- Arch-security - lists.archlinux.org

[ASA-202106-22] thunderbird: arbitrary code execution
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-22 ========================================== Severity: High Date : 2021-06-09 CVE-ID : CVE-2021-29967 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2035 Summary ======= The package thunderbird before version 78.11.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 78.11.0-1. # pacman -Syu "thunderbird>=78.11.0-1" The problem has been fixed upstream in version 78.11.0. Workaround ========== None. Description =========== Mozilla developers reported memory safety bugs present in Firefox 88 and Thunderbird 78.10. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker could execute arbitrary code using a crafted email message. References ========== https://www.mozilla.org/security/advisories/mfsa2021-23/ https://www.mozilla.org/security/advisories/mfsa2021-26/ https://bugzilla.mozilla.org/buglist.cgi?bug_id=1602862%2C1703191%2C1703760… https://security.archlinux.org/CVE-2021-29967

1 0

[ASA-202106-21] gitlab: multiple issues
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-21 ========================================== Severity: High Date : 2021-06-09 CVE-ID : CVE-2021-22181 CVE-2021-22213 CVE-2021-22214 CVE-2021-22216 CVE-2021-22217 CVE-2021-22218 CVE-2021-22219 CVE-2021-22220 CVE-2021-22221 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2023 Summary ======= The package gitlab before version 13.12.2-1 is vulnerable to multiple issues including denial of service, information disclosure, access restriction bypass, authentication bypass, cross-site scripting and content spoofing. Resolution ========== Upgrade to 13.12.2-1. # pacman -Syu "gitlab>=13.12.2-1" The problems have been fixed upstream in version 13.12.2. Workaround ========== None. Description =========== - CVE-2021-22181 (denial of service) A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 before 13.12.2 allows an attacker to create a recursive pipeline relationship and exhaust resources. - CVE-2021-22213 (information disclosure) A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 before 13.12.2 allowed an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari. - CVE-2021-22214 (access restriction bypass) When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 before 13.12.2 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited. - CVE-2021-22216 (denial of service) A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2 allows an attacker to cause uncontrolled resource consumption with a very long issue or merge request description. - CVE-2021-22217 (denial of service) A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request. - CVE-2021-22218 (content spoofing) All versions of GitLab CE/EE starting with 12.8 before 13.12.2 were affected by an issue in the handling of x509 certificates that could be used to spoof author of signed commits. - CVE-2021-22219 (information disclosure) GitLab CE/EE since version 9.5 before 13.12.2 allows a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly registered for log masking. - CVE-2021-22220 (cross-site scripting) An issue has been discovered in GitLab affecting all versions starting with 13.10 before 13.12.2. GitLab was vulnerable to a stored cross-site scripting (XSS) attack in the blob viewer of notebooks. - CVE-2021-22221 (authentication bypass) An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.12.2. Insufficient expired password validation in various operations allowed users to maintain limited access after their password expired. Impact ====== A remote attacker could disclose sensitive information, bypass authentication, execute JavaScript code using cross-site scripting, spoof content or crash the GitLab server. References ========== https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-… https://gitlab.com/gitlab-org/gitlab/-/issues/300308 https://hackerone.com/reports/1089277 https://gitlab.com/gitlab-org/gitlab/-/issues/322926 https://hackerone.com/reports/1110131 https://gitlab.com/gitlab-org/gitlab/-/issues/329890 https://gitlab.com/gitlab-org/gitlab/-/issues/300709 https://hackerone.com/reports/1090049 https://gitlab.com/gitlab-org/gitlab/-/issues/297665 https://hackerone.com/reports/1077019 https://gitlab.com/gitlab-org/gitlab/-/issues/296995 https://gitlab.com/gitlab-org/gitlab/-/issues/294128 https://hackerone.com/reports/1060114 https://gitlab.com/gitlab-org/gitlab/-/issues/292006 https://security.archlinux.org/CVE-2021-22181 https://security.archlinux.org/CVE-2021-22213 https://security.archlinux.org/CVE-2021-22214 https://security.archlinux.org/CVE-2021-22216 https://security.archlinux.org/CVE-2021-22217 https://security.archlinux.org/CVE-2021-22218 https://security.archlinux.org/CVE-2021-22219 https://security.archlinux.org/CVE-2021-22220 https://security.archlinux.org/CVE-2021-22221

