- Arch-security - lists.archlinux.org

[ASA-202102-33] salt: multiple issues
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-33 ========================================== Severity: High Date : 2021-02-27 CVE-ID : CVE-2020-28243 CVE-2020-28972 CVE-2020-35662 CVE-2021-3144 CVE-2021-3148 CVE-2021-3197 CVE-2021-25281 CVE-2021-25282 CVE-2021-25283 CVE-2021-25284 Package : salt Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1624 Summary ======= The package salt before version 3002.5-3 is vulnerable to multiple issues including access restriction bypass, arbitrary command execution, certificate verification bypass, cross-site scripting, insufficient validation, privilege escalation, directory traversal and information disclosure. Resolution ========== Upgrade to 3002.5-3. # pacman -Syu "salt>=3002.5-3" The problems have been fixed upstream in version 3002.5. Workaround ========== None. Description =========== - CVE-2020-28243 (privilege escalation) An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create files on the minion in a non-blacklisted directory. - CVE-2020-28972 (certificate verification bypass) In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate. - CVE-2020-35662 (certificate verification bypass) In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. - CVE-2021-3144 (insufficient validation) In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.) - CVE-2021-3148 (arbitrary command execution) An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py. - CVE-2021-3197 (arbitrary command execution) An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request. - CVE-2021-25281 (access restriction bypass) An issue was discovered in SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master. - CVE-2021-25282 (directory traversal) An issue was discovered in SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. - CVE-2021-25283 (cross-site scripting) An issue was discovered in SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. - CVE-2021-25284 (information disclosure) An issue was discovered in SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. Impact ====== A remote unauthenticated attacker could execute commands, bypass TLS verification, traverse directories and disclose credentials. References ========== https://saltproject.io/security_announcements/active-saltstack-cve-release-… https://security.archlinux.org/CVE-2020-28243 https://security.archlinux.org/CVE-2020-28972 https://security.archlinux.org/CVE-2020-35662 https://security.archlinux.org/CVE-2021-3144 https://security.archlinux.org/CVE-2021-3148 https://security.archlinux.org/CVE-2021-3197 https://security.archlinux.org/CVE-2021-25281 https://security.archlinux.org/CVE-2021-25282 https://security.archlinux.org/CVE-2021-25283 https://security.archlinux.org/CVE-2021-25284

1 0

[ASA-202102-32] mumble: arbitrary code execution
by Morten Linderud 25 Feb '21

25 Feb '21

Arch Linux Security Advisory ASA-202102-32 ========================================== Severity: Medium Date : 2021-02-20 CVE-ID : CVE-2021-27229 Package : mumble Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1576 Summary ======= The package mumble before version 1.3.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.3.4-1. # pacman -Syu "mumble>=1.3.4-1" The problem has been fixed upstream in version 1.3.4. Workaround ========== None. Description =========== Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text. Impact ====== A remote attacker is able to execute arbitrary code by tricking the user into opening the web page text of a server list. References ========== https://github.com/mumble-voip/mumble/pull/4733 https://github.com/mumble-voip/mumble/commit/e59ee87abe249f345908c7d568f687… https://security.archlinux.org/CVE-2021-27229

1 0

[ASA-202102-31] postgresql: information disclosure
by Morten Linderud 25 Feb '21

25 Feb '21

Arch Linux Security Advisory ASA-202102-31 ========================================== Severity: Medium Date : 2021-02-20 CVE-ID : CVE-2021-3393 CVE-2021-20229 Package : postgresql Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1567 Summary ======= The package postgresql before version 13.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 13.2-1. # pacman -Syu "postgresql>=13.2-1" The problems have been fixed upstream in version 13.2. Workaround ========== None. Description =========== - CVE-2021-3393 (information disclosure) A security issue was found in PostgreSQL 11 to 13 before version 13.2. A user having an UPDATE privilege on a partitioned table but lacking the SELECT privilege on some column may be able to acquire denied- column values from an error message. This is similar to CVE-2014-8161, but the conditions to exploit are more rare. - CVE-2021-20229 (information disclosure) A security issue was found in PostgreSQL 13 before version 13.2. A user having a SELECT privilege on an individual column can craft a special query that returns all columns of the table. Additionally, a stored view that uses column-level privileges will have incomplete column-usage bitmaps. In installations that depend on column-level permissions for security, it is recommended to execute CREATE OR REPLACE on all user-defined views to force them to be re-parsed. Impact ====== A remote, authenticated user is able to disclose information by executing crafted SQL queries. References ========== https://www.postgresql.org/about/news/postgresql-132-126-1111-1016-9621-and… https://github.com/postgres/postgres/commit/8e56684d54d44ba4ed737d5847d31fb… https://github.com/postgres/postgres/commit/d525fbcfd167b28818301d0a2d3548a… https://security.archlinux.org/CVE-2021-3393 https://security.archlinux.org/CVE-2021-20229

