April 2022 - Arch-security - lists.archlinux.org

[ASA-202204-9] python-django: sql injection
by Levente Polyak 12 Apr '22

12 Apr '22

Arch Linux Security Advisory ASA-202204-9 ========================================= Severity: High Date : 2022-04-12 CVE-ID : CVE-2022-28346 CVE-2022-28347 Package : python-django Type : sql injection Remote : Yes Link : https://security.archlinux.org/AVG-2667 Summary ======= The package python-django before version 4.0.4-1 is vulnerable to sql injection. Resolution ========== Upgrade to 4.0.4-1. # pacman -Syu "python-django>=4.0.4-1" The problems have been fixed upstream in version 4.0.4. Workaround ========== None. Description =========== - CVE-2022-28346 (sql injection) QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods. - CVE-2022-28347 (sql injection) QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument. Impact ====== An attacker is able to perform an SQL injection via a specially crafted input. References ========== https://www.djangoproject.com/weblog/2022/apr/11/security-releases/ https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef080… https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7e… https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5… https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e… https://github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1b… https://github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408… https://github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf1887… https://github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa… https://security.archlinux.org/CVE-2022-28346 https://security.archlinux.org/CVE-2022-28347

1 0

[ASA-202204-8] xz: arbitrary command execution
by Levente Polyak 12 Apr '22

12 Apr '22

Arch Linux Security Advisory ASA-202204-8 ========================================= Severity: High Date : 2022-04-07 CVE-ID : CVE-2022-1271 Package : xz Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-2665 Summary ======= The package xz before version 5.2.5-3 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 5.2.5-3. # pacman -Syu "xz>=5.2.5-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Malicious filenames with two or more newlines can make zgrep and xzgrep to write to arbitrary files or (with a GNU sed extension) lead to arbitrary code execution. The issue with the old code is that with multiple newlines, the N-command will read the second line of input, then the s-commands will be skipped because it's not the end of the file yet, then a new sed cycle starts and the pattern space is printed and emptied. So only the last line or two get escaped. Impact ====== An attacker is able to provide malicious filenames to write to arbitrary files or execute arbitrary commands on the affected host. References ========== https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=dc9740df61e575e8c3148… https://savannah.gnu.org/forum/forum.php?forum_id=10157 https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f… https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch.sig https://security.archlinux.org/CVE-2022-1271

1 0

[ASA-202204-7] gzip: arbitrary command execution
by Levente Polyak 12 Apr '22

12 Apr '22

Arch Linux Security Advisory ASA-202204-7 ========================================= Severity: High Date : 2022-04-07 CVE-ID : CVE-2022-1271 Package : gzip Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-2666 Summary ======= The package gzip before version 1.12-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 1.12-1. # pacman -Syu "gzip>=1.12-1" The problem has been fixed upstream in version 1.12. Workaround ========== None. Description =========== Malicious filenames with two or more newlines can make zgrep and xzgrep to write to arbitrary files or (with a GNU sed extension) lead to arbitrary code execution. The issue with the old code is that with multiple newlines, the N-command will read the second line of input, then the s-commands will be skipped because it's not the end of the file yet, then a new sed cycle starts and the pattern space is printed and emptied. So only the last line or two get escaped. Impact ====== An attacker is able to provide malicious filenames to write to arbitrary files or execute arbitrary commands on the affected host. References ========== https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=dc9740df61e575e8c3148… https://savannah.gnu.org/forum/forum.php?forum_id=10157 https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f… https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch.sig https://security.archlinux.org/CVE-2022-1271

