- Arch-security - lists.archlinux.org

[ASA-202107-4] opera: arbitrary code execution
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-4 ========================================= Severity: High Date : 2021-07-01 CVE-ID : CVE-2021-30554 CVE-2021-30555 CVE-2021-30556 CVE-2021-30557 Package : opera Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2083 Summary ======= The package opera before version 77.0.4054.146-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 77.0.4054.146-1. # pacman -Syu "opera>=77.0.4054.146-1" The problems have been fixed upstream in version 77.0.4054.146. Workaround ========== None. Description =========== - CVE-2021-30554 (arbitrary code execution) A use after free security issue has been found in the WebGL component of the Chromium browser engine before version 91.0.4472.114. Google is aware that an exploit for CVE-2021-30554 exists in the wild. - CVE-2021-30555 (arbitrary code execution) A use after free security issue has been found in the Sharing component of the Chromium browser engine before version 91.0.4472.114. - CVE-2021-30556 (arbitrary code execution) A use after free security issue has been found in the WebAudio component of the Chromium browser engine before version 91.0.4472.114. - CVE-2021-30557 (arbitrary code execution) A use after free security issue has been found in the TabGroups component of the Chromium browser engine before version 91.0.4472.114. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://blogs.opera.com/desktop/changelog-for-77/ https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1219857 https://crbug.com/1215029 https://crbug.com/1212599 https://crbug.com/1202102 https://security.archlinux.org/CVE-2021-30554 https://security.archlinux.org/CVE-2021-30555 https://security.archlinux.org/CVE-2021-30556 https://security.archlinux.org/CVE-2021-30557

1 0

[ASA-202107-3] istio: information disclosure
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-3 ========================================= Severity: Critical Date : 2021-07-01 CVE-ID : CVE-2021-34824 Package : istio Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2113 Summary ======= The package istio before version 1.10.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.10.2-1. # pacman -Syu "istio>=1.10.2-1" The problem has been fixed upstream in version 1.10.2. Workaround ========== This vulnerability can be mitigated by disabling Istiod caching. Caching is disabled by setting an Istiod environment variable PILOT_ENABLE_XDS_CACHE=false. System and Istiod performance may be impacted as this disables XDS caching. Description =========== Istio before version 1.10.2 contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces. The Istio Gateway and DestinationRule can load private keys and certificates from Kubernetes secrets via the credentialName configuration. For Istio 1.8 and above, the secrets are conveyed from Istiod to gateways or workloads via the XDS API. In the above approach, a gateway or workload deployment should only be able to access credentials (TLS certificates and private keys) stored in the Kubernetes secrets within its namespace. However, a bug in Istiod permits an authorized client the ability to access and retrieve any TLS certificate and private key cached in Istiod. Impact ====== An authorized client could retrieve any TLS certificate and private key cached in Istiod outside of its own namespace. References ========== https://istio.io/latest/news/security/istio-security-2021-007/ https://github.com/istio/istio/commit/10674c9a86ece93dcd40efd8e4b9147bc8604… https://github.com/istio/istio/commit/f58f789f8e0d1580d00b68b76b1132163939b… https://security.archlinux.org/CVE-2021-34824

1 0

[ASA-202107-2] electron11: multiple issues
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-2 ========================================= Severity: Critical Date : 2021-07-01 CVE-ID : CVE-2021-30544 CVE-2021-30548 CVE-2021-30551 Package : electron11 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2099 Summary ======= The package electron11 before version 11.4.9-1 is vulnerable to multiple issues including arbitrary code execution and incorrect calculation. Resolution ========== Upgrade to 11.4.9-1. # pacman -Syu "electron11>=11.4.9-1" The problems have been fixed upstream in version 11.4.9. Workaround ========== None. Description =========== - CVE-2021-30544 (arbitrary code execution) A use after free security issue has been found in the BFCache component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30548 (arbitrary code execution) A use after free security issue has been found in the Loader component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30551 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 91.0.4472.101. Google is aware that an exploit for CVE-2021-30551 exists in the wild. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://www.electronjs.org/releases/stable?version=11#11.4.9 https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1212618 https://crbug.com/1210487 https://crbug.com/1216437 https://security.archlinux.org/CVE-2021-30544 https://security.archlinux.org/CVE-2021-30548 https://security.archlinux.org/CVE-2021-30551

