- Arch-security - lists.archlinux.org

[ASA-202103-10] openssl: multiple issues
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-10 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-3449 CVE-2021-3450 Package : openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1736 Summary ======= The package openssl before version 1.1.1.k-1 is vulnerable to multiple issues including certificate verification bypass and denial of service. Resolution ========== Upgrade to 1.1.1.k-1. # pacman -Syu "openssl>=1.1.1.k-1" The problems have been fixed upstream in version 1.1.1.k. Workaround ========== None. Description =========== - CVE-2021-3449 (denial of service) An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. - CVE-2021-3450 (certificate verification bypass) The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. Impact ====== A malicious client can crash the server, or a malicious server can serve a crafted certificate to bypass certificate verification routines. References ========== https://www.openssl.org/news/secadv/20210325.txt https://git.openssl.org/?p=openssl.git;a=commitdiff;h=fb9fa6b51defd48157eeb… https://git.openssl.org/?p=openssl.git;a=commitdiff;h=2a40b7bc7b94dd7de897a… https://security.archlinux.org/CVE-2021-3449 https://security.archlinux.org/CVE-2021-3450

1 0

[ASA-202103-9] chromium: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-9 ========================================= Severity: High Date : 2021-03-13 CVE-ID : CVE-2021-21191 CVE-2021-21192 CVE-2021-21193 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1683 Summary ======= The package chromium before version 89.0.4389.90-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 89.0.4389.90-1. # pacman -Syu "chromium>=89.0.4389.90-1" The problems have been fixed upstream in version 89.0.4389.90. Workaround ========== None. Description =========== - CVE-2021-21191 (arbitrary code execution) A use after free security issue was found in the WebRTC component of the Chromium browser before version 89.0.4389.90. - CVE-2021-21192 (arbitrary code execution) A heap buffer overflow security issue was found in the tab groups component of the Chromium browser before version 89.0.4389.90. - CVE-2021-21193 (arbitrary code execution) A use after free security issue was found in the Blink component of the Chromium browser before version 89.0.4389.90. Google is aware of reports that an exploit for this issue exists in the wild. Impact ====== A remote attacker can execute arbitrary code on the affected host. Google is aware of reports that an exploit for CVE-2021-21193 exists in the wild. References ========== https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-des… https://crbug.com/1167357 https://crbug.com/1181387 https://crbug.com/1186287 https://security.archlinux.org/CVE-2021-21191 https://security.archlinux.org/CVE-2021-21192 https://security.archlinux.org/CVE-2021-21193

1 0

[ASA-202103-8] opera: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-8 ========================================= Severity: High Date : 2021-03-13 CVE-ID : CVE-2021-21149 CVE-2021-21150 CVE-2021-21151 CVE-2021-21152 CVE-2021-21153 CVE-2021-21154 CVE-2021-21155 CVE-2021-21156 CVE-2021-21157 Package : opera Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1586 Summary ======= The package opera before version 74.0.3911.203-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 74.0.3911.203-1. # pacman -Syu "opera>=74.0.3911.203-1" The problems have been fixed upstream in version 74.0.3911.203. Workaround ========== None. Description =========== - CVE-2021-21149 (arbitrary code execution) A stack overflow security issue was found in the Data Transfer component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21150 (arbitrary code execution) A use after free security issue was found in the Downloads component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21151 (arbitrary code execution) A use after free security issue was found in the Payments component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21152 (arbitrary code execution) A heap buffer overflow security issue was found in the Media component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21153 (arbitrary code execution) A stack overflow security issue was found in the GPU Process component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21154 (arbitrary code execution) A heap buffer overflow security issue was found in the Tab Strip component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21155 (arbitrary code execution) A heap buffer overflow security issue was found in the Tab Strip component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21156 (arbitrary code execution) A heap buffer overflow security issue was found in the V8 component of the Chromium browser before version 88.0.4324.182. - CVE-2021-21157 (arbitrary code execution) A use after free security issue was found in the Web Sockets component of the Chromium browser before version 88.0.4324.182. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://blogs.opera.com/desktop/changelog-for-74/ https://blogs.opera.com/desktop/2021/03/opera-74-0-3911-203-stable-update/ https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-des… https://crbug.com/1138143 https://crbug.com/1172192 https://crbug.com/1165624 https://crbug.com/1166504 https://crbug.com/1155974 https://crbug.com/1173269 https://crbug.com/1177341 https://crbug.com/1170657 https://security.archlinux.org/CVE-2021-21149 https://security.archlinux.org/CVE-2021-21150 https://security.archlinux.org/CVE-2021-21151 https://security.archlinux.org/CVE-2021-21152 https://security.archlinux.org/CVE-2021-21153 https://security.archlinux.org/CVE-2021-21154 https://security.archlinux.org/CVE-2021-21155 https://security.archlinux.org/CVE-2021-21156 https://security.archlinux.org/CVE-2021-21157

