- Arch-security - lists.archlinux.org

[arch-security] [ASA-201705-5] libtirpc: denial of service
by Levente Polyak 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-5 ========================================= Severity: Medium Date : 2017-05-07 CVE-ID : CVE-2017-8779 Package : libtirpc Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-262 Summary ======= The package libtirpc before version 1.0.1-3 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.1-3. # pacman -Syu "libtirpc>=1.0.1-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that libtirpc and libntirpc fails to free a buffer allocated for parsing XDR blocks when parsing fails due to insufficient input data being available. A specially crafted message sent to a service such as rpcbind results in a memory leak, causing the application to crash or other processes to be impacted via the OOM killer. Impact ====== A remote attacker is able to send specially crafted input to leak memory, possibly leading to denial of service. References ========== https://bugs.archlinux.org/task/53928 https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial… https://security.archlinux.org/CVE-2017-8779

1 0

[arch-security] [ASA-201705-4] rpcbind: denial of service
by Levente Polyak 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-4 ========================================= Severity: Medium Date : 2017-05-07 CVE-ID : CVE-2017-8779 Package : rpcbind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-261 Summary ======= The package rpcbind before version 0.2.4-3 is vulnerable to denial of service. Resolution ========== Upgrade to 0.2.4-3. # pacman -Syu "rpcbind>=0.2.4-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that libtirpc and libntirpc fails to free a buffer allocated for parsing XDR blocks when parsing fails due to insufficient input data being available. A specially crafted message sent to a service such as rpcbind results in a memory leak, causing the application to crash or other processes to be impacted via the OOM killer. Impact ====== A remote attacker is able to send specially crafted input to leak memory, possibly leading to denial of service. References ========== https://bugs.archlinux.org/task/53927 https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial… https://security.archlinux.org/CVE-2017-8779

1 0

[arch-security] [ASA-201705-3] ghostscript: arbitrary command execution
by Levente Polyak 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-3 ========================================= Severity: High Date : 2017-05-07 CVE-ID : CVE-2017-8291 Package : ghostscript Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-256 Summary ======= The package ghostscript before version 9.21-2 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 9.21-2. # pacman -Syu "ghostscript>=9.21-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code via a "/OutputFile (%pipe%" substring in the context of the ghostscript process, bypassing the -dSAFER protection. Impact ====== A remote attacker is able to execute arbitrary commands via a specially crafted PostScript document. References ========== https://bugs.ghostscript.com/show_bug.cgi?id=697808 https://security.archlinux.org/CVE-2017-8291

1 0

[arch-security] [ASA-201705-2] chromium: arbitrary code execution
by Remi Gacogne 03 May '17

03 May '17

Arch Linux Security Advisory ASA-201705-2 ========================================= Severity: High Date : 2017-05-03 CVE-ID : CVE-2017-5068 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-260 Summary ======= The package chromium before version 58.0.3029.96-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 58.0.3029.96-1. # pacman -Syu "chromium>=58.0.3029.96-1" The problem has been fixed upstream in version 58.0.3029.96. Workaround ========== None. Description =========== A race condition issue has been found in the WebRTC component of the Chromium browser. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-des… https://security.archlinux.org/CVE-2017-5068

1 0

[arch-security] [ASA-201705-1] dovecot: denial of service
by Remi Gacogne 01 May '17

01 May '17

Arch Linux Security Advisory ASA-201705-1 ========================================= Severity: Medium Date : 2017-05-01 CVE-ID : CVE-2017-2669 Package : dovecot Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-238 Summary ======= The package dovecot before version 2.2.29.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.2.29.1-1. # pacman -Syu "dovecot>=2.2.29.1-1" The problem has been fixed upstream in version 2.2.29.1. Workaround ========== None. Description =========== A security issue has been found in Dovecot >= 2.2.26 and <= 2.2.28. If the "dict" passdb is used for authentication, the username sent by the client is passed to the var_expand() function and double expansion of %-variables is performed. A remote unauthenticated attacker could then send a specially crafted username containing %variables to cause a denial of service. Impact ====== A remote, unauthenticated attacker can cause a denial of service by sending a specially crafted username. References ========== https://dovecot.org/list/dovecot-news/2017-April/000341.html https://github.com/dovecot/core/commit/000030feb7a30f193197f1aab8a7b04a26b4… https://security.archlinux.org/CVE-2017-2669

