July 2021 - Arch-security - lists.archlinux.org

[ASA-202107-14] openexr: arbitrary code execution
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-14 ========================================== Severity: Medium Date : 2021-07-06 CVE-ID : CVE-2021-3598 Package : openexr Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2071 Summary ======= The package openexr before version 3.0.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.0.5-1. # pacman -Syu "openexr>=3.0.5-1" The problem has been fixed upstream in version 3.0.5. Workaround ========== None. Description =========== A heap-buffer overflow was found in the readChars function of OpenEXR before version 3.0.5. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR. Impact ====== An attacker could execute arbitrary code through a crafted EXR image file. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1970987 https://github.com/AcademySoftwareFoundation/openexr/issues/1033 https://github.com/AcademySoftwareFoundation/openexr/pull/1037 https://github.com/AcademySoftwareFoundation/openexr/commit/b054116e57ebf62… https://security.archlinux.org/CVE-2021-3598

1 0

[ASA-202107-13] nodejs: multiple issues
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-13 ========================================== Severity: High Date : 2021-07-06 CVE-ID : CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 Package : nodejs Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2126 Summary ======= The package nodejs before version 16.4.1-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 16.4.1-1. # pacman -Syu "nodejs>=16.4.1-1" The problems have been fixed upstream in version 16.4.1. Workaround ========== None. Description =========== - CVE-2021-22918 (information disclosure) Node.js before versions 16.4.1, 14.17.2 and 12.22.2 is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. - CVE-2021-23362 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks. - CVE-2021-27290 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks. Impact ====== A remote attacker could disclose information by supplying crafted domain names, or cause denial of service through high resource usage with crafted Git repository URLs or Subresource Integrity (SRI) hashes. References ========== https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv… https://hackerone.com/reports/1209681 https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631… https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac… https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc09… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#npm-u… https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 https://github.com/npm/hosted-git-info/pull/76 https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f8… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#npm-u… https://github.com/advisories/GHSA-vx3p-948g-6vhq https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf https://github.com/npm/ssri/pull/17 https://github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2 https://security.archlinux.org/CVE-2021-22918 https://security.archlinux.org/CVE-2021-23362 https://security.archlinux.org/CVE-2021-27290

1 0

[ASA-202107-12] spice: multiple issues
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-12 ========================================== Severity: Critical Date : 2021-07-06 CVE-ID : CVE-2020-14355 CVE-2021-20201 Package : spice Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1239 Summary ======= The package spice before version 0.15.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.15.0-1. # pacman -Syu "spice>=0.15.0-1" The problems have been fixed upstream in version 0.15.0. Workaround ========== None. Description =========== - CVE-2020-14355 (arbitrary code execution) Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system. More specifically, these flaws reside in the spice-common shared code between the client and server of SPICE. In other words, both the client (spice-gtk) and server are affected by these flaws. A malicious client or server could send specially crafted messages which could result in a process crash or potential code execution scenario. The issues have been fixed in spice (server) version 0.14.90 and spice-gtk (client) version 0.39. - CVE-2021-20201 (denial of service) An issue was discovered in SPICE server before version 0.15.0. There is a vulnerability which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection. Impact ====== A remote attacker could execute arbitrary code on the SPICE server using crafted messages, or cause high CPU consumption by performing many renegotiations. References ========== https://bugs.archlinux.org/task/68166 https://www.openwall.com/lists/oss-security/2020/10/06/10 https://gitlab.freedesktop.org/spice/spice-common/-/commit/762e0abae36033cc… https://gitlab.freedesktop.org/spice/spice-common/-/commit/404d74782c8b5e57… https://gitlab.freedesktop.org/spice/spice-common/-/commit/ef1b6ff7b82e15d7… https://gitlab.freedesktop.org/spice/spice-common/-/commit/b24fe6b66b86e601… https://gitlab.freedesktop.org/spice/spice/-/commit/4f71d0cdb79d2f61da49d43… https://gitlab.freedesktop.org/spice/spice-gtk/-/commit/df0d3f9d95fe8235b95… https://bugzilla.redhat.com/show_bug.cgi?id=1921846 https://gitlab.freedesktop.org/spice/spice/-/issues/49 https://gitlab.freedesktop.org/spice/spice/-/merge_requests/150 https://gitlab.freedesktop.org/spice/spice/-/commit/95a0cfac8a1c8eff50f05e6… https://gitlab.freedesktop.org/spice/spice/-/commit/ca5bbc5692e052159bce1a7… https://security.archlinux.org/CVE-2020-14355 https://security.archlinux.org/CVE-2021-20201