1 0

[ASA-202107-1] electron12: arbitrary code execution
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-1 ========================================= Severity: High Date : 2021-07-01 CVE-ID : CVE-2021-30547 CVE-2021-30553 CVE-2021-30554 Package : electron12 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2112 Summary ======= The package electron12 before version 12.0.13-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 12.0.13-1. # pacman -Syu "electron12>=12.0.13-1" The problems have been fixed upstream in version 12.0.13. Workaround ========== None. Description =========== - CVE-2021-30547 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30553 (arbitrary code execution) A use after free security issue has been found in the Network service component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30554 (arbitrary code execution) A use after free security issue has been found in the WebGL component of the Chromium browser engine before version 91.0.4472.114. Google is aware that an exploit for CVE-2021-30554 exists in the wild. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://github.com/electron/electron/releases/tag/v12.0.13 https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1210414 https://crbug.com/1209769 https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1219857 https://security.archlinux.org/CVE-2021-30547 https://security.archlinux.org/CVE-2021-30553 https://security.archlinux.org/CVE-2021-30554

1 0

[ASA-202106-57] pigeonhole: denial of service
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-57 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2020-28200 Package : pigeonhole Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2088 Summary ======= The package pigeonhole before version 0.5.15-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.5.15-1. # pacman -Syu "pigeonhole>=0.5.15-1" The problem has been fixed upstream in version 0.5.15. Workaround ========== Disabling the regex sieve extension avoids the worst problems. lmtp_user_concurrency_limit may also be helpful. Description =========== A security issue has been found in Pigeonhole before version 0.5.15. The Sieve interpreter is not protected against abusive scripts that claim excessive resource usage, especially scripts using massive amounts of regexps. This means an attacker can cause a denial of service of the mail delivery system by using excessive amount of CPU and/or reaching the lmtp/lda process limits. Impact ====== A user could consume an excessive amount of CPU resources through crafted Sieve scripts. References ========== https://dovecot.org/pipermail/dovecot-news/2021-June/000458.html https://dovecot.org/pipermail/dovecot-news/2021-June/000460.html https://github.com/dovecot/pigeonhole/commit/68505e444f91ebd784d419a8c11f1b… https://security.archlinux.org/CVE-2020-28200

1 0

[ASA-202106-56] dovecot: information disclosure
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-56 ========================================== Severity: High Date : 2021-06-22 CVE-ID : CVE-2021-29157 CVE-2021-33515 Package : dovecot Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2087 Summary ======= The package dovecot before version 2.3.15-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.3.15-1. # pacman -Syu "dovecot>=2.3.15-1" The problems have been fixed upstream in version 2.3.15. Workaround ========== CVE-2021-29157 can be mitigated by disabling local JWT validation in oauth2, or using a different dict driver than fs:posix. No known workaround exists for CVE-2021-33515. Description =========== - CVE-2021-29157 (information disclosure) A security issue has been found in Dovecot before version 2.3.14.1. The kid and azp fields in JWT tokens are not correctly escaped. This may be used to supply attacker controlled keys to validate tokens in some configurations. The attack requires an attacker to be able to write files to the local disk. As a result, a local attacker can login as any user and access their emails. - CVE-2021-33515 (information disclosure) A security issue has been found in Dovecot before version 2.3.14.1. An on-path attacker could inject plaintext commands before the STARTTLS negotiation that would be executed after STARTTLS finished with the client. Only the SMTP submission service is affected. As a result, an attacker can potentially steal user credentials and emails. The attacker needs to have sending permissions on the submission server (a valid username and password). Impact ====== A remote authenticated attacker or a local attacker with write access to the disk could disclose user credentials and emails. References ========== https://dovecot.org/pipermail/dovecot-news/2021-June/000461.html https://github.com/dovecot/core/commit/7f06f6274437ea97142df1f64f322b3ced44… https://github.com/dovecot/core/commit/7a77e070ddb6a67fe7a40118ba3e3f9b6062… https://github.com/dovecot/core/commit/bae4e44596d6548322665d242b055f44fe1d… https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html https://github.com/dovecot/core/commit/65bd1a27a361545c9ccf405b955c72a9c4d2… https://security.archlinux.org/CVE-2021-29157 https://security.archlinux.org/CVE-2021-33515

