- Arch-security - lists.archlinux.org

[ASA-202107-17] rabbitmq: cross-site scripting
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-17 ========================================== Severity: Low Date : 2021-07-06 CVE-ID : CVE-2021-32718 CVE-2021-32719 Package : rabbitmq Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2109 Summary ======= The package rabbitmq before version 3.8.19-1 is vulnerable to cross- site scripting. Resolution ========== Upgrade to 3.8.19-1. # pacman -Syu "rabbitmq>=3.8.19-1" The problems have been fixed upstream in version 3.8.19. Workaround ========== As a workaround, disable the rabbitmq_management plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring. Description =========== - CVE-2021-32718 (cross-site scripting) In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper <script> tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). - CVE-2021-32719 (cross-site scripting) In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the rabbitmq_federation_management plugin, its consumer tag was rendered without proper <script> tag sanitization, potentially allowing for JavaScript code execution in the context of the page. Impact ====== Crafted user banes and federation links could be used to inject arbitrary JavaScript code into the management web UI. References ========== https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c3hj-r… https://github.com/rabbitmq/rabbitmq-server/pull/3028 https://github.com/rabbitmq/rabbitmq-server/commit/a7373585faeac0aaede5a9c2… https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5452-h… https://github.com/rabbitmq/rabbitmq-server/pull/3122 https://github.com/rabbitmq/rabbitmq-server/commit/08beb82e9ab8923ded88ece2… https://security.archlinux.org/CVE-2021-32718 https://security.archlinux.org/CVE-2021-32719

1 0

[ASA-202107-16] php7: multiple issues
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-16 ========================================== Severity: Medium Date : 2021-07-06 CVE-ID : CVE-2021-21704 CVE-2021-21705 Package : php7 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2133 Summary ======= The package php7 before version 7.4.21-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 7.4.21-1. # pacman -Syu "php7>=7.4.21-1" The problems have been fixed upstream in version 7.4.21. Workaround ========== None. Description =========== - CVE-2021-21704 (denial of service) Multiple bugs in the pdo_firebase module allow a malicious firebase server or man-in-the-middle attacker to crash PHP before versions 8.0.8 and 7.4.21. - CVE-2021-21705 (insufficient validation) A security issue was found in the php_url_parse_ex() function in PHP before versions 8.0.8 and 7.4.21, which leads to FILTER_VALIDATE_URL accepting URLs with invalid userinfo, a different issue from CVE-2020-7071. Impact ====== A remote user could bypass URL validation. Furthermore, a malicious firebase server or man-in-the-middle attacker could crash a PHP application. References ========== https://www.php.net/ChangeLog-8.php#8.0.8 https://www.php.net/ChangeLog-7.php#7.4.21 https://bugs.php.net/bug.php?id=76448 https://bugs.php.net/bug.php?id=76449 https://bugs.php.net/bug.php?id=76450 https://bugs.php.net/bug.php?id=76452 https://github.com/php/php-src/commit/1edd284cd56ce4c23f6fdf66050e4a722e651… https://github.com/php/php-src/commit/8cb87aabba0b2e284428aabca13401d1ad54b… https://github.com/php/php-src/commit/921f320ec2baabd24e5ff182d9fb73092eb28… https://github.com/php/php-src/commit/c8620a753114fac789016a4e6ae9c9b1210be… https://github.com/php/php-src/commit/1d4c3114afe8f7dde51f917cd14dc4600a3a4… https://github.com/php/php-src/commit/922ea3419923c74471f01ff8c6ea30f0a07d8… https://github.com/php/php-src/commit/08fc2960bccd4f04031d10099c82cf8d76cfa… https://github.com/php/php-src/commit/e92d5edeeeed809bc3a06b165e4f0a63bcabd… https://bugs.php.net/bug.php?id=81122 https://github.com/php/php-src/commit/5a1fe88ac120d71064bdd314dce1e49c86ff0… https://github.com/php/php-src/commit/5cea97e083448aaa2352320612541c895178b… https://security.archlinux.org/CVE-2021-21704 https://security.archlinux.org/CVE-2021-21705