1 0

[ASA-202204-6] libtiff: multiple issues
by Levente Polyak 07 Apr '22

07 Apr '22

Arch Linux Security Advisory ASA-202204-6 ========================================= Severity: High Date : 2022-04-05 CVE-ID : CVE-2022-0561 CVE-2022-0562 CVE-2022-0865 CVE-2022-0891 CVE-2022-0907 CVE-2022-0908 CVE-2022-0909 CVE-2022-0924 CVE-2022-22844 Package : libtiff Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2658 Summary ======= The package libtiff before version 4.3.0-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 4.3.0-2. # pacman -Syu "libtiff>=4.3.0-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2022-0561 (denial of service) Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. - CVE-2022-0562 (denial of service) Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. - CVE-2022-0865 (denial of service) Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-0891 (arbitrary code execution) A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact. - CVE-2022-0907 (denial of service) Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-0908 (denial of service) Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file. - CVE-2022-0909 (denial of service) A division by zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-0924 (denial of service) Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-22844 (denial of service) LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field. Impact ====== A remote attacker is able to crash the application or execute arbitrary code on the affected host via a crafted tiff file. References ========== https://bugs.archlinux.org/task/74229 https://gitlab.com/libtiff/libtiff/-/issues/362 https://gitlab.com/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a… https://gitlab.com/libtiff/libtiff/-/commit/561599c99f987dc32ae110370cfdd7d… https://gitlab.com/libtiff/libtiff/-/issues/385 https://gitlab.com/libtiff/libtiff/-/merge_requests/306 https://gitlab.com/libtiff/libtiff/-/commit/a1c933dabd0e1c54a412f3f84ae0aa5… https://gitlab.com/libtiff/libtiff/-/issues/380 https://gitlab.com/libtiff/libtiff/-/issues/382 https://gitlab.com/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb… https://gitlab.com/libtiff/libtiff/-/issues/392 https://gitlab.com/libtiff/libtiff/-/merge_requests/314 https://gitlab.com/libtiff/libtiff/-/commit/40b00cfb32256d377608b4d4cd30fac… https://gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f8… https://gitlab.com/libtiff/libtiff/-/issues/383 https://gitlab.com/libtiff/libtiff/-/issues/393 https://gitlab.com/libtiff/libtiff/-/merge_requests/310 https://gitlab.com/libtiff/libtiff/-/commit/32ea0722ee68f503b7a3f9b2d557acb… https://gitlab.com/libtiff/libtiff/-/issues/278 https://gitlab.com/libtiff/libtiff/-/merge_requests/311 https://gitlab.com/libtiff/libtiff/-/commit/88d79a45a31c74cba98c697892fed5f… https://gitlab.com/libtiff/libtiff/-/issues/355 https://gitlab.com/libtiff/libtiff/-/merge_requests/287 https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e… https://security.archlinux.org/CVE-2022-0561 https://security.archlinux.org/CVE-2022-0562 https://security.archlinux.org/CVE-2022-0865 https://security.archlinux.org/CVE-2022-0891 https://security.archlinux.org/CVE-2022-0907 https://security.archlinux.org/CVE-2022-0908 https://security.archlinux.org/CVE-2022-0909 https://security.archlinux.org/CVE-2022-0924 https://security.archlinux.org/CVE-2022-22844