1 0

[ASA-202106-20] inetutils: arbitrary code execution
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-20 ========================================== Severity: High Date : 2021-06-09 CVE-ID : CVE-2019-0053 CVE-2020-10188 Package : inetutils Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1003 Summary ======= The package inetutils before version 2.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.0-1. # pacman -Syu "inetutils>=2.0-1" The problems have been fixed upstream in version 2.0. Workaround ========== None. Description =========== - CVE-2019-0053 (arbitrary code execution) inetutils before version 1.9.4.90 contains a stack overflow vulnerability in the client-side environment variable handling which can be exploited to escape restricted shells on embedded devices. A stack-based overflow is present in the handling of environment variables when connecting telnet.c to remote telnet servers through oversized DISPLAY arguments. - CVE-2020-10188 (arbitrary code execution) A vulnerability was found in inetutils before version 1.9.4.91 where incorrect bounds checks in the telnet server’s (telnetd) handling of short writes and urgent data could lead to information disclosure and corruption of heap data. An unauthenticated remote attacker could exploit these bugs by sending specially crafted telnet packets to achieve arbitrary code execution in the telnet server. Impact ====== Requesting environment variables with crafted contents could lead to arbitrary code execution in a telnet client. Additionally an unauthenticated remote attacker could execute arbitrary code on a telnet server via crafted packets. References ========== https://bugs.archlinux.org/task/70040 https://raw.githubusercontent.com/hackerhouse-opensource/exploits/master/in… https://git.savannah.gnu.org/gitweb/?p=inetutils.git;a=commitdiff;h=1480573… https://git.savannah.gnu.org/gitweb/?p=inetutils.git;a=commitdiff;h=07fdb42… https://bugzilla.redhat.com/show_bug.cgi?id=1811673 https://git.savannah.gnu.org/gitweb/?p=inetutils.git;a=commitdiff;h=cd7e7e6… https://security.archlinux.org/CVE-2019-0053 https://security.archlinux.org/CVE-2020-10188

1 0

[ASA-202106-19] keycloak: incorrect calculation
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-19 ========================================== Severity: Low Date : 2021-06-01 CVE-ID : CVE-2021-3461 Package : keycloak Type : incorrect calculation Remote : Yes Link : https://security.archlinux.org/AVG-1994 Summary ======= The package keycloak before version 13.0.1-1 is vulnerable to incorrect calculation. Resolution ========== Upgrade to 13.0.1-1. # pacman -Syu "keycloak>=13.0.1-1" The problem has been fixed upstream in version 13.0.1. Workaround ========== None. Description =========== Keycloak may fail to logout a user session if the logout request comes from an external SAML identity provider that is set up to identify the principal via attributes rather than by Subject Name ID. Impact ====== A remote attacker could take over a logged out user session if they manage to obtain the old session token. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1941565 https://issues.redhat.com/browse/KEYCLOAK-17495 https://github.com/keycloak/keycloak/commit/f014299e7c781dff2b492b81bc81adc… https://security.archlinux.org/CVE-2021-3461

1 0

[ASA-202106-18] packagekit: information disclosure
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-18 ========================================== Severity: Low Date : 2021-06-01 CVE-ID : CVE-2020-16121 Package : packagekit Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1260 Summary ======= The package packagekit before version 1.2.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.2.3-1. # pacman -Syu "packagekit>=1.2.3-1" The problem has been fixed upstream in version 1.2.3. Workaround ========== None. Description =========== The InstallFiles, GetFilesLocal and GetDetailsLocal methods of the DBus interface to PackageKit <= 1.1.13 access files before checking for authorization. This allows non-privileged users to learn the MIME type of any file on the system. Impact ====== A non-privileged local attacker could learn the MIME type of any file on the system. References ========== https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887 https://github.com/hughsie/PackageKit/commit/d5e8c59745bf7c521c6f311e6b22b4… https://security.archlinux.org/CVE-2020-16121

1 0

[ASA-202106-17] rabbitmq: denial of service
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-17 ========================================== Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2021-22116 Package : rabbitmq Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1966 Summary ======= The package rabbitmq before version 3.8.16-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.8.16-1. # pacman -Syu "rabbitmq>=3.8.16-1" The problem has been fixed upstream in version 3.8.16. Workaround ========== None. Description =========== RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. An attacker can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled. Impact ====== A remote attacker could crash the RabbitMQ server through crafted AMQP messages. References ========== https://tanzu.vmware.com/security/cve-2021-22116 https://security.archlinux.org/CVE-2021-22116