1 0

[ASA-202102-30] ansible-base: information disclosure
by Morten Linderud 25 Feb '21

25 Feb '21

Arch Linux Security Advisory ASA-202102-30 ========================================== Severity: Medium Date : 2021-02-20 CVE-ID : CVE-2021-20228 Package : ansible-base Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1562 Summary ======= The package ansible-base before version 2.10.6-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.10.6-1. # pacman -Syu "ansible-base>=2.10.6-1" The problem has been fixed upstream in version 2.10.6. Workaround ========== None. Description =========== A flaw was found in the Ansible Engine, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. Impact ====== A local attacker is able to disclose sensitive information when running an Ansible playbook. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1925002 https://github.com/ansible/ansible/pull/73487 https://github.com/ansible/ansible/commit/e41d1f0a3fd6c466192e7e24accd3d1c6… https://security.archlinux.org/CVE-2021-20228

1 0

[ASA-202102-29] keycloak: cross-site scripting
by Morten Linderud 25 Feb '21

25 Feb '21

Arch Linux Security Advisory ASA-202102-29 ========================================== Severity: High Date : 2021-02-20 CVE-ID : CVE-2021-20195 Package : keycloak Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1578 Summary ======= The package keycloak before version 12.0.3-1 is vulnerable to cross- site scripting. Resolution ========== Upgrade to 12.0.3-1. # pacman -Syu "keycloak>=12.0.3-1" The problem has been fixed upstream in version 12.0.3. Workaround ========== None. Description =========== A security issue was found in keycloak before version 12.0.3. A self stored cross-site scripting (XSS) attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. Specifically, the Account page does not HTML-encode the user first name, and last name, which means a malicious HTML code, which executes malicious Javascript code, can be embedded into the Account page. Even though the malicious Javascript code is linked to the attacker user (Self-XSS), it can be exploited on the Keycloak admin browser, using the Impersonation functionality, and thus the attacker is able to compromise Keycloak. Impact ====== A malicious user can execute arbitrary code in Keycloak's account page possibly compromising Keycloak's admin account. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1919143 https://issues.redhat.com/browse/KEYCLOAK-16890 https://github.com/keycloak/keycloak/commit/87422b77aee787c6c55ca22fde31c60… https://security.archlinux.org/CVE-2021-20195

1 0

[ASA-202102-28] python-django: url request injection
by Morten Linderud 22 Feb '21

22 Feb '21

Arch Linux Security Advisory ASA-202102-28 ========================================== Severity: Medium Date : 2021-02-20 CVE-ID : CVE-2021-23336 Package : python-django Type : url request injection Remote : Yes Link : https://security.archlinux.org/AVG-1593 Summary ======= The package python-django before version 3.1.7-1 is vulnerable to url request injection. Resolution ========== Upgrade to 3.1.7-1. # pacman -Syu "python-django>=3.1.7-1" The problem has been fixed upstream in version 3.1.7. Workaround ========== None. Description =========== The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. The package python-django contains a copy of urllib.parse.parse_qsl() which was added to backport some security fixes. A further security fix has been issued in versions 3.1.7, 3.0.13 and 2.2.19 such that parse_qsl() no longer allows using ; as a query parameter separator by default. Impact ====== A remote attacker is able to insert malicious requests in the web proxy cache. References ========== https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933 https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/ https://bugs.python.org/issue42967 https://github.com/python/cpython/pull/24297 https://github.com/python/cpython/commit/c9f07813ab8e664d8c34413c4fc2d4f86c… https://www.djangoproject.com/weblog/2021/feb/19/security-releases/ https://github.com/django/django/commit/8f6d431b08cbb418d9144b976e7b9725466… https://security.archlinux.org/CVE-2021-23336