1 0

[ASA-202103-7] ffmpeg: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-7 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2020-35964 Package : ffmpeg Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1649 Summary ======= The package ffmpeg before version 2:4.3.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2:4.3.2-1. # pacman -Syu "ffmpeg>=2:4.3.2-1" The problem has been fixed upstream in version 4.3.2. Workaround ========== None. Description =========== track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of- bounds write because of incorrect extradata packing. The issue is fixed in FFmpeg version 4.3.2. Impact ====== An attacker might be able to execute arbitrary code via a crafted media file. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26622 https://github.com/FFmpeg/FFmpeg/commit/4f0bdff292391cdb96b79b08c5653302916… https://security.archlinux.org/CVE-2020-35964

1 0

[ASA-202103-6] openssh: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-6 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2021-28041 Package : openssh Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1657 Summary ======= The package openssh before version 8.5p1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.5p1-1. # pacman -Syu "openssh>=8.5p1-1" The problem has been fixed upstream in version 8.5p1. Workaround ========== None. Description =========== ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host. Impact ====== A remote attacker with enough privileges to access the socket of the forwarding agent might be able to execute arbitrary code. References ========== https://www.openssh.com/security.html https://www.openssh.com/txt/release-8.5 https://github.com/openssh/openssh-portable/commit/e04fd6dde16de1cdc5a4d994… https://security.archlinux.org/CVE-2021-28041

1 0

[ASA-202103-5] minio: access restriction bypass
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-5 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2021-21362 Package : minio Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-1664 Summary ======= The package minio before version 2021.03.04-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 2021.03.04-1. # pacman -Syu "minio>=2021.03.04-1" The problem has been fixed upstream in version 2021.03.04. Workaround ========== Disabling uploads with `Content-Type: multipart/form-data` as mentioned in the S3 API RESTObjectPOST docs by using a proxy in front of MinIO. Description =========== In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone using MinIO multi-users is impacted. As a workaround, one can disable uploads with `Content-Type: multipart/form-data` as mentioned in the S3 API RESTObjectPOST docs by using a proxy in front of MinIO. Impact ====== A remote attacker can alter a read-only resource via a temporary share upload URL. References ========== https://github.com/minio/minio/security/advisories/GHSA-hq5j-6r98-9m8v https://github.com/minio/minio/pull/11682 https://github.com/minio/minio/commit/039f59b552319fcc2f83631bb421a7d4b82bc… https://security.archlinux.org/CVE-2021-21362

1 0

[ASA-202103-4] flatpak: sandbox escape
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-4 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2021-21381 Package : flatpak Type : sandbox escape Remote : No Link : https://security.archlinux.org/AVG-1678 Summary ======= The package flatpak before version 1.10.2-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 1.10.2-1. # pacman -Syu "flatpak>=1.10.2-1" The problem has been fixed upstream in version 1.10.2. Workaround ========== None. Description =========== Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. Impact ====== A malicious app publisher can escape the sandbox to access sensitive files. References ========== https://github.com/flatpak/flatpak/security/advisories/GHSA-xgh4-387p-hqpp https://github.com/flatpak/flatpak/issues/4146 https://github.com/flatpak/flatpak/pull/4156 https://github.com/flatpak/flatpak/commit/8279c5818425b6812523e3805bbe242fb… https://security.archlinux.org/CVE-2021-21381