1 0

[arch-security] [ASA-201704-12] curl: certificate verification bypass
by Remi Gacogne 29 Apr '17

29 Apr '17

Arch Linux Security Advisory ASA-201704-12 ========================================== Severity: Medium Date : 2017-04-29 CVE-ID : CVE-2017-7468 Package : curl Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-241 Summary ======= The package curl before version 7.54.0-1 is vulnerable to certificate verification bypass. Resolution ========== Upgrade to 7.54.0-1. # pacman -Syu "curl>=7.54.0-1" The problem has been fixed upstream in version 7.54.0. Workaround ========== None. Description =========== libcurl from 7.52.0 to and including 7.53.1 would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range. Impact ====== An attacker can bypass a client certificate check by taking advantage of TLS session resumption to reuse a previously established session. References ========== https://curl.haxx.se/docs/adv_20170419.html https://security.archlinux.org/CVE-2017-7468

1 0

[arch-security] [ASA-201704-11] bind: denial of service
by Remi Gacogne 29 Apr '17

29 Apr '17

Arch Linux Security Advisory ASA-201704-11 ========================================== Severity: High Date : 2017-04-29 CVE-ID : CVE-2017-3136 CVE-2017-3137 CVE-2017-3138 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-239 Summary ======= The package bind before version 9.11.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.11.1-1. # pacman -Syu "bind>=9.11.1-1" The problems have been fixed upstream in version 9.11.1. Workaround ========== None. Description =========== - CVE-2017-3136 (denial of service) A security issue has been found in bind, where an error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;". - CVE-2017-3137 (denial of service) A security issue has been found in bind, where a server which is performing recursion can be forced to exit with an assertion failure if it can be caused to receive a response containing CNAME or DNAME resource records with certain ordering. - CVE-2017-3138 (denial of service) A security issue has been found in the bind named daemon, that will exit with a "require" assertion failure if it receives a null command string on its control channel. The control channel is not enabled by default and is usually restricted to a few remote hosts via an ACL and/or a transaction key. Impact ====== A remote attacker can crash the application, leading to denial of service. References ========== https://deepthought.isc.org/article/AA-01471 https://deepthought.isc.org/article/AA-01465 https://deepthought.isc.org/article/AA-01466 https://security.archlinux.org/CVE-2017-3136 https://security.archlinux.org/CVE-2017-3137 https://security.archlinux.org/CVE-2017-3138

1 0

[arch-security] [ASA-201704-10] libtiff: multiple issues
by Remi Gacogne 28 Apr '17

