe10611382ff73d14eed7 https://github.com/ruby/ruby/commit/483f303d02e768b69e476e0b9be4ab2f26389522 https://github.com/ruby/ruby/commit/fe3c49c9baeeab58304ede915b7edd18ecf360fc https://security.archlinux.org/CVE-2021-22223 https://security.archlinux.org/CVE-2021-22224 https://security.archlinux.org/CVE-2021-22225 https://security.archlinux.org/CVE-2021-22226 https://security.archlinux.org/CVE-2021-22227 https://security.archlinux.org/CVE-2021-22228 https://security.archlinux.org/CVE-2021-22229 https://security.archlinux.org/CVE-2021-22230 https://security.archlinux.org/CVE-2021-22231 https://security.archlinux.org/CVE-2021-22232 https://security.archlinux.org/CVE-2021-31799

1 0

[ASA-202107-17] rabbitmq: cross-site scripting
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-17 ========================================== Severity: Low Date : 2021-07-06 CVE-ID : CVE-2021-32718 CVE-2021-32719 Package : rabbitmq Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2109 Summary ======= The package rabbitmq before version 3.8.19-1 is vulnerable to cross- site scripting. Resolution ========== Upgrade to 3.8.19-1. # pacman -Syu "rabbitmq>=3.8.19-1" The problems have been fixed upstream in version 3.8.19. Workaround ========== As a workaround, disable the rabbitmq_management plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring. Description =========== - CVE-2021-32718 (cross-site scripting) In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper <script> tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). - CVE-2021-32719 (cross-site scripting) In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the rabbitmq_federation_management plugin, its consumer tag was rendered without proper <script> tag sanitization, potentially allowing for JavaScript code execution in the context of the page. Impact ====== Crafted user banes and federation links could be used to inject arbitrary JavaScript code into the management web UI. References ========== https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c3hj-r… https://github.com/rabbitmq/rabbitmq-server/pull/3028 https://github.com/rabbitmq/rabbitmq-server/commit/a7373585faeac0aaede5a9c2… https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5452-h… https://github.com/rabbitmq/rabbitmq-server/pull/3122 https://github.com/rabbitmq/rabbitmq-server/commit/08beb82e9ab8923ded88ece2… https://security.archlinux.org/CVE-2021-32718 https://security.archlinux.org/CVE-2021-32719

1 0

[ASA-202107-16] php7: multiple issues
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-16 ========================================== Severity: Medium Date : 2021-07-06 CVE-ID : CVE-2021-21704 CVE-2021-21705 Package : php7 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2133 Summary ======= The package php7 before version 7.4.21-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 7.4.21-1. # pacman -Syu "php7>=7.4.21-1" The problems have been fixed upstream in version 7.4.21. Workaround ========== None. Description =========== - CVE-2021-21704 (denial of service) Multiple bugs in the pdo_firebase module allow a malicious firebase server or man-in-the-middle attacker to crash PHP before versions 8.0.8 and 7.4.21. - CVE-2021-21705 (insufficient validation) A security issue was found in the php_url_parse_ex() function in PHP before versions 8.0.8 and 7.4.21, which leads to FILTER_VALIDATE_URL accepting URLs with invalid userinfo, a different issue from CVE-2020-7071. Impact ====== A remote user could bypass URL validation. Furthermore, a malicious firebase server or man-in-the-middle attacker could crash a PHP application. References ========== https://www.php.net/ChangeLog-8.php#8.0.8 https://www.php.net/ChangeLog-7.php#7.4.21 https://bugs.php.net/bug.php?id=76448 https://bugs.php.net/bug.php?id=76449 https://bugs.php.net/bug.php?id=76450 https://bugs.php.net/bug.php?id=76452 https://github.com/php/php-src/commit/1edd284cd56ce4c23f6fdf66050e4a722e651… https://github.com/php/php-src/commit/8cb87aabba0b2e284428aabca13401d1ad54b… https://github.com/php/php-src/commit/921f320ec2baabd24e5ff182d9fb73092eb28… https://github.com/php/php-src/commit/c8620a753114fac789016a4e6ae9c9b1210be… https://github.com/php/php-src/commit/1d4c3114afe8f7dde51f917cd14dc4600a3a4… https://github.com/php/php-src/commit/922ea3419923c74471f01ff8c6ea30f0a07d8… https://github.com/php/php-src/commit/08fc2960bccd4f04031d10099c82cf8d76cfa… https://github.com/php/php-src/commit/e92d5edeeeed809bc3a06b165e4f0a63bcabd… https://bugs.php.net/bug.php?id=81122 https://github.com/php/php-src/commit/5a1fe88ac120d71064bdd314dce1e49c86ff0… https://github.com/php/php-src/commit/5cea97e083448aaa2352320612541c895178b… https://security.archlinux.org/CVE-2021-21704 https://security.archlinux.org/CVE-2021-21705

1 0

[ASA-202107-15] php: multiple issues
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-15 ========================================== Severity: Medium Date : 2021-07-06 CVE-ID : CVE-2021-21704 CVE-2021-21705 Package : php Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2132 Summary ======= The package php before version 8.0.8-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 8.0.8-1. # pacman -Syu "php>=8.0.8-1" The problems have been fixed upstream in version 8.0.8. Workaround ========== None. Description =========== - CVE-2021-21704 (denial of service) Multiple bugs in the pdo_firebase module allow a malicious firebase server or man-in-the-middle attacker to crash PHP before versions 8.0.8 and 7.4.21. - CVE-2021-21705 (insufficient validation) A security issue was found in the php_url_parse_ex() function in PHP before versions 8.0.8 and 7.4.21, which leads to FILTER_VALIDATE_URL accepting URLs with invalid userinfo, a different issue from CVE-2020-7071. Impact ====== A remote user could bypass URL validation. Furthermore, a malicious firebase server or man-in-the-middle attacker could crash a PHP application. References ========== https://www.php.net/ChangeLog-8.php#8.0.8 https://www.php.net/ChangeLog-7.php#7.4.21 https://bugs.php.net/bug.php?id=76448 https://bugs.php.net/bug.php?id=76449 https://bugs.php.net/bug.php?id=76450 https://bugs.php.net/bug.php?id=76452 https://github.com/php/php-src/commit/1edd284cd56ce4c23f6fdf66050e4a722e651… https://github.com/php/php-src/commit/8cb87aabba0b2e284428aabca13401d1ad54b… https://github.com/php/php-src/commit/921f320ec2baabd24e5ff182d9fb73092eb28… https://github.com/php/php-src/commit/c8620a753114fac789016a4e6ae9c9b1210be… https://github.com/php/php-src/commit/1d4c3114afe8f7dde51f917cd14dc4600a3a4… https://github.com/php/php-src/commit/922ea3419923c74471f01ff8c6ea30f0a07d8… https://github.com/php/php-src/commit/08fc2960bccd4f04031d10099c82cf8d76cfa… https://github.com/php/php-src/commit/e92d5edeeeed809bc3a06b165e4f0a63bcabd… https://bugs.php.net/bug.php?id=81122 https://github.com/php/php-src/commit/5a1fe88ac120d71064bdd314dce1e49c86ff0… https://github.com/php/php-src/commit/5cea97e083448aaa2352320612541c895178b… https://security.archlinux.org/CVE-2021-21704 https://security.archlinux.org/CVE-2021-21705

1 0