1 0

[ASA-202107-15] php: multiple issues
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-15 ========================================== Severity: Medium Date : 2021-07-06 CVE-ID : CVE-2021-21704 CVE-2021-21705 Package : php Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2132 Summary ======= The package php before version 8.0.8-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 8.0.8-1. # pacman -Syu "php>=8.0.8-1" The problems have been fixed upstream in version 8.0.8. Workaround ========== None. Description =========== - CVE-2021-21704 (denial of service) Multiple bugs in the pdo_firebase module allow a malicious firebase server or man-in-the-middle attacker to crash PHP before versions 8.0.8 and 7.4.21. - CVE-2021-21705 (insufficient validation) A security issue was found in the php_url_parse_ex() function in PHP before versions 8.0.8 and 7.4.21, which leads to FILTER_VALIDATE_URL accepting URLs with invalid userinfo, a different issue from CVE-2020-7071. Impact ====== A remote user could bypass URL validation. Furthermore, a malicious firebase server or man-in-the-middle attacker could crash a PHP application. References ========== https://www.php.net/ChangeLog-8.php#8.0.8 https://www.php.net/ChangeLog-7.php#7.4.21 https://bugs.php.net/bug.php?id=76448 https://bugs.php.net/bug.php?id=76449 https://bugs.php.net/bug.php?id=76450 https://bugs.php.net/bug.php?id=76452 https://github.com/php/php-src/commit/1edd284cd56ce4c23f6fdf66050e4a722e651… https://github.com/php/php-src/commit/8cb87aabba0b2e284428aabca13401d1ad54b… https://github.com/php/php-src/commit/921f320ec2baabd24e5ff182d9fb73092eb28… https://github.com/php/php-src/commit/c8620a753114fac789016a4e6ae9c9b1210be… https://github.com/php/php-src/commit/1d4c3114afe8f7dde51f917cd14dc4600a3a4… https://github.com/php/php-src/commit/922ea3419923c74471f01ff8c6ea30f0a07d8… https://github.com/php/php-src/commit/08fc2960bccd4f04031d10099c82cf8d76cfa… https://github.com/php/php-src/commit/e92d5edeeeed809bc3a06b165e4f0a63bcabd… https://bugs.php.net/bug.php?id=81122 https://github.com/php/php-src/commit/5a1fe88ac120d71064bdd314dce1e49c86ff0… https://github.com/php/php-src/commit/5cea97e083448aaa2352320612541c895178b… https://security.archlinux.org/CVE-2021-21704 https://security.archlinux.org/CVE-2021-21705

1 0

[ASA-202107-14] openexr: arbitrary code execution
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-14 ========================================== Severity: Medium Date : 2021-07-06 CVE-ID : CVE-2021-3598 Package : openexr Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2071 Summary ======= The package openexr before version 3.0.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.0.5-1. # pacman -Syu "openexr>=3.0.5-1" The problem has been fixed upstream in version 3.0.5. Workaround ========== None. Description =========== A heap-buffer overflow was found in the readChars function of OpenEXR before version 3.0.5. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR. Impact ====== An attacker could execute arbitrary code through a crafted EXR image file. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1970987 https://github.com/AcademySoftwareFoundation/openexr/issues/1033 https://github.com/AcademySoftwareFoundation/openexr/pull/1037 https://github.com/AcademySoftwareFoundation/openexr/commit/b054116e57ebf62… https://security.archlinux.org/CVE-2021-3598

