- Arch-security - lists.archlinux.org

[ASA-202107-7] mediawiki: access restriction bypass
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-7 ========================================= Severity: Medium Date : 2021-07-01 CVE-ID : CVE-2021-35197 Package : mediawiki Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-2093 Summary ======= The package mediawiki before version 1.36.1-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 1.36.1-1. # pacman -Syu "mediawiki>=1.36.1-1" The problem has been fixed upstream in version 1.36.1. Workaround ========== None. Description =========== A security issue has been found in MediaWiki before version 1.36.1 that allows blocked users to purge pages. Impact ====== Blocked users could purge pages. References ========== https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikime… https://phabricator.wikimedia.org/T280226 https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/7fc84bbd23c… https://security.archlinux.org/CVE-2021-35197

1 0

[ASA-202107-6] python-fastapi: cross-site request forgery
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-6 ========================================= Severity: Medium Date : 2021-07-01 CVE-ID : CVE-2021-32677 Package : python-fastapi Type : cross-site request forgery Remote : Yes Link : https://security.archlinux.org/AVG-2060 Summary ======= The package python-fastapi before version 0.65.2-1 is vulnerable to cross-site request forgery. Resolution ========== Upgrade to 0.65.2-1. # pacman -Syu "python-fastapi>=0.65.2-1" The problem has been fixed upstream in version 0.65.2. Workaround ========== To mitigate the issue, it would be possible to add a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type. Description =========== FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). So, a request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. But requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. Impact ====== A remote attacker could perform cross-origin request forgery (CSRF) attacks on FastAPI applications accepting JSON payloads. References ========== https://github.com/tiangolo/fastapi/security/advisories/GHSA-8h2j-cgx8-6xv7 https://github.com/tiangolo/fastapi/pull/2118 https://github.com/tiangolo/fastapi/commit/fa7e3c996edf2d5482fff8f9d890ac23… https://security.archlinux.org/CVE-2021-32677

1 0

[ASA-202107-5] jenkins: multiple issues
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-5 ========================================= Severity: High Date : 2021-07-01 CVE-ID : CVE-2021-21670 CVE-2021-21671 Package : jenkins Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2118 Summary ======= The package jenkins before version 2.300-1 is vulnerable to multiple issues including authentication bypass and access restriction bypass. Resolution ========== Upgrade to 2.300-1. # pacman -Syu "jenkins>=2.300-1" The problems have been fixed upstream in version 2.300. Workaround ========== As a workaround for CVE-2021-21670, do not grant Item/Cancel permission to users who do not have Item/Read permission. No known workaround exists for CVE-2021-21671. Description =========== - CVE-2021-21670 (access restriction bypass) Jenkins 2.299 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission. Jenkins 2.300 requires that users have Item/Read permission for applicable types in addition to Item/Cancel permission. As a workaround on earlier versions of Jenkins, do not grant Item/Cancel permission to users who do not have Item/Read permission. - CVE-2021-21671 (authentication bypass) Jenkins 2.299 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. Jenkins 2.300 invalidates the existing session on login. Impact ====== A remote attacker could login into an expired user session. Additionally, users could cancel queue items and abort builds for which they do not have Item/Read permission. References ========== https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2278 https://github.com/jenkinsci/jenkins/commit/86b7d7e789586575522650c60d59160… https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2371 https://github.com/jenkinsci/jenkins/commit/25a42f3942fd9f8bd768c887c679dbc… https://security.archlinux.org/CVE-2021-21670 https://security.archlinux.org/CVE-2021-21671

1 0

[ASA-202107-4] opera: arbitrary code execution
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-4 ========================================= Severity: High Date : 2021-07-01 CVE-ID : CVE-2021-30554 CVE-2021-30555 CVE-2021-30556 CVE-2021-30557 Package : opera Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2083 Summary ======= The package opera before version 77.0.4054.146-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 77.0.4054.146-1. # pacman -Syu "opera>=77.0.4054.146-1" The problems have been fixed upstream in version 77.0.4054.146. Workaround ========== None. Description =========== - CVE-2021-30554 (arbitrary code execution) A use after free security issue has been found in the WebGL component of the Chromium browser engine before version 91.0.4472.114. Google is aware that an exploit for CVE-2021-30554 exists in the wild. - CVE-2021-30555 (arbitrary code execution) A use after free security issue has been found in the Sharing component of the Chromium browser engine before version 91.0.4472.114. - CVE-2021-30556 (arbitrary code execution) A use after free security issue has been found in the WebAudio component of the Chromium browser engine before version 91.0.4472.114. - CVE-2021-30557 (arbitrary code execution) A use after free security issue has been found in the TabGroups component of the Chromium browser engine before version 91.0.4472.114. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://blogs.opera.com/desktop/changelog-for-77/ https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1219857 https://crbug.com/1215029 https://crbug.com/1212599 https://crbug.com/1202102 https://security.archlinux.org/CVE-2021-30554 https://security.archlinux.org/CVE-2021-30555 https://security.archlinux.org/CVE-2021-30556 https://security.archlinux.org/CVE-2021-30557

