- Arch-security - lists.archlinux.org

[ASA-202204-7] gzip: arbitrary command execution
by Levente Polyak 12 Apr '22

12 Apr '22

Arch Linux Security Advisory ASA-202204-7 ========================================= Severity: High Date : 2022-04-07 CVE-ID : CVE-2022-1271 Package : gzip Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-2666 Summary ======= The package gzip before version 1.12-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 1.12-1. # pacman -Syu "gzip>=1.12-1" The problem has been fixed upstream in version 1.12. Workaround ========== None. Description =========== Malicious filenames with two or more newlines can make zgrep and xzgrep to write to arbitrary files or (with a GNU sed extension) lead to arbitrary code execution. The issue with the old code is that with multiple newlines, the N-command will read the second line of input, then the s-commands will be skipped because it's not the end of the file yet, then a new sed cycle starts and the pattern space is printed and emptied. So only the last line or two get escaped. Impact ====== An attacker is able to provide malicious filenames to write to arbitrary files or execute arbitrary commands on the affected host. References ========== https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=dc9740df61e575e8c3148… https://savannah.gnu.org/forum/forum.php?forum_id=10157 https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f… https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch.sig https://security.archlinux.org/CVE-2022-1271

1 0

[ASA-202204-6] libtiff: multiple issues
by Levente Polyak 07 Apr '22

07 Apr '22

Arch Linux Security Advisory ASA-202204-6 ========================================= Severity: High Date : 2022-04-05 CVE-ID : CVE-2022-0561 CVE-2022-0562 CVE-2022-0865 CVE-2022-0891 CVE-2022-0907 CVE-2022-0908 CVE-2022-0909 CVE-2022-0924 CVE-2022-22844 Package : libtiff Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2658 Summary ======= The package libtiff before version 4.3.0-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 4.3.0-2. # pacman -Syu "libtiff>=4.3.0-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2022-0561 (denial of service) Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. - CVE-2022-0562 (denial of service) Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. - CVE-2022-0865 (denial of service) Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-0891 (arbitrary code execution) A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact. - CVE-2022-0907 (denial of service) Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-0908 (denial of service) Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file. - CVE-2022-0909 (denial of service) A division by zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-0924 (denial of service) Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. - CVE-2022-22844 (denial of service) LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field. Impact ====== A remote attacker is able to crash the application or execute arbitrary code on the affected host via a crafted tiff file. References ========== https://bugs.archlinux.org/task/74229 https://gitlab.com/libtiff/libtiff/-/issues/362 https://gitlab.com/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a… https://gitlab.com/libtiff/libtiff/-/commit/561599c99f987dc32ae110370cfdd7d… https://gitlab.com/libtiff/libtiff/-/issues/385 https://gitlab.com/libtiff/libtiff/-/merge_requests/306 https://gitlab.com/libtiff/libtiff/-/commit/a1c933dabd0e1c54a412f3f84ae0aa5… https://gitlab.com/libtiff/libtiff/-/issues/380 https://gitlab.com/libtiff/libtiff/-/issues/382 https://gitlab.com/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb… https://gitlab.com/libtiff/libtiff/-/issues/392 https://gitlab.com/libtiff/libtiff/-/merge_requests/314 https://gitlab.com/libtiff/libtiff/-/commit/40b00cfb32256d377608b4d4cd30fac… https://gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f8… https://gitlab.com/libtiff/libtiff/-/issues/383 https://gitlab.com/libtiff/libtiff/-/issues/393 https://gitlab.com/libtiff/libtiff/-/merge_requests/310 https://gitlab.com/libtiff/libtiff/-/commit/32ea0722ee68f503b7a3f9b2d557acb… https://gitlab.com/libtiff/libtiff/-/issues/278 https://gitlab.com/libtiff/libtiff/-/merge_requests/311 https://gitlab.com/libtiff/libtiff/-/commit/88d79a45a31c74cba98c697892fed5f… https://gitlab.com/libtiff/libtiff/-/issues/355 https://gitlab.com/libtiff/libtiff/-/merge_requests/287 https://gitlab.com/libtiff/libtiff/-/commit/03047a26952a82daaa0792957ce211e… https://security.archlinux.org/CVE-2022-0561 https://security.archlinux.org/CVE-2022-0562 https://security.archlinux.org/CVE-2022-0865 https://security.archlinux.org/CVE-2022-0891 https://security.archlinux.org/CVE-2022-0907 https://security.archlinux.org/CVE-2022-0908 https://security.archlinux.org/CVE-2022-0909 https://security.archlinux.org/CVE-2022-0924 https://security.archlinux.org/CVE-2022-22844