1 0

[ASA-202107-13] nodejs: multiple issues
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-13 ========================================== Severity: High Date : 2021-07-06 CVE-ID : CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 Package : nodejs Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2126 Summary ======= The package nodejs before version 16.4.1-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 16.4.1-1. # pacman -Syu "nodejs>=16.4.1-1" The problems have been fixed upstream in version 16.4.1. Workaround ========== None. Description =========== - CVE-2021-22918 (information disclosure) Node.js before versions 16.4.1, 14.17.2 and 12.22.2 is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. - CVE-2021-23362 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks. - CVE-2021-27290 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks. Impact ====== A remote attacker could disclose information by supplying crafted domain names, or cause denial of service through high resource usage with crafted Git repository URLs or Subresource Integrity (SRI) hashes. References ========== https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv… https://hackerone.com/reports/1209681 https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631… https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac… https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc09… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#npm-u… https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 https://github.com/npm/hosted-git-info/pull/76 https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f8… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#npm-u… https://github.com/advisories/GHSA-vx3p-948g-6vhq https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf https://github.com/npm/ssri/pull/17 https://github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2 https://security.archlinux.org/CVE-2021-22918 https://security.archlinux.org/CVE-2021-23362 https://security.archlinux.org/CVE-2021-27290

1 0

[ASA-202107-12] spice: multiple issues
by Jonas Witschel 09 Jul '21

09 Jul '21

Arch Linux Security Advisory ASA-202107-12 ========================================== Severity: Critical Date : 2021-07-06 CVE-ID : CVE-2020-14355 CVE-2021-20201 Package : spice Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1239 Summary ======= The package spice before version 0.15.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.15.0-1. # pacman -Syu "spice>=0.15.0-1" The problems have been fixed upstream in version 0.15.0. Workaround ========== None. Description =========== - CVE-2020-14355 (arbitrary code execution) Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system. More specifically, these flaws reside in the spice-common shared code between the client and server of SPICE. In other words, both the client (spice-gtk) and server are affected by these flaws. A malicious client or server could send specially crafted messages which could result in a process crash or potential code execution scenario. The issues have been fixed in spice (server) version 0.14.90 and spice-gtk (client) version 0.39. - CVE-2021-20201 (denial of service) An issue was discovered in SPICE server before version 0.15.0. There is a vulnerability which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection. Impact ====== A remote attacker could execute arbitrary code on the SPICE server using crafted messages, or cause high CPU consumption by performing many renegotiations. References ========== https://bugs.archlinux.org/task/68166 https://www.openwall.com/lists/oss-security/2020/10/06/10 https://gitlab.freedesktop.org/spice/spice-common/-/commit/762e0abae36033cc… https://gitlab.freedesktop.org/spice/spice-common/-/commit/404d74782c8b5e57… https://gitlab.freedesktop.org/spice/spice-common/-/commit/ef1b6ff7b82e15d7… https://gitlab.freedesktop.org/spice/spice-common/-/commit/b24fe6b66b86e601… https://gitlab.freedesktop.org/spice/spice/-/commit/4f71d0cdb79d2f61da49d43… https://gitlab.freedesktop.org/spice/spice-gtk/-/commit/df0d3f9d95fe8235b95… https://bugzilla.redhat.com/show_bug.cgi?id=1921846 https://gitlab.freedesktop.org/spice/spice/-/issues/49 https://gitlab.freedesktop.org/spice/spice/-/merge_requests/150 https://gitlab.freedesktop.org/spice/spice/-/commit/95a0cfac8a1c8eff50f05e6… https://gitlab.freedesktop.org/spice/spice/-/commit/ca5bbc5692e052159bce1a7… https://security.archlinux.org/CVE-2020-14355 https://security.archlinux.org/CVE-2021-20201

1 0

[ASA-202107-11] python-django: insufficient validation
by Jelle van der Waa 05 Jul '21