1 0

[ASA-202107-3] istio: information disclosure
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-3 ========================================= Severity: Critical Date : 2021-07-01 CVE-ID : CVE-2021-34824 Package : istio Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2113 Summary ======= The package istio before version 1.10.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.10.2-1. # pacman -Syu "istio>=1.10.2-1" The problem has been fixed upstream in version 1.10.2. Workaround ========== This vulnerability can be mitigated by disabling Istiod caching. Caching is disabled by setting an Istiod environment variable PILOT_ENABLE_XDS_CACHE=false. System and Istiod performance may be impacted as this disables XDS caching. Description =========== Istio before version 1.10.2 contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces. The Istio Gateway and DestinationRule can load private keys and certificates from Kubernetes secrets via the credentialName configuration. For Istio 1.8 and above, the secrets are conveyed from Istiod to gateways or workloads via the XDS API. In the above approach, a gateway or workload deployment should only be able to access credentials (TLS certificates and private keys) stored in the Kubernetes secrets within its namespace. However, a bug in Istiod permits an authorized client the ability to access and retrieve any TLS certificate and private key cached in Istiod. Impact ====== An authorized client could retrieve any TLS certificate and private key cached in Istiod outside of its own namespace. References ========== https://istio.io/latest/news/security/istio-security-2021-007/ https://github.com/istio/istio/commit/10674c9a86ece93dcd40efd8e4b9147bc8604… https://github.com/istio/istio/commit/f58f789f8e0d1580d00b68b76b1132163939b… https://security.archlinux.org/CVE-2021-34824

1 0

[ASA-202107-2] electron11: multiple issues
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-2 ========================================= Severity: Critical Date : 2021-07-01 CVE-ID : CVE-2021-30544 CVE-2021-30548 CVE-2021-30551 Package : electron11 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2099 Summary ======= The package electron11 before version 11.4.9-1 is vulnerable to multiple issues including arbitrary code execution and incorrect calculation. Resolution ========== Upgrade to 11.4.9-1. # pacman -Syu "electron11>=11.4.9-1" The problems have been fixed upstream in version 11.4.9. Workaround ========== None. Description =========== - CVE-2021-30544 (arbitrary code execution) A use after free security issue has been found in the BFCache component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30548 (arbitrary code execution) A use after free security issue has been found in the Loader component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30551 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 91.0.4472.101. Google is aware that an exploit for CVE-2021-30551 exists in the wild. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://www.electronjs.org/releases/stable?version=11#11.4.9 https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1212618 https://crbug.com/1210487 https://crbug.com/1216437 https://security.archlinux.org/CVE-2021-30544 https://security.archlinux.org/CVE-2021-30548 https://security.archlinux.org/CVE-2021-30551

1 0

[ASA-202107-1] electron12: arbitrary code execution
by Jonas Witschel 03 Jul '21

03 Jul '21

Arch Linux Security Advisory ASA-202107-1 ========================================= Severity: High Date : 2021-07-01 CVE-ID : CVE-2021-30547 CVE-2021-30553 CVE-2021-30554 Package : electron12 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2112 Summary ======= The package electron12 before version 12.0.13-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 12.0.13-1. # pacman -Syu "electron12>=12.0.13-1" The problems have been fixed upstream in version 12.0.13. Workaround ========== None. Description =========== - CVE-2021-30547 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30553 (arbitrary code execution) A use after free security issue has been found in the Network service component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30554 (arbitrary code execution) A use after free security issue has been found in the WebGL component of the Chromium browser engine before version 91.0.4472.114. Google is aware that an exploit for CVE-2021-30554 exists in the wild. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://github.com/electron/electron/releases/tag/v12.0.13 https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1210414 https://crbug.com/1209769 https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1219857 https://security.archlinux.org/CVE-2021-30547 https://security.archlinux.org/CVE-2021-30553 https://security.archlinux.org/CVE-2021-30554