28 Apr '17

Arch Linux Security Advisory ASA-201704-10 ========================================== Severity: Medium Date : 2017-04-28 CVE-ID : CVE-2017-7592 CVE-2017-7593 CVE-2017-7594 CVE-2017-7595 CVE-2017-7596 CVE-2017-7597 CVE-2017-7598 CVE-2017-7599 CVE-2017-7600 CVE-2017-7601 CVE-2017-7602 Package : libtiff Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-237 Summary ======= The package libtiff before version 4.0.7-3 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 4.0.7-3. # pacman -Syu "libtiff>=4.0.7-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-7592 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior in putagreytile(). - CVE-2017-7593 (information disclosure) A security issue has been found in libtiff < 4.0.7, where a crafted tiff image can cause a unitialized-memory access in tif_rawdata(), leading to information leakage. - CVE-2017-7594 (denial of service) A security issue has been found in libtiff < 4.0.7, where a crafted tiff image can cause a memory leak in OJPEGReadHeaderInfoSecTablesAcTable(). - CVE-2017-7595 (denial of service) A security issue has been found in libtiff < 4.0.7, where a crafted tiff image can cause a division by zero in JPEGSetupEncode(), leading to denial of service. - CVE-2017-7596 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior. - CVE-2017-7597 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior. - CVE-2017-7598 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger a division by zero in TIFFReadDirEntryCheckedRational() or TIFFReadDirEntryCheckedSrational(), leading to denial of service - CVE-2017-7599 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior. - CVE-2017-7600 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior. - CVE-2017-7601 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior (invalid shift exponent) in JPEGSetupEncode(). - CVE-2017-7602 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior in TIFFReadRawStrip1(). Impact ====== A remote attacker can access sensitive information and cause an application crash via a crafted TIFF file. References ========== http://seclists.org/oss-sec/2017/q2/35 http://bugzilla.maptools.org/show_bug.cgi?id=2658 https://github.com/vadz/libtiff/commit/48780b4fcc425cddc4ef8ffdf536f96a0d1b… http://seclists.org/oss-sec/2017/q2/36 http://bugzilla.maptools.org/show_bug.cgi?id=2651 https://github.com/vadz/libtiff/commit/d60332057b9575ada4f264489582b13e3013… https://github.com/vadz/libtiff/commit/8283e4d1b7e53340684d12932880cbcbaf23… http://bugzilla.maptools.org/show_bug.cgi?id=2659 http://seclists.org/oss-sec/2017/q2/37 https://blogs.gentoo.org/ago/2017/04/01/libtiff-divide-by-zero-in-jpegsetup… https://github.com/vadz/libtiff/commit/47f2fb61a3a64667bce1a8398a8fcb1b348f… http://seclists.org/oss-sec/2017/q2/38 http://seclists.org/oss-sec/2017/q2/39 https://github.com/vadz/libtiff/commit/3144e57770c1e4d26520d8abee750f8ac8b7… https://github.com/vadz/libtiff/commit/3cfd62d77c2a7e147a05bd678524c345fa9c… https://github.com/vadz/libtiff/commit/0a76a8c765c7b8327c59646284fa78c3c27e… https://github.com/vadz/libtiff/commit/66e7bd59520996740e4df5495a830b42fae4… https://security.archlinux.org/CVE-2017-7592 https://security.archlinux.org/CVE-2017-7593 https://security.archlinux.org/CVE-2017-7594 https://security.archlinux.org/CVE-2017-7595 https://security.archlinux.org/CVE-2017-7596 https://security.archlinux.org/CVE-2017-7597 https://security.archlinux.org/CVE-2017-7598 https://security.archlinux.org/CVE-2017-7599 https://security.archlinux.org/CVE-2017-7600 https://security.archlinux.org/CVE-2017-7601 https://security.archlinux.org/CVE-2017-7602

1 0

[arch-security] [ASA-201704-9] webkit2gtk: multiple issues
by Remi Gacogne 28 Apr '17