1 0

[ASA-202106-55] tpm2-tools: man-in-the-middle
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-55 ========================================== Severity: Low Date : 2021-06-22 CVE-ID : CVE-2021-3565 Package : tpm2-tools Type : man-in-the-middle Remote : No Link : https://security.archlinux.org/AVG-1986 Summary ======= The package tpm2-tools before version 5.1.1-1 is vulnerable to man-in- the-middle. Resolution ========== Upgrade to 5.1.1-1. # pacman -Syu "tpm2-tools>=5.1.1-1" The problem has been fixed upstream in version 5.1.1. Workaround ========== None. Description =========== A security issue was found in tpm2-tools before version 5.1.1. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a man-in-the-middle (MITM) attacker to unwrap the inner portion and reveal the key being imported. Impact ====== A local attacker could disclose the secret portion of a key while it is being imported into the TPM. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1964427 https://github.com/tpm2-software/tpm2-tools/issues/2738 https://github.com/tpm2-software/tpm2-tools/pull/2739 https://github.com/tpm2-software/tpm2-tools/commit/47b3b6e6fffed7080a2f1ce7… https://security.archlinux.org/CVE-2021-3565

1 0

[ASA-202106-54] exiv2: multiple issues
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-54 ========================================== Severity: Low Date : 2021-06-22 CVE-ID : CVE-2021-3482 CVE-2021-29457 CVE-2021-29458 CVE-2021-29463 CVE-2021-29464 CVE-2021-29470 CVE-2021-29473 CVE-2021-29623 CVE-2021-32617 Package : exiv2 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1772 Summary ======= The package exiv2 before version 0.27.4-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 0.27.4-1. # pacman -Syu "exiv2>=0.27.4-1" The problems have been fixed upstream in version 0.27.4. Workaround ========== None. Description =========== - CVE-2021-3482 (arbitrary code execution) A security issue was found in Exiv2 in versions before version 0.27.4. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. - CVE-2021-29457 (arbitrary code execution) A heap buffer overflow was found in Exiv2 before version 0.27.4. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. - CVE-2021-29458 (denial of service) An out-of-bounds read was found in Exiv2 before version 0.27.4. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. - CVE-2021-29463 (denial of service) An out-of-bounds read was found in Exiv2 before version 0.27.4. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. - CVE-2021-29464 (arbitrary code execution) A heap buffer overflow was found in Exiv2 before version 0.27.4. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. - CVE-2021-29470 (denial of service) An out-of-bounds read was found in Exiv2 before version 0.27.4. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. - CVE-2021-29473 (denial of service) An out-of-bounds read was found in Exiv2 before version 0.27.4. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. - CVE-2021-29623 (information disclosure) A read of uninitialized memory was found in Exiv2 before version 0.27.4. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack memory, if they can trick the victim into running Exiv2 on a crafted image file. - CVE-2021-32617 (denial of service) An inefficient algorithm (quadratic complexity) was found in Exiv2 before version 0.27.4. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as rm. Impact ====== Reading or writing EXIF metadata of a crafted image file could lead to arbitrary code execution. References ========== https://github.com/Exiv2/exiv2/security/advisories/GHSA-9jp9-m3fv-2vg9 https://github.com/Exiv2/exiv2/issues/1522 https://github.com/Exiv2/exiv2/pull/1523 https://github.com/Exiv2/exiv2/commit/22ea582c6b74ada30bec3a6b15de3c3e52f2b… https://github.com/Exiv2/exiv2/security/advisories/GHSA-v74w-h496-cgqm https://github.com/Exiv2/exiv2/issues/1529 https://github.com/Exiv2/exiv2/pull/1534 https://github.com/Exiv2/exiv2/commit/13e5a3e02339b746abcaee6408893ca2fd8e2… https://github.com/Exiv2/exiv2/security/advisories/GHSA-57jj-75fm-9rq5 https://github.com/Exiv2/exiv2/issues/1530 https://github.com/Exiv2/exiv2/pull/1536 https://github.com/Exiv2/exiv2/pull/1539 https://github.com/Exiv2/exiv2/commit/9b7a19f957af53304655ed1efe32253a1b11a… https://github.com/Exiv2/exiv2/security/advisories/GHSA-5p8g-9xf3-gfrr https://github.com/Exiv2/exiv2/pull/1577 https://github.com/Exiv2/exiv2/commit/d639e45c2cdc18b9b49b1307c6e4315277fa8… https://github.com/Exiv2/exiv2/security/advisories/GHSA-jgm9-5fw5-pw9p https://github.com/Exiv2/exiv2/pull/1576 https://github.com/Exiv2/exiv2/commit/0357f341e43f6e14123f227946574231ba379… https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj https://github.com/Exiv2/exiv2/pull/1581 https://github.com/Exiv2/exiv2/commit/f6ee71526eef5649a529ac6da3f2843e3b63e… https://github.com/Exiv2/exiv2/security/advisories/GHSA-7569-phvm-vwc2 https://github.com/Exiv2/exiv2/pull/1587 https://github.com/Exiv2/exiv2/commit/e6a0982f7cd9282052b6e3485a458d60629ff… https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v https://github.com/Exiv2/exiv2/pull/1627 https://github.com/Exiv2/exiv2/commit/0f9eb74c44c908e170a64cab590949d53749a… https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mj https://github.com/Exiv2/exiv2/pull/1657 https://github.com/Exiv2/exiv2/commit/c261fbaa2567687eec6a595d3016212fd6ae6… https://security.archlinux.org/CVE-2021-3482 https://security.archlinux.org/CVE-2021-29457 https://security.archlinux.org/CVE-2021-29458 https://security.archlinux.org/CVE-2021-29463 https://security.archlinux.org/CVE-2021-29464 https://security.archlinux.org/CVE-2021-29470 https://security.archlinux.org/CVE-2021-29473 https://security.archlinux.org/CVE-2021-29623 https://security.archlinux.org/CVE-2021-32617