1 0

[ASA-202107-11] python-django: insufficient validation
by Jelle van der Waa 05 Jul '21

05 Jul '21

Arch Linux Security Advisory ASA-202107-11 ========================================== Severity: High Date : 2021-07-03 CVE-ID : CVE-2021-35042 Package : python-django Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-2123 Summary ======= The package python-django before version 3.2.5-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 3.2.5-1. # pacman -Syu "python-django>=3.2.5-1" The problem has been fixed upstream in version 3.2.5. Workaround ========== None. Description =========== A security issue has been found in Django before version 3.2.5. Unsanitized user input passed to QuerySet.order_by() could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted. As a mitigation the strict column reference validation was restored for the duration of the deprecation period. Impact ====== A remote attacker is able to perform a SQL injection via unsanitized user input passed to QuerySet.order_by(). References ========== https://docs.djangoproject.com/en/3.2/releases/3.2.5/#cve-2021-35042-potent… https://github.com/django/django/commit/a34a5f724c5d5adb2109374ba3989ebb7b1… https://security.archlinux.org/CVE-2021-35042

1 0

[ASA-202107-10] mruby: arbitrary code execution
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-10 ========================================== Severity: Medium Date : 2021-07-01 CVE-ID : CVE-2020-36401 Package : mruby Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2116 Summary ======= The package mruby before version 3.0.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.0.0-1. # pacman -Syu "mruby>=3.0.0-1" The problem has been fixed upstream in version 3.0.0. Workaround ========== None. Description =========== mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free). Impact ====== An attacker could execute arbitrary code through a use after free. References ========== https://github.com/google/oss-fuzz-vulns/blob/main/vulns/mruby/OSV-2020-744… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23801 https://github.com/mruby/mruby/commit/97319697c8f9f6ff27b32589947e1918e3015… https://security.archlinux.org/CVE-2020-36401

1 0

[ASA-202107-9] libtpms: information disclosure
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-9 ========================================= Severity: Medium Date : 2021-07-01 CVE-ID : CVE-2021-3623 Package : libtpms Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-2108 Summary ======= The package libtpms before version 0.8.4-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 0.8.4-1. # pacman -Syu "libtpms>=0.8.4-1" The problem has been fixed upstream in version 0.8.4. Workaround ========== None. Description =========== A security issue was found in libtpms before version 0.8.4. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. Impact ====== An attacker could disclose sensitive information about the state of the TPM through crafted command packets. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1976806 https://github.com/stefanberger/libtpms/pull/223 https://github.com/stefanberger/libtpms/pull/225 https://github.com/stefanberger/libtpms/commit/f16250b35aff6995e540143a9858… https://github.com/stefanberger/libtpms/commit/3ef9b26cb9f28bd64d738bff9505… https://github.com/stefanberger/libtpms/commit/5cc98a62dc6f204dcf5b87c2ee83… https://security.archlinux.org/CVE-2021-3623

1 0

[ASA-202107-8] puppet: privilege escalation
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-8 ========================================= Severity: Medium Date : 2021-07-01 CVE-ID : CVE-2021-27021 Package : puppet Type : privilege escalation Remote : Yes Link : https://security.archlinux.org/AVG-2105 Summary ======= The package puppet before version 6.23.0-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 6.23.0-1. # pacman -Syu "puppet>=6.23.0-1" The problem has been fixed upstream in version 6.23.0. Workaround ========== None. Description =========== A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query. This has been resolved in Puppet DB 6.17.0, 7.4.1, Platform 6.23, 7.7.0 and Puppet Enterprise 2021.2, 2019.8.7. Impact ====== A privilege escalation security issue allowed users to delete tables. References ========== https://puppet.com/security/cve/cve-2021-27021/ https://puppet.com/docs/puppetdb/6/release_notes.html#puppetdb-6170 https://tickets.puppetlabs.com/browse/PDB-5138 https://github.com/puppetlabs/puppetdb/commit/c146e624d230f7410fb648d58ae28… https://github.com/puppetlabs/puppetdb/commit/f8dc81678cf347739838e42cc1c42… https://github.com/puppetlabs/puppetdb/commit/72bd137511487643a3a6236ad9e72… https://security.archlinux.org/CVE-2021-27021