1 0

[ASA-202103-3] git: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-3 ========================================= Severity: Low Date : 2021-03-13 CVE-ID : CVE-2021-21300 Package : git Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1665 Summary ======= The package git before version 2.30.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.30.2-1. # pacman -Syu "git>=2.30.2-1" The problem has been fixed upstream in version 2.30.2. Workaround ========== None. Description =========== In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS. Note that clean/smudge filters have to be configured for that. As a workaround, if symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. _before_ cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.62.17.6. Impact ====== Under certain circumstances, a remote attacker might be able to execute arbitrary code by getting a local user to clone a crafted repository. References ========== https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm https://lore.kernel.org/git/xmqqim6019yd.fsf@gitster.c.googlers.com/ https://git.kernel.org/pub/scm/git/git.git/commit/?id=684dd4c2b414bcf648505… https://security.archlinux.org/CVE-2021-21300

1 0

[ASA-202103-2] wireshark-qt: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-2 ========================================= Severity: Medium Date : 2021-03-13 CVE-ID : CVE-2021-22191 Package : wireshark-qt Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1669 Summary ======= The package wireshark-qt before version 3.4.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.4.4-1. # pacman -Syu "wireshark-qt>=3.4.4-1" The problem has been fixed upstream in version 3.4.4. Workaround ========== None. Description =========== A security issue has been found in Wireshark before version 3.4.4. Some fields in the Wireshark proto_tree are double-clickable and pass URLs with arbitrary schemes to the QDesktopServices::openUrl function. http and https URLs passed to this function are opened by the browser which is generally safe. For some other schemes like dav and file however, referenced files will be opened by the system's standard application associated with their file type. By preparing internet-hosted file shares and executable files, arbitrary code execution can be achieved via malicious pcap(ng) files or captured live-traffic and some user interaction. Impact ====== A remote attacker might be able to execute arbitrary code via a crafted network packet, or a crafted packet trace file. References ========== https://www.wireshark.org/security/wnpa-sec-2021-03.html https://gitlab.com/wireshark/wireshark/-/issues/17232 https://gitlab.com/wireshark/wireshark/-/merge_requests/2074 https://gitlab.com/wireshark/wireshark/-/commit/b2c58d020c100958beb59d9e624… https://security.archlinux.org/CVE-2021-22191

1 0

[ASA-202103-1] gnutls: arbitrary code execution
by Morten Linderud 20 Mar '21

20 Mar '21

Arch Linux Security Advisory ASA-202103-1 ========================================= Severity: Low Date : 2021-03-13 CVE-ID : CVE-2021-20231 CVE-2021-20232 Package : gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1674 Summary ======= The package gnutls before version 3.7.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.7.1-1. # pacman -Syu "gnutls>=3.7.1-1" The problems have been fixed upstream in version 3.7.1. Workaround ========== None. Description =========== - CVE-2021-20231 (arbitrary code execution) A security issue was found in GnuTLS before version 3.7.1. It was found that the client sending a "key_share" extension may result in dereferencing a pointer no longer valid after realloc(). This only happens in TLS 1.3 and only when the client sends a large Client Hello message, e.g., when HRR is sent in a resumed session previously negotiated large FFDHE parameters, because the initial allocation of the buffer is large enough without having to call realloc(). - CVE-2021-20232 (arbitrary code execution) A security issue was found in GnuTLS before version 3.7.1. It was found that the client sending a "pre_share_key" extension may result in dereferencing a pointer no longer valid after realloc(). This only happens in TLS 1.3 and only when the client sends a large Client Hello message, e.g., when HRR is sent in a resumed session previously negotiated large FFDHE parameters, because the initial allocation of the buffer is large enough without having to call realloc(). Impact ====== A remote attacker might be able to cause a denial of service or possibly execute arbitrary code when a TLS client is resuming a TLS 1.3 session. References ========== https://www.gnutls.org/security-new.html#GNUTLS-SA-2021-03-10 https://gitlab.com/gnutls/gnutls/-/issues/1151 https://gitlab.com/gnutls/gnutls/-/merge_requests/1399 https://gitlab.com/gnutls/gnutls/-/commit/15beb4b193b2714d88107e7dffca78179… https://gitlab.com/gnutls/gnutls/-/commit/75a937d97f4fefc6f9b08e3791f151445… https://security.archlinux.org/CVE-2021-20231 https://security.archlinux.org/CVE-2021-20232

1 0