1 0

[ASA-202106-53] keycloak: certificate verification bypass
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-53 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2020-35509 Package : keycloak Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-2084 Summary ======= The package keycloak before version 14.0.0-1 is vulnerable to certificate verification bypass. Resolution ========== Upgrade to 14.0.0-1. # pacman -Syu "keycloak>=14.0.0-1" The problem has been fixed upstream in version 14.0.0. Workaround ========== None. Description =========== A security issue has been found in Keycloak before version 14.0.0. Depending on the webserver configuration, a malicious user can supply an expired certificate and it would be accepted by Keycloak direct- grant authenticator. This is because Keycloak does not trigger the appropriate timestamp validation. Impact ====== A user could authenticate with an expired certificate. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1912427 https://issues.redhat.com/browse/KEYCLOAK-16450 https://github.com/keycloak/keycloak/pull/8067 https://github.com/keycloak/keycloak/commit/478319348bdfdb9b6d39122f41edf2a… https://security.archlinux.org/CVE-2020-35509

1 0

[ASA-202106-52] helm: information disclosure
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-52 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-32690 Package : helm Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2078 Summary ======= The package helm before version 3.6.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 3.6.1-1. # pacman -Syu "helm>=3.6.1-1" The problem has been fixed upstream in version 3.6.1. Workaround ========== None. Description =========== In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. The index.yaml within a Helm chart repository contains a reference where to get the chart archive for each version of a chart. The reference can be relative to the index.yaml file or a URL to location. The URL can point to any domain and this is a feature leveraged by Helm users. For example, an index.yaml file can be hosted on GitHub pages while the chart archives are hosted as GitHub releases. These are on different domain names and the index.yaml file points to the other domain. When a username and password were associated with a Helm repository the username and password were also passed on to other domains referenced in the index.yaml file. This occurred when Helm went to retrieve a specific chart archive on the other domain. Impact ====== Username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. References ========== https://github.com/helm/helm/security/advisories/GHSA-56hp-xqp3-w2jf https://github.com/helm/helm/commit/61d8e8c4a6f95540c15c6a65f36a6dd0a45e7a2f https://security.archlinux.org/CVE-2021-32690

1 0