1 0

[ASA-202204-5] bind: multiple issues
by Levente Polyak 07 Apr '22

07 Apr '22

Arch Linux Security Advisory ASA-202204-5 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-25220 CVE-2022-0396 CVE-2022-0635 CVE-2022-0667 Package : bind Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2661 Summary ======= The package bind before version 9.18.1-1 is vulnerable to multiple issues including denial of service and content spoofing. Resolution ========== Upgrade to 9.18.1-1. # pacman -Syu "bind>=9.18.1-1" The problems have been fixed upstream in version 9.18.1. Workaround ========== - CVE-2021-25220 If applicable, modify your configuration to either remove all forwarding or all possibility of recursion. Depending on your use-case, it may be possible to use other zone types to replace forward zones. - CVE-2022-0396 use the default setting of keep-response-order { none; }. - CVE-2022-0635 The failure can be avoided by adding this option to named.conf: synth-from-dnssec no; However we do not recommend disabling this feature other than as a temporary workaround because it provides protection from pseudo-random- subdomain attacks against DNSSEC-signed zones. Description =========== - CVE-2021-25220 (content spoofing) When using forwarders in BIND, bogus NS records supplied by, or via, those forwarders may be cached and used by named if it needs to recurse for any reason, causing it to obtain and pass on potentially incorrect answers. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients. Authoritative-only BIND 9 servers are not vulnerable to this flaw. - CVE-2022-0396 (denial of service) ISC recently discovered an issue in BIND that allows TCP connection slots to be consumed for an indefinite time frame via a specifically crafted TCP stream sent from a client. This issue is present in BIND 9.16.11 to 9.16.26 (including S editions), and 9.18.0. This issue can only be triggered on BIND servers which have keep- response-order enabled, which is not the default configuration. The keep-response-order option is an ACL block; any hosts which are specified within it will be able to trigger this issue on affected versions. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection. - CVE-2022-0635 (denial of service) BIND 9.18.0 stable release refactored the RFC 8198 Aggressive Use of DNSSEC-Validated Cache feature (synth-from-dnssec) and changed the default so that is now automatically enabled for dnssec-validating resolvers. Subsequently it was found that repeated patterns of specific queries to servers with this feature enabled could cause an INSIST failure in query.c:query_dname which causes named to terminate unexpectedly. The vulnerability affects BIND resolvers running 9.18.0 that have both dnssec-validation and synth-from-dnssec enabled. (Note that dnssec- validation auto; is the default setting unless configured otherwise in named.conf and that enabling dnssec-validation automatically enables synth-from-dnssec unless explicitly disabled) When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check. - CVE-2022-0667 (denial of service) In BIND 9.18.0 the recursive client code was refactored that introduced a "backstop lifetime timer". While BIND is processing a request for a DS record that needs to be forwarded, it waits until this processing is complete or until the backstop lifetime timer has timed out. When the resume_dslookup() function is called as a result of such a timeout, the function does not test whether the fetch has previously been shut down. This introduces the possibility of triggering an assertion failure, which could cause the BIND process to terminate. Impact ====== A remote attacker is able to crash the application or force TCP connections to BIND to remain in CLOSE_WAIT status leading to denial of service on the affected host. Furthermore the cache could become poisoned leading to queries being made to the wrong servers, which might also result in false information being returned to clients. References ========== https://kb.isc.org/docs/cve-2021-25220 https://gitlab.isc.org/isc-projects/bind9/-/commit/fc9cb6cf91c1a36b797ffef0… https://kb.isc.org/docs/cve-2022-0396 https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5987 https://gitlab.isc.org/isc-projects/bind9/-/commit/ae7fa0a3082d1b97b1123a96… https://kb.isc.org/docs/cve-2022-0635 https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5988 https://gitlab.isc.org/isc-projects/bind9/-/commit/71dd44339f4cf616e514cefa… https://kb.isc.org/docs/cve-2022-0667 https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5989 https://gitlab.isc.org/isc-projects/bind9/-/commit/7ba3a069355875409fadd0da… https://security.archlinux.org/CVE-2021-25220 https://security.archlinux.org/CVE-2022-0396 https://security.archlinux.org/CVE-2022-0635 https://security.archlinux.org/CVE-2022-0667