05 Jul '21

Arch Linux Security Advisory ASA-202107-11 ========================================== Severity: High Date : 2021-07-03 CVE-ID : CVE-2021-35042 Package : python-django Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-2123 Summary ======= The package python-django before version 3.2.5-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 3.2.5-1. # pacman -Syu "python-django>=3.2.5-1" The problem has been fixed upstream in version 3.2.5. Workaround ========== None. Description =========== A security issue has been found in Django before version 3.2.5. Unsanitized user input passed to QuerySet.order_by() could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted. As a mitigation the strict column reference validation was restored for the duration of the deprecation period. Impact ====== A remote attacker is able to perform a SQL injection via unsanitized user input passed to QuerySet.order_by(). References ========== https://docs.djangoproject.com/en/3.2/releases/3.2.5/#cve-2021-35042-potent… https://github.com/django/django/commit/a34a5f724c5d5adb2109374ba3989ebb7b1… https://security.archlinux.org/CVE-2021-35042

1 0

[ASA-202107-10] mruby: arbitrary code execution
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-10 ========================================== Severity: Medium Date : 2021-07-01 CVE-ID : CVE-2020-36401 Package : mruby Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2116 Summary ======= The package mruby before version 3.0.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.0.0-1. # pacman -Syu "mruby>=3.0.0-1" The problem has been fixed upstream in version 3.0.0. Workaround ========== None. Description =========== mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free). Impact ====== An attacker could execute arbitrary code through a use after free. References ========== https://github.com/google/oss-fuzz-vulns/blob/main/vulns/mruby/OSV-2020-744… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23801 https://github.com/mruby/mruby/commit/97319697c8f9f6ff27b32589947e1918e3015… https://security.archlinux.org/CVE-2020-36401

1 0

[ASA-202107-9] libtpms: information disclosure
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-9 ========================================= Severity: Medium Date : 2021-07-01 CVE-ID : CVE-2021-3623 Package : libtpms Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-2108 Summary ======= The package libtpms before version 0.8.4-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 0.8.4-1. # pacman -Syu "libtpms>=0.8.4-1" The problem has been fixed upstream in version 0.8.4. Workaround ========== None. Description =========== A security issue was found in libtpms before version 0.8.4. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. Impact ====== An attacker could disclose sensitive information about the state of the TPM through crafted command packets. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1976806 https://github.com/stefanberger/libtpms/pull/223 https://github.com/stefanberger/libtpms/pull/225 https://github.com/stefanberger/libtpms/commit/f16250b35aff6995e540143a9858… https://github.com/stefanberger/libtpms/commit/3ef9b26cb9f28bd64d738bff9505… https://github.com/stefanberger/libtpms/commit/5cc98a62dc6f204dcf5b87c2ee83… https://security.archlinux.org/CVE-2021-3623

1 0

[ASA-202107-8] puppet: privilege escalation
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-8 ========================================= Severity: Medium Date : 2021-07-01 CVE-ID : CVE-2021-27021 Package : puppet Type : privilege escalation Remote : Yes Link : https://security.archlinux.org/AVG-2105 Summary ======= The package puppet before version 6.23.0-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 6.23.0-1. # pacman -Syu "puppet>=6.23.0-1" The problem has been fixed upstream in version 6.23.0. Workaround ========== None. Description =========== A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query. This has been resolved in Puppet DB 6.17.0, 7.4.1, Platform 6.23, 7.7.0 and Puppet Enterprise 2021.2, 2019.8.7. Impact ====== A privilege escalation security issue allowed users to delete tables. References ========== https://puppet.com/security/cve/cve-2021-27021/ https://puppet.com/docs/puppetdb/6/release_notes.html#puppetdb-6170 https://tickets.puppetlabs.com/browse/PDB-5138 https://github.com/puppetlabs/puppetdb/commit/c146e624d230f7410fb648d58ae28… https://github.com/puppetlabs/puppetdb/commit/f8dc81678cf347739838e42cc1c42… https://github.com/puppetlabs/puppetdb/commit/72bd137511487643a3a6236ad9e72… https://security.archlinux.org/CVE-2021-27021

1 0