28 Apr '17

Arch Linux Security Advisory ASA-201704-9 ========================================= Severity: Critical Date : 2017-04-28 CVE-ID : CVE-2016-9642 CVE-2016-9643 CVE-2017-2367 CVE-2017-2376 CVE-2017-2377 CVE-2017-2386 CVE-2017-2392 CVE-2017-2394 CVE-2017-2395 CVE-2017-2396 CVE-2017-2405 CVE-2017-2415 CVE-2017-2419 CVE-2017-2433 CVE-2017-2442 CVE-2017-2445 CVE-2017-2446 CVE-2017-2447 CVE-2017-2454 CVE-2017-2455 CVE-2017-2457 CVE-2017-2459 CVE-2017-2460 CVE-2017-2464 CVE-2017-2465 CVE-2017-2466 CVE-2017-2468 CVE-2017-2469 CVE-2017-2470 CVE-2017-2471 CVE-2017-2475 CVE-2017-2476 CVE-2017-2481 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-235 Summary ======= The package webkit2gtk before version 2.16.1-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, content spoofing, cross-site scripting, information disclosure, same-origin policy bypass and denial of service. Resolution ========== Upgrade to 2.16.1-1. # pacman -Syu "webkit2gtk>=2.16.1-1" The problems have been fixed upstream in version 2.16.1. Workaround ========== None. Description =========== - CVE-2016-9642 (denial of service) JavaScriptCore in WebKitGTK+ before 2.16.0 allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file. - CVE-2016-9643 (denial of service) The regex code in WebKitGTK+ before 2.14.6 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number of ($ (open parenthesis and dollar) followed by {-2,16} and a large number of +) (plus close parenthesis). - CVE-2017-2367 (same-origin policy bypass) An issue has been found in WebKit, allowing remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. - CVE-2017-2376 (content spoofing) An issue has been found in WebKit, allowing remote attackers to spoof the address bar by leveraging text input during the loading of a page. - CVE-2017-2377 (denial of service) This issue involves the “WebKit Web Inspector” component. It allows attackers to cause a denial of service (memory corruption and application crash) by leveraging a window-close action during a debugger-pause state. - CVE-2017-2386 (same-origin policy bypass) An issue has been found in WebKit, allowing remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. - CVE-2017-2392 (arbitrary code execution) An issue has been found in WebKit, allowing attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app. - CVE-2017-2394 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2395 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2396 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2405 (arbitrary code execution) An issue has been found in the “WebKit Web Inspector” component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2415 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code by leveraging an unspecified “type confusion.”. - CVE-2017-2419 (access restriction bypass) An issue has been found in WebKit, allowing remote attackers to bypass a Content Security Policy protection mechanism via unspecified vectors. - CVE-2017-2433 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2442 (same-origin policy bypass) An issue has been found in WebKit, involving the “WebKit JavaScript Bindings” component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. - CVE-2017-2445 (cross-site scripting) An issue has been found in WebKit, allowing remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects. - CVE-2017-2446 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code via a crafted web site that leverages the mishandling of strict mode functions. - CVE-2017-2447 (information disclosure) An issue has been found in WebKit, allowing remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted web site. - CVE-2017-2454 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2455 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2457 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2459 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2460 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2464 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2465 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2466 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2468 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2469 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2470 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2471 (arbitrary code execution) A use-after-free vulnerability has been found in WebKit, allowing remote attackers to execute arbitrary code via a crafted web site. - CVE-2017-2475 (cross-site scripting) An issue has been found in WebKit, allowing remote attackers to conduct Universal XSS (UXSS) attacks via crafted use of frames on a web site. - CVE-2017-2476 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2481 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. Impact ====== A remote attacker can bypass access restrictions, spoof content, access sensitive information, cause a crash and execute arbitrary code on the affected host. References ========== https://webkitgtk.org/security/WSA-2017-0003.html https://security.archlinux.org/CVE-2016-9642 https://security.archlinux.org/CVE-2016-9643 https://security.archlinux.org/CVE-2017-2367 https://security.archlinux.org/CVE-2017-2376 https://security.archlinux.org/CVE-2017-2377 https://security.archlinux.org/CVE-2017-2386 https://security.archlinux.org/CVE-2017-2392 https://security.archlinux.org/CVE-2017-2394 https://security.archlinux.org/CVE-2017-2395 https://security.archlinux.org/CVE-2017-2396 https://security.archlinux.org/CVE-2017-2405 https://security.archlinux.org/CVE-2017-2415 https://security.archlinux.org/CVE-2017-2419 https://security.archlinux.org/CVE-2017-2433 https://security.archlinux.org/CVE-2017-2442 https://security.archlinux.org/CVE-2017-2445 https://security.archlinux.org/CVE-2017-2446 https://security.archlinux.org/CVE-2017-2447 https://security.archlinux.org/CVE-2017-2454 https://security.archlinux.org/CVE-2017-2455 https://security.archlinux.org/CVE-2017-2457 https://security.archlinux.org/CVE-2017-2459 https://security.archlinux.org/CVE-2017-2460 https://security.archlinux.org/CVE-2017-2464 https://security.archlinux.org/CVE-2017-2465 https://security.archlinux.org/CVE-2017-2466 https://security.archlinux.org/CVE-2017-2468 https://security.archlinux.org/CVE-2017-2469 https://security.archlinux.org/CVE-2017-2470 https://security.archlinux.org/CVE-2017-2471 https://security.archlinux.org/CVE-2017-2475 https://security.archlinux.org/CVE-2017-2476 https://security.archlinux.org/CVE-2017-2481