1 0

[ASA-202204-4] rizin: multiple issues
by Levente Polyak 05 Apr '22

05 Apr '22

Arch Linux Security Advisory ASA-202204-4 ========================================= Severity: Medium Date : 2022-04-04 CVE-ID : CVE-2021-4022 CVE-2021-43814 Package : rizin Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2590 Summary ======= The package rizin before version 0.3.2-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.3.2-1. # pacman -Syu "rizin>=0.3.2-1" The problems have been fixed upstream in version 0.3.2. Workaround ========== None. Description =========== - CVE-2021-4022 (denial of service) A specially crafted binary can make Rizin segfault when it tries to analyze it (doing a full analysis with aaa). In rz_core_analysis_type_match retctx structure was initialized on the stack only after a "goto out_function", where a field of that structure was freed. When the goto path is taken, the field is not properly initialized and it could cause a crash of Rizin or have other effects. - CVE-2021-43814 (arbitrary code execution) In Rizin versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin may crash or execute unintended actions. Impact ====== An attacker is able to provide a malicious AMD64 ELF binary that when opened by a victim may execute arbitrary code on the affected host. References ========== https://github.com/rizinorg/rizin/issues/2015 https://github.com/rizinorg/rizin/pull/2031 https://github.com/rizinorg/rizin/commit/21584e416cdcef2fa7d855c5aabf592a96… https://github.com/rizinorg/rizin/commit/6ce71d8aa3dafe3cdb52d5d72ae8f4b959… https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8r https://github.com/rizinorg/rizin/issues/2083 https://github.com/rizinorg/rizin/pull/2086 https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b… https://github.com/rizinorg/rizin/commit/1a63dad027df62c5d65cad480d9ddc6134… https://security.archlinux.org/CVE-2021-4022 https://security.archlinux.org/CVE-2021-43814

1 0

[ASA-202204-3] zlib: arbitrary code execution
by Levente Polyak 05 Apr '22

05 Apr '22

Arch Linux Security Advisory ASA-202204-3 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2018-25032 Package : zlib Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2657 Summary ======= The package zlib before version 1:1.2.12-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1:1.2.12-1. # pacman -Syu "zlib>=1:1.2.12-1" The problem has been fixed upstream in version 1.2.12. Workaround ========== None. Description =========== An out-of-bounds access flaw was found in zlib before 1.2.12, which allows memory corruption when deflating (ex: when compressing) if the input has many distant matches. For some rare inputs with a large number of distant matches (crafted payloads), the buffer into which the compressed or deflated data is written can overwrite the distance symbol table which it overlays. This issue results in corrupted output due to invalid distances, which leads to out-of-bound access, corrupting the memory and crashing the application or potentially execute arbitrary code. Impact ====== A remote attacker is able to use a specially crafted input to crash an application that is using zlib or potentially execute arbitrary code on the affected host. References ========== https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c… https://github.com/madler/zlib/issues/605 https://www.openwall.com/lists/oss-security/2022/03/24/1 https://www.openwall.com/lists/oss-security/2022/03/26/1 https://security.archlinux.org/CVE-2018-25032

1 0

[ASA-202204-2] polkit: multiple issues
by Levente Polyak 05 Apr '22

05 Apr '22

Arch Linux Security Advisory ASA-202204-2 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-4034 CVE-2021-4115 Package : polkit Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2654 Summary ======= The package polkit before version 0.120-5 is vulnerable to multiple issues including privilege escalation and denial of service. Resolution ========== Upgrade to 0.120-5. # pacman -Syu "polkit>=0.120-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2021-4034 (privilege escalation) A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. - CVE-2021-4115 (denial of service) There is a file descriptor leak in polkit, which can enable an unprivileged user to cause polkit to crash, due to file descriptor exhaustion. Impact ====== A local attacker is able to crash the process or elevate privileges on the affected host. References ========== https://access.redhat.com/security/cve/CVE-2021-4034 https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c… https://www.openwall.com/lists/oss-security/2022/02/18/5 https://gitlab.freedesktop.org/polkit/polkit/-/issues/141 https://gitlab.freedesktop.org/polkit/polkit/-/commit/41cb093f554da87723626… https://security.archlinux.org/CVE-2021-4034 https://security.archlinux.org/CVE-2021-4115