1 0

[ASA-202106-16] pam-u2f: authentication bypass
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-16 ========================================== Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2021-31924 Package : pam-u2f Type : authentication bypass Remote : No Link : https://security.archlinux.org/AVG-2001 Summary ======= The package pam-u2f before version 1.1.1-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 1.1.1-1. # pacman -Syu "pam-u2f>=1.1.1-1" The problem has been fixed upstream in version 1.1.1. Workaround ========== None. Description =========== Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature verification to be bypassed, so an attacker would still need to physically possess and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN requirement is bypassed. Impact ====== A local attacker could authenticate with a U2F device without having to enter the correct PIN. References ========== https://www.yubico.com/support/security-advisories/ysa-2021-03/ https://github.com/Yubico/pam-u2f/issues/175 https://github.com/Yubico/pam-u2f/pull/180 https://github.com/Yubico/pam-u2f/commit/6059b057dd9b6d0164fc16f9422c0d728f… https://github.com/Yubico/pam-u2f/commit/1ffd435c9c26e8c3122ea121d3e0b55cb8… https://security.archlinux.org/CVE-2021-31924

1 0

[ASA-202106-15] postgresql: multiple issues
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-15 ========================================== Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2021-32027 CVE-2021-32028 CVE-2021-32029 Package : postgresql Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1956 Summary ======= The package postgresql before version 13.3-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 13.3-1. # pacman -Syu "postgresql>=13.3-1" The problems have been fixed upstream in version 13.3. Workaround ========== None. Description =========== - CVE-2021-32027 (arbitrary code execution) A security issue was found in PostgreSQL before version 13.3. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. - CVE-2021-32028 (information disclosure) A security issue was found in PostgreSQL before version 13.3. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas cannot use this attack at will. - CVE-2021-32029 (information disclosure) A security issue was found in PostgreSQL before version 13.3. Using an UPDATE ... RETURNING on a purpose-crafted partitioned table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can create prerequisite objects and complete this attack at will. A user lacking the CREATE and TEMPORARY privileges on all databases and the CREATE privilege on all schemas typically cannot use this attack at will. Impact ====== An authenticated remote attacker could read the database server memory or execute arbitrary code on the server. References ========== https://www.postgresql.org/support/security/CVE-2021-32027/ https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=467395bf… https://www.postgresql.org/support/security/CVE-2021-32028/ https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=4a8656a7… https://www.postgresql.org/support/security/CVE-2021-32029/ https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=a71cfc56… https://security.archlinux.org/CVE-2021-32027 https://security.archlinux.org/CVE-2021-32028 https://security.archlinux.org/CVE-2021-32029

1 0

[ASA-202106-14] ruby-bundler: insufficient validation
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-14 ========================================== Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2020-36327 Package : ruby-bundler Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1891 Summary ======= The package ruby-bundler before version 2.2.18-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 2.2.18-1. # pacman -Syu "ruby-bundler>=2.2.18-1" The problem has been fixed upstream in version 2.2.18. Workaround ========== None. Description =========== Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. Impact ====== A remote attacker could replace a private gem in a project with a public gem under their control with a higher version number. References ========== https://github.com/rubygems/rubygems/issues/3982 https://github.com/rubygems/rubygems/pull/4609 https://github.com/rubygems/rubygems/commit/d68d3cdb9cc69f648f87e5d3f258816… https://security.archlinux.org/CVE-2020-36327

1 0

[ASA-202106-13] zint: arbitrary code execution
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-13 ========================================== Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2021-27799 Package : zint Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1625 Summary ======= The package zint before version 2.9.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.9.1-2. # pacman -Syu "zint>=2.9.1-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== ean_leading_zeroes in backend/upcean.c in Zint Barcode Generator 2.9.1 has a stack-based buffer overflow that is reachable from the C API through an application that includes the Zint Barcode Generator library code. Impact ====== An attacker could execute arbitrary code by supplying crafted input to generate an EAN barcode. References ========== https://bugs.archlinux.org/task/70051 https://sourceforge.net/p/zint/tickets/218/ https://sourceforge.net/p/zint/code/ci/7f8c8114f31c09a986597e0ba63a49f96150… https://security.archlinux.org/CVE-2021-27799

1 0