1 0

[ASA-202107-7] mediawiki: access restriction bypass
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-7 ========================================= Severity: Medium Date : 2021-07-01 CVE-ID : CVE-2021-35197 Package : mediawiki Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-2093 Summary ======= The package mediawiki before version 1.36.1-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 1.36.1-1. # pacman -Syu "mediawiki>=1.36.1-1" The problem has been fixed upstream in version 1.36.1. Workaround ========== None. Description =========== A security issue has been found in MediaWiki before version 1.36.1 that allows blocked users to purge pages. Impact ====== Blocked users could purge pages. References ========== https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikime… https://phabricator.wikimedia.org/T280226 https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/7fc84bbd23c… https://security.archlinux.org/CVE-2021-35197

1 0

[ASA-202107-6] python-fastapi: cross-site request forgery
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-6 ========================================= Severity: Medium Date : 2021-07-01 CVE-ID : CVE-2021-32677 Package : python-fastapi Type : cross-site request forgery Remote : Yes Link : https://security.archlinux.org/AVG-2060 Summary ======= The package python-fastapi before version 0.65.2-1 is vulnerable to cross-site request forgery. Resolution ========== Upgrade to 0.65.2-1. # pacman -Syu "python-fastapi>=0.65.2-1" The problem has been fixed upstream in version 0.65.2. Workaround ========== To mitigate the issue, it would be possible to add a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type. Description =========== FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). So, a request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. But requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. Impact ====== A remote attacker could perform cross-origin request forgery (CSRF) attacks on FastAPI applications accepting JSON payloads. References ========== https://github.com/tiangolo/fastapi/security/advisories/GHSA-8h2j-cgx8-6xv7 https://github.com/tiangolo/fastapi/pull/2118 https://github.com/tiangolo/fastapi/commit/fa7e3c996edf2d5482fff8f9d890ac23… https://security.archlinux.org/CVE-2021-32677

1 0

[ASA-202107-5] jenkins: multiple issues
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-5 ========================================= Severity: High Date : 2021-07-01 CVE-ID : CVE-2021-21670 CVE-2021-21671 Package : jenkins Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2118 Summary ======= The package jenkins before version 2.300-1 is vulnerable to multiple issues including authentication bypass and access restriction bypass. Resolution ========== Upgrade to 2.300-1. # pacman -Syu "jenkins>=2.300-1" The problems have been fixed upstream in version 2.300. Workaround ========== As a workaround for CVE-2021-21670, do not grant Item/Cancel permission to users who do not have Item/Read permission. No known workaround exists for CVE-2021-21671. Description =========== - CVE-2021-21670 (access restriction bypass) Jenkins 2.299 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission. Jenkins 2.300 requires that users have Item/Read permission for applicable types in addition to Item/Cancel permission. As a workaround on earlier versions of Jenkins, do not grant Item/Cancel permission to users who do not have Item/Read permission. - CVE-2021-21671 (authentication bypass) Jenkins 2.299 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. Jenkins 2.300 invalidates the existing session on login. Impact ====== A remote attacker could login into an expired user session. Additionally, users could cancel queue items and abort builds for which they do not have Item/Read permission. References ========== https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2278 https://github.com/jenkinsci/jenkins/commit/86b7d7e789586575522650c60d59160… https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2371 https://github.com/jenkinsci/jenkins/commit/25a42f3942fd9f8bd768c887c679dbc… https://security.archlinux.org/CVE-2021-21670 https://security.archlinux.org/CVE-2021-21671

1 0