1 0

[ASA-202204-1] postgresql: man-in-the-middle
by Levente Polyak 05 Apr '22

05 Apr '22

Arch Linux Security Advisory ASA-202204-1 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-23214 Package : postgresql Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-2546 Summary ======= The package postgresql before version 13.5-1 is vulnerable to man-in- the-middle. Resolution ========== Upgrade to 13.5-1. # pacman -Syu "postgresql>=13.5-1" The problem has been fixed upstream in version 13.5. Workaround ========== None. Description =========== A security issue has been found in PostgreSQL versions 9.6 up to 14. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the- middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. Impact ====== A man-in-the-middle attacker is able to inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. References ========== https://www.postgresql.org/support/security/CVE-2021-23214/ https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=28e24125… https://security.archlinux.org/CVE-2021-23214

1 0

[ASA-202112-12] grafana-agent: information disclosure
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-12 ========================================== Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-41090 Package : grafana-agent Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2614 Summary ======= The package grafana-agent before version 0.21.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 0.21.2-1. # pacman -Syu "grafana-agent>=0.21.2-1" The problem has been fixed upstream in version 0.21.2. Workaround ========== None. Description =========== A security issue has been found in Grafana Agent before version 0.21.2. Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server: - Inline secrets for metrics instance configs in the base YAML file are exposed at /-/config - Inline secrets for integrations are exposed at /-/config - Inline secrets for Consul ACL tokens and ETCD basic auth when configured for the scraping service at /-/config. - Inline secrets for the Kafka receiver for OpenTelemetry-Collector tracing at /-/config. - Inline secrets for metrics instance configs loaded from the scraping service are exposed at /agent/api/v1/configs/{name}. Inline secrets will be exposed to anyone being able to reach these endpoints. Secrets found in these sections are used for: - Delivering metrics to a Prometheus Remote Write system - Authenticating against a system for discovering Prometheus targets - Authenticating against a system for collecting metrics (scrape_configs and integrations) - Authenticating against a Consul or ETCD for storing configurations to distribute in scraping service mode - Authenticating against Kafka for receiving traces Non-inlined secrets, such as *_file-based secrets, are not impacted by this vulnerability. Impact ====== A remote attacker could disclose inline secrets over the Grafana Agent HTTP server. References ========== https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh https://security.archlinux.org/CVE-2021-41090

1 0

[ASA-202112-11] grafana: directory traversal
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-11 ========================================== Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-43798 CVE-2021-43813 CVE-2021-43815 Package : grafana Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2609 Summary ======= The package grafana before version 8.3.1-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 8.3.1-1. # pacman -Syu "grafana>=8.3.1-1" The problems have been fixed upstream in version 8.3.1. Workaround ========== None. Description =========== - CVE-2021-43798 (directory traversal) Grafana 8 before version 8.3.1 is vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is <grafana_host_url>/public/plugins/<"plugin-id">, where <"plugin-id"> is the plugin ID for any installed plugin. - CVE-2021-43813 (directory traversal) A security issue has been found in Grafana before version 8.3.2 through which authenticated users could read out fully lowercase or fully uppercase .md files through directory traversal. The vulnerable URL path is: /api/plugins/.*/markdown/.* for .md files. - CVE-2021-43815 (directory traversal) A security issue has been found in Grafana 8 before version 8.3.2 through which authenticated users could read out arbitrary .csv files through directory traversal. The vulnerable URL path is: /api/ds/query. Impact ====== A remote attacker could access arbitrary local files on the server through directory traversal. References ========== https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-rel… https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafan… https://j0vsec.com/post/cve-2021-43798/ https://github.com/grafana/grafana/commit/00e38ba555cfb120361c9623de3285d70… https://github.com/grafana/grafana/security/advisories/GHSA-c3q8-26ph-9g2q https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-… https://github.com/grafana/grafana/commit/06706efbbe59ad9d3075835cc31e2f734… https://github.com/grafana/grafana/security/advisories/GHSA-7533-c8qv-jm9m https://github.com/grafana/grafana/commit/1d7105c0959df2083814237024f7ec098… https://security.archlinux.org/CVE-2021-43798 https://security.archlinux.org/CVE-2021-43813 https://security.archlinux.org/CVE-2021-43815