1 0

[ASA-202204-5] bind: multiple issues
by Levente Polyak 06 Apr '22

06 Apr '22

Arch Linux Security Advisory ASA-202204-5 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-25220 CVE-2022-0396 CVE-2022-0635 CVE-2022-0667 Package : bind Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2661 Summary ======= The package bind before version 9.18.1-1 is vulnerable to multiple issues including denial of service and content spoofing. Resolution ========== Upgrade to 9.18.1-1. # pacman -Syu "bind>=9.18.1-1" The problems have been fixed upstream in version 9.18.1. Workaround ========== - CVE-2021-25220 If applicable, modify your configuration to either remove all forwarding or all possibility of recursion. Depending on your use-case, it may be possible to use other zone types to replace forward zones. - CVE-2022-0396 use the default setting of keep-response-order { none; }. - CVE-2022-0635 The failure can be avoided by adding this option to named.conf: synth-from-dnssec no; However we do not recommend disabling this feature other than as a temporary workaround because it provides protection from pseudo-random- subdomain attacks against DNSSEC-signed zones. Description =========== - CVE-2021-25220 (content spoofing) When using forwarders in BIND, bogus NS records supplied by, or via, those forwarders may be cached and used by named if it needs to recurse for any reason, causing it to obtain and pass on potentially incorrect answers. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients. Authoritative-only BIND 9 servers are not vulnerable to this flaw. - CVE-2022-0396 (denial of service) ISC recently discovered an issue in BIND that allows TCP connection slots to be consumed for an indefinite time frame via a specifically crafted TCP stream sent from a client. This issue is present in BIND 9.16.11 to 9.16.26 (including S editions), and 9.18.0. This issue can only be triggered on BIND servers which have keep- response-order enabled, which is not the default configuration. The keep-response-order option is an ACL block; any hosts which are specified within it will be able to trigger this issue on affected versions. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection. - CVE-2022-0635 (denial of service) BIND 9.18.0 stable release refactored the RFC 8198 Aggressive Use of DNSSEC-Validated Cache feature (synth-from-dnssec) and changed the default so that is now automatically enabled for dnssec-validating resolvers. Subsequently it was found that repeated patterns of specific queries to servers with this feature enabled could cause an INSIST failure in query.c:query_dname which causes named to terminate unexpectedly. The vulnerability affects BIND resolvers running 9.18.0 that have both dnssec-validation and synth-from-dnssec enabled. (Note that dnssec- validation auto; is the default setting unless configured otherwise in named.conf and that enabling dnssec-validation automatically enables synth-from-dnssec unless explicitly disabled) When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check. - CVE-2022-0667 (denial of service) In BIND 9.18.0 the recursive client code was refactored that introduced a "backstop lifetime timer". While BIND is processing a request for a DS record that needs to be forwarded, it waits until this processing is complete or until the backstop lifetime timer has timed out. When the resume_dslookup() function is called as a result of such a timeout, the function does not test whether the fetch has previously been shut down. This introduces the possibility of triggering an assertion failure, which could cause the BIND process to terminate. Impact ====== A remote attacker is able to crash the application or force TCP connections to BIND to remain in CLOSE_WAIT status leading to denial of service on the affected host. Furthermore the cache could become poisoned leading to queries being made to the wrong servers, which might also result in false information being returned to clients. References ========== https://kb.isc.org/docs/cve-2021-25220 https://gitlab.isc.org/isc-projects/bind9/-/commit/fc9cb6cf91c1a36b797ffef0… https://kb.isc.org/docs/cve-2022-0396 https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5987 https://gitlab.isc.org/isc-projects/bind9/-/commit/ae7fa0a3082d1b97b1123a96… https://kb.isc.org/docs/cve-2022-0635 https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5988 https://gitlab.isc.org/isc-projects/bind9/-/commit/71dd44339f4cf616e514cefa… https://kb.isc.org/docs/cve-2022-0667 https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5989 https://gitlab.isc.org/isc-projects/bind9/-/commit/7ba3a069355875409fadd0da… https://security.archlinux.org/CVE-2021-25220 https://security.archlinux.org/CVE-2022-0396 https://security.archlinux.org/CVE-2022-0635 https://security.archlinux.org/CVE-2022-0667

1 0

[ASA-202204-4] rizin: multiple issues
by Levente Polyak 05 Apr '22

05 Apr '22

Arch Linux Security Advisory ASA-202204-4 ========================================= Severity: Medium Date : 2022-04-04 CVE-ID : CVE-2021-4022 CVE-2021-43814 Package : rizin Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2590 Summary ======= The package rizin before version 0.3.2-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.3.2-1. # pacman -Syu "rizin>=0.3.2-1" The problems have been fixed upstream in version 0.3.2. Workaround ========== None. Description =========== - CVE-2021-4022 (denial of service) A specially crafted binary can make Rizin segfault when it tries to analyze it (doing a full analysis with aaa). In rz_core_analysis_type_match retctx structure was initialized on the stack only after a "goto out_function", where a field of that structure was freed. When the goto path is taken, the field is not properly initialized and it could cause a crash of Rizin or have other effects. - CVE-2021-43814 (arbitrary code execution) In Rizin versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin may crash or execute unintended actions. Impact ====== An attacker is able to provide a malicious AMD64 ELF binary that when opened by a victim may execute arbitrary code on the affected host. References ========== https://github.com/rizinorg/rizin/issues/2015 https://github.com/rizinorg/rizin/pull/2031 https://github.com/rizinorg/rizin/commit/21584e416cdcef2fa7d855c5aabf592a96… https://github.com/rizinorg/rizin/commit/6ce71d8aa3dafe3cdb52d5d72ae8f4b959… https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8r https://github.com/rizinorg/rizin/issues/2083 https://github.com/rizinorg/rizin/pull/2086 https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b… https://github.com/rizinorg/rizin/commit/1a63dad027df62c5d65cad480d9ddc6134… https://security.archlinux.org/CVE-2021-4022 https://security.archlinux.org/CVE-2021-43814