1 0

[arch-security] [ASA-201704-8] jenkins: multiple issues
by Jelle van der Waa 27 Apr '17

27 Apr '17

Arch Linux Security Advisory ASA-201704-8 ========================================= Severity: High Date : 2017-04-27 CVE-ID : CVE-2017-1000354 CVE-2017-1000355 CVE-2017-1000356 Package : jenkins Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-255 Summary ======= The package jenkins before version 2.57-1 is vulnerable to multiple issues including cross-site request forgery, privilege escalation and arbitrary code execution. Resolution ========== Upgrade to 2.57-1. # pacman -Syu "jenkins>=2.57-1" The problems have been fixed upstream in version 2.57. Workaround ========== None. Description =========== - CVE-2017-1000354 (privilege escalation) The login command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to authenticate further commands. Users with sufficient permission to create secrets in Jenkins, and download their encrypted values (e.g. with Job/Configure permission), were able to impersonate any other Jenkins user on the same instance. This has been fixed by storing the cached authentication as a hash- based MAC with a key specific to the Jenkins instance and the CLI authentication cache. Previously cached authentications are invalidated when upgrading Jenkins to a version containing a fix for this. - CVE-2017-1000355 (arbitrary code execution) Jenkins uses the XStream library to serialize and deserialize XML. Its maintainer recently published a security vulnerability that allows anyone able to provide XML to Jenkins for processing using XStream to crash the Java process. In Jenkins this typically applies to users with permission to create or configure items (jobs), views, or agents. Jenkins now prohibits the attempted deserialization of void / Void that results in a crash. - CVE-2017-1000356 (cross-site request forgery) Multiple Cross-Site Request Forgery vulnerabilities in Jenkins allowed malicious users to perform several administrative actions by tricking a victim into opening a web page. The most notable ones: SECURITY-412: Restart Jenkins immediately, after all builds are finished, or after all plugin installations and builds are finished SECURITY-412: Schedule a downgrade of Jenkins to a previously installed version if Jenkins previously upgraded itself SECURITY-413: Install and (optionally) dynamically load any plugin present on a configured update site SECURITY-414: Remove any update site from the Jenkins configuration SECURITY-415: Change a user’s API token SECURITY-416: Submit system configuration SECURITY-417: Submit global security configuration SECURITY-418, SECURITY-420: For Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting the existing default admin user in the process SECURITY-419: Create a new agent, possibly executing arbitrary shell commands on the master node by choosing the appropriate launch method SECURITY-420: Update the node monitor data on all agents Impact ====== A remote attacker can escalate privileges, execute arbitrary code or execute cross-site request forgery which allows the attacker to perform several administrative actions. References ========== https://jenkins.io/security/advisory/2017-04-26/ http://seclists.org/oss-sec/2017/q2/132 http://www.openwall.com/lists/oss-security/2017/04/03/4 https://security.archlinux.org/CVE-2017-1000354 https://security.archlinux.org/CVE-2017-1000355 https://security.archlinux.org/CVE-2017-1000356

1 0