1 0

[ASA-202112-10] gitlab: multiple issues
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-10 ========================================== Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-39910 CVE-2021-39915 CVE-2021-39917 CVE-2021-39919 CVE-2021-39931 CVE-2021-39932 CVE-2021-39933 CVE-2021-39934 CVE-2021-39935 CVE-2021-39936 CVE-2021-39937 CVE-2021-39938 CVE-2021-39940 CVE-2021-39941 CVE-2021-39944 CVE-2021-39945 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2603 Summary ======= The package gitlab before version 14.5.2-1 is vulnerable to multiple issues including privilege escalation, access restriction bypass, denial of service, information disclosure and content spoofing. Resolution ========== Upgrade to 14.5.2-1. # pacman -Syu "gitlab>=14.5.2-1" The problems have been fixed upstream in version 14.5.2. Workaround ========== None. Description =========== - CVE-2021-39910 (content spoofing) An issue has been discovered in GitLab before version 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature. - CVE-2021-39915 (information disclosure) Improper access control in the GraphQL API in GitLab before version 14.5.2 allows an attacker to see the names of project access tokens on arbitrary projects. - CVE-2021-39917 (denial of service) An issue has been discovered in GitLab before version 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking that could cause a denial of service attack. - CVE-2021-39919 (information disclosure) In all versions of GitLab before version 14.5.2, the reset password token and new user email token are accidentally logged which may lead to information disclosure. - CVE-2021-39931 (access restriction bypass) An issue has been discovered in GitLab before version 14.5.2. Under specific condition an unauthorised project member was allowed to delete a protected branches due to a business logic error. - CVE-2021-39932 (denial of service) An issue has been discovered in GitLab before version 14.5.2. Using large payloads, the diff feature could be used to trigger high load time for users reviewing code changes. - CVE-2021-39933 (denial of service) An issue has been discovered in GitLab before version 14.5.2. A regular expression used for handling user input (notes, comments, etc) was susceptible to catastrophic backtracking that could cause a denial of service attack. - CVE-2021-39934 (information disclosure) Improper access control allows any project member to retrieve the service desk email address in GitLab before version 14.5.2. - CVE-2021-39935 (access restriction bypass) An issue has been discovered in GitLab before version 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API. - CVE-2021-39936 (access restriction bypass) Improper access control in GitLab before version 14.5.2 allows an attacker in possession of a deploy token to access a project's disabled wiki. - CVE-2021-39937 (privilege escalation) A collision in access memoization logic in all versions of GitLab before version 14.5.2 leads to potential elevated privileges in groups and projects under rare circumstances. - CVE-2021-39938 (denial of service) A vulnerable regular expression pattern in GitLab before version 14.5.2 allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted deploy Slash commands. - CVE-2021-39940 (denial of service) An issue has been discovered in GitLab before version 14.5.2. GitLab Maven Package registry is vulnerable to a regular expression denial of service when a specifically crafted string is sent. - CVE-2021-39941 (information disclosure) An information disclosure vulnerability in GitLab before version 14.5.2 allowed non-project members to see the default branch name for projects that restrict access to the repository to project members. - CVE-2021-39944 (privilege escalation) An issue has been discovered in GitLab before version 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege to a maintainer on projects they import. - CVE-2021-39945 (access restriction bypass) Improper access control in the GitLab API affecting all versions before version 14.5.2 allows an author of a Merge Request to approve the Merge Request even after having their project access revoked. Impact ====== A remote attacker could elevate their privileges, bypass access restrictions, disclose sensitive information, spoof content or cause high resource consumption leading to denial of service. References ========== https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2… https://security.archlinux.org/CVE-2021-39910 https://security.archlinux.org/CVE-2021-39915 https://security.archlinux.org/CVE-2021-39917 https://security.archlinux.org/CVE-2021-39919 https://security.archlinux.org/CVE-2021-39931 https://security.archlinux.org/CVE-2021-39932 https://security.archlinux.org/CVE-2021-39933 https://security.archlinux.org/CVE-2021-39934 https://security.archlinux.org/CVE-2021-39935 https://security.archlinux.org/CVE-2021-39936 https://security.archlinux.org/CVE-2021-39937 https://security.archlinux.org/CVE-2021-39938 https://security.archlinux.org/CVE-2021-39940 https://security.archlinux.org/CVE-2021-39941 https://security.archlinux.org/CVE-2021-39944 https://security.archlinux.org/CVE-2021-39945

1 0