1 0

[ASA-202204-3] zlib: arbitrary code execution
by Levente Polyak 05 Apr '22

05 Apr '22

Arch Linux Security Advisory ASA-202204-3 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2018-25032 Package : zlib Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2657 Summary ======= The package zlib before version 1:1.2.12-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1:1.2.12-1. # pacman -Syu "zlib>=1:1.2.12-1" The problem has been fixed upstream in version 1.2.12. Workaround ========== None. Description =========== An out-of-bounds access flaw was found in zlib before 1.2.12, which allows memory corruption when deflating (ex: when compressing) if the input has many distant matches. For some rare inputs with a large number of distant matches (crafted payloads), the buffer into which the compressed or deflated data is written can overwrite the distance symbol table which it overlays. This issue results in corrupted output due to invalid distances, which leads to out-of-bound access, corrupting the memory and crashing the application or potentially execute arbitrary code. Impact ====== A remote attacker is able to use a specially crafted input to crash an application that is using zlib or potentially execute arbitrary code on the affected host. References ========== https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c… https://github.com/madler/zlib/issues/605 https://www.openwall.com/lists/oss-security/2022/03/24/1 https://www.openwall.com/lists/oss-security/2022/03/26/1 https://security.archlinux.org/CVE-2018-25032

1 0

[ASA-202204-2] polkit: multiple issues
by Levente Polyak 05 Apr '22

05 Apr '22

Arch Linux Security Advisory ASA-202204-2 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-4034 CVE-2021-4115 Package : polkit Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2654 Summary ======= The package polkit before version 0.120-5 is vulnerable to multiple issues including privilege escalation and denial of service. Resolution ========== Upgrade to 0.120-5. # pacman -Syu "polkit>=0.120-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2021-4034 (privilege escalation) A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. - CVE-2021-4115 (denial of service) There is a file descriptor leak in polkit, which can enable an unprivileged user to cause polkit to crash, due to file descriptor exhaustion. Impact ====== A local attacker is able to crash the process or elevate privileges on the affected host. References ========== https://access.redhat.com/security/cve/CVE-2021-4034 https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c… https://www.openwall.com/lists/oss-security/2022/02/18/5 https://gitlab.freedesktop.org/polkit/polkit/-/issues/141 https://gitlab.freedesktop.org/polkit/polkit/-/commit/41cb093f554da87723626… https://security.archlinux.org/CVE-2021-4034 https://security.archlinux.org/CVE-2021-4115

1 0

[ASA-202204-1] postgresql: man-in-the-middle
by Levente Polyak 05 Apr '22

05 Apr '22

Arch Linux Security Advisory ASA-202204-1 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-23214 Package : postgresql Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-2546 Summary ======= The package postgresql before version 13.5-1 is vulnerable to man-in- the-middle. Resolution ========== Upgrade to 13.5-1. # pacman -Syu "postgresql>=13.5-1" The problem has been fixed upstream in version 13.5. Workaround ========== None. Description =========== A security issue has been found in PostgreSQL versions 9.6 up to 14. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the- middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. Impact ====== A man-in-the-middle attacker is able to inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. References ========== https://www.postgresql.org/support/security/CVE-2021-23214/ https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=28e24125… https://security.archlinux.org/CVE-2021-23214

1 0