1 0

[ASA-202106-57] pigeonhole: denial of service
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-57 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2020-28200 Package : pigeonhole Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2088 Summary ======= The package pigeonhole before version 0.5.15-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.5.15-1. # pacman -Syu "pigeonhole>=0.5.15-1" The problem has been fixed upstream in version 0.5.15. Workaround ========== Disabling the regex sieve extension avoids the worst problems. lmtp_user_concurrency_limit may also be helpful. Description =========== A security issue has been found in Pigeonhole before version 0.5.15. The Sieve interpreter is not protected against abusive scripts that claim excessive resource usage, especially scripts using massive amounts of regexps. This means an attacker can cause a denial of service of the mail delivery system by using excessive amount of CPU and/or reaching the lmtp/lda process limits. Impact ====== A user could consume an excessive amount of CPU resources through crafted Sieve scripts. References ========== https://dovecot.org/pipermail/dovecot-news/2021-June/000458.html https://dovecot.org/pipermail/dovecot-news/2021-June/000460.html https://github.com/dovecot/pigeonhole/commit/68505e444f91ebd784d419a8c11f1b… https://security.archlinux.org/CVE-2020-28200

1 0

[ASA-202106-56] dovecot: information disclosure
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-56 ========================================== Severity: High Date : 2021-06-22 CVE-ID : CVE-2021-29157 CVE-2021-33515 Package : dovecot Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2087 Summary ======= The package dovecot before version 2.3.15-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.3.15-1. # pacman -Syu "dovecot>=2.3.15-1" The problems have been fixed upstream in version 2.3.15. Workaround ========== CVE-2021-29157 can be mitigated by disabling local JWT validation in oauth2, or using a different dict driver than fs:posix. No known workaround exists for CVE-2021-33515. Description =========== - CVE-2021-29157 (information disclosure) A security issue has been found in Dovecot before version 2.3.14.1. The kid and azp fields in JWT tokens are not correctly escaped. This may be used to supply attacker controlled keys to validate tokens in some configurations. The attack requires an attacker to be able to write files to the local disk. As a result, a local attacker can login as any user and access their emails. - CVE-2021-33515 (information disclosure) A security issue has been found in Dovecot before version 2.3.14.1. An on-path attacker could inject plaintext commands before the STARTTLS negotiation that would be executed after STARTTLS finished with the client. Only the SMTP submission service is affected. As a result, an attacker can potentially steal user credentials and emails. The attacker needs to have sending permissions on the submission server (a valid username and password). Impact ====== A remote authenticated attacker or a local attacker with write access to the disk could disclose user credentials and emails. References ========== https://dovecot.org/pipermail/dovecot-news/2021-June/000461.html https://github.com/dovecot/core/commit/7f06f6274437ea97142df1f64f322b3ced44… https://github.com/dovecot/core/commit/7a77e070ddb6a67fe7a40118ba3e3f9b6062… https://github.com/dovecot/core/commit/bae4e44596d6548322665d242b055f44fe1d… https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html https://github.com/dovecot/core/commit/65bd1a27a361545c9ccf405b955c72a9c4d2… https://security.archlinux.org/CVE-2021-29157 https://security.archlinux.org/CVE-2021-33515

1 0

[ASA-202106-55] tpm2-tools: man-in-the-middle
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-55 ========================================== Severity: Low Date : 2021-06-22 CVE-ID : CVE-2021-3565 Package : tpm2-tools Type : man-in-the-middle Remote : No Link : https://security.archlinux.org/AVG-1986 Summary ======= The package tpm2-tools before version 5.1.1-1 is vulnerable to man-in- the-middle. Resolution ========== Upgrade to 5.1.1-1. # pacman -Syu "tpm2-tools>=5.1.1-1" The problem has been fixed upstream in version 5.1.1. Workaround ========== None. Description =========== A security issue was found in tpm2-tools before version 5.1.1. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a man-in-the-middle (MITM) attacker to unwrap the inner portion and reveal the key being imported. Impact ====== A local attacker could disclose the secret portion of a key while it is being imported into the TPM. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1964427 https://github.com/tpm2-software/tpm2-tools/issues/2738 https://github.com/tpm2-software/tpm2-tools/pull/2739 https://github.com/tpm2-software/tpm2-tools/commit/47b3b6e6fffed7080a2f1ce7… https://security.archlinux.org/CVE-2021-3565

1 0