- Arch-security - lists.archlinux.org

[ASA-202012-22] tensorflow: multiple issues
by Morten Linderud 31 Dec '20

31 Dec '20

Arch Linux Security Advisory ASA-202012-22 ========================================== Severity: Critical Date : 2020-12-16 CVE-ID : CVE-2020-26266 CVE-2020-26267 CVE-2020-26268 CVE-2020-26269 CVE-2020-26270 CVE-2020-26271 Package : tensorflow Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1348 Summary ======= The package tensorflow before version 2.4.0-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 2.4.0-1. # pacman -Syu "tensorflow>=2.4.0-1" The problems have been fixed upstream in version 2.4.0. Workaround ========== None. Description =========== - CVE-2020-26266 (information disclosure) In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. - CVE-2020-26267 (information disclosure) In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. - CVE-2020-26268 (denial of service) In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area. If the file is too small, TensorFlow properly returns an error as the memory area has fewer bytes than what is needed for the tensor it creates. However, as soon as there are enough bytes, the above snippet causes a segmentation fault. This is because the allocator used to return the buffer data is not marked as returning an opaque handle since the needed virtual method is not overridden. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. - CVE-2020-26269 (information disclosure) In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PRs introducing it (#40861 and #44310). Thus, we are completely rewriting the implementation to fully specify and validate these. This is patched in version 2.4.0. This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched. - CVE-2020-26270 (denial of service) In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of- death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. - CVE-2020-26271 (information disclosure) In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The MakeEdge function creates an edge between one output tensor of the src node (given by output_index) and the input slot of the dst node (given by input_index). This is only possible if the types of the tensors on both sides coincide, so the function begins by obtaining the corresponding DataType values and comparing these for equality. However, there is no check that the indices point to inside of the arrays they index into. Thus, this can result in accessing data out of bounds of the corresponding heap allocated arrays. In most scenarios, this can manifest as unitialized data access, but if the index points far away from the boundaries of the arrays this can be used to leak addresses from the library. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Impact ====== An attacker might be able to cause a denial of service or access sensitive information. References ========== https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qhxx-j73r… https://github.com/tensorflow/tensorflow/commit/1b3546b184a42ca69b5d094131a… https://github.com/tensorflow/tensorflow/security/advisories/GHSA-c9f3-9wfr… https://github.com/tensorflow/tensorflow/commit/ffea0239373512240bb17101b5a… https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hhvc-g5hv… https://github.com/tensorflow/tensorflow/commit/eccdffd4ba5604fd53bcc48a9b2… https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9jjw-hf72… https://github.com/tensorflow/tensorflow/commit/18d54d15864eaa8b163183786d0… https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m648-33qf… https://github.com/tensorflow/tensorflow/commit/b550171e78e0a085b208d6a3b8b… https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q263-fvxm… https://github.com/tensorflow/tensorflow/commit/7664e65c2c0fcda6b9d833acbb1… https://security.archlinux.org/CVE-2020-26266 https://security.archlinux.org/CVE-2020-26267 https://security.archlinux.org/CVE-2020-26268 https://security.archlinux.org/CVE-2020-26269 https://security.archlinux.org/CVE-2020-26270 https://security.archlinux.org/CVE-2020-26271

1 0

[ASA-202012-21] openjpeg2: multiple issues
by Morten Linderud 31 Dec '20

31 Dec '20

Arch Linux Security Advisory ASA-202012-21 ========================================== Severity: Medium Date : 2020-12-09 CVE-ID : CVE-2019-12973 CVE-2020-6851 CVE-2020-8112 CVE-2020-15389 CVE-2020-27814 CVE-2020-27824 CVE-2020-27841 CVE-2020-27842 CVE-2020-27843 CVE-2020-27845 Package : openjpeg2 Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1339