1 0

[ASA-202102-27] roundcubemail: cross-site scripting
by Morten Linderud 22 Feb '21

22 Feb '21

Arch Linux Security Advisory ASA-202102-27 ========================================== Severity: High Date : 2021-02-12 CVE-ID : CVE-2021-26925 Package : roundcubemail Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1551 Summary ======= The package roundcubemail before version 1.4.11-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.4.11-1. # pacman -Syu "roundcubemail>=1.4.11-1" The problem has been fixed upstream in version 1.4.11. Workaround ========== None. Description =========== Roundcube before 1.4.11 allows cross-site scripting (XSS) via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering. Impact ====== A remote attacker might be able to perform cross-site scripting via crafted CSS content in a HTML message. References ========== https://roundcube.net/news/2021/02/08/security-update-1.4.11 https://github.com/roundcube/roundcubemail/commit/9dc276d5f26042db02754fa1b… https://security.archlinux.org/CVE-2021-26925

1 0

[ASA-202102-26] firejail: privilege escalation
by Morten Linderud 22 Feb '21

22 Feb '21

Arch Linux Security Advisory ASA-202102-26 ========================================== Severity: High Date : 2021-02-12 CVE-ID : CVE-2021-26910 Package : firejail Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1545 Summary ======= The package firejail before version 0.9.64.4-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 0.9.64.4-1. # pacman -Syu "firejail>=0.9.64.4-1" The problem has been fixed upstream in version 0.9.64.4. Workaround ========== The issue can be mitigated by setting "overlayfs no" in /etc/firejail/firejail.config. Description =========== Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat operation and an OverlayFS mount operation. Impact ====== A local unprivileged attacker can obtain arbitrary file system access for an application running within a firejail sandbox, leading to potential privilege escalation. References ========== https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for… https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8… https://security.archlinux.org/CVE-2021-26910

1 0

[ASA-202102-25] wpa_supplicant: arbitrary code execution
by Morten Linderud 22 Feb '21

22 Feb '21

Arch Linux Security Advisory ASA-202102-25 ========================================== Severity: High Date : 2021-02-12 CVE-ID : CVE-2021-0326 Package : wpa_supplicant Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1530 Summary ======= The package wpa_supplicant before version 2:2.9-8 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2:2.9-8. # pacman -Syu "wpa_supplicant>=2:2.9-8" The problem has been fixed upstream but no release is available yet. Workaround ========== The issue can be mitigated by disabling P2P, using the control interface command "P2P_SET disabled 1" or "p2p_disabled=1" in (each, if multiple interfaces used) wpa_supplicant configuration file. Description =========== A security issue was found in hostapd and wpa_supplicant version 2.9. A missing length check in the p2p_copy_client_info function could lead to a buffer overflow. Impact ====== An attacker within radio range of the device running P2P discovery might be able to cause a crash or execute arbitrary code. References ========== https://bugs.archlinux.org/task/69525 https://w1.fi/security/2020-2/wpa_supplicant-p2p-group-info-processing-vuln… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27269 https://w1.fi/cgit/hostap/commit/?id=947272febe24a8f0ea828b5b2f35f13c382190… https://security.archlinux.org/CVE-2021-0326

1 0

[ASA-202102-24] connman: multiple issues
by Morten Linderud 22 Feb '21

22 Feb '21

Arch Linux Security Advisory ASA-202102-24 ========================================== Severity: Critical Date : 2021-02-12 CVE-ID : CVE-2021-26675 CVE-2021-26676 Package : connman Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1543 Summary ======= The package connman before version 1.39-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 1.39-1. # pacman -Syu "connman>=1.39-1" The problems have been fixed upstream in version 1.39. Workaround ========== None. Description =========== - CVE-2021-26675 (arbitrary code execution) A security issue was found in connman 1.38. A stack buffer overflow can be used to execute code by network adjacent attackers. - CVE-2021-26676 (information disclosure) A security issue was found in connman 1.38. A stack information leak from an uninitialised variable can lead to information disclosure to a remote attacker. This information can be used to help exploiting CVE-2021-26675 reliably. Impact ====== A network adjacent attacker can execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/69583 https://www.openwall.com/lists/oss-security/2021/02/08/2 https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=e4079… https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=58d39… https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=a7452… https://security.archlinux.org/CVE-2021-26675 https://security.archlinux.org/CVE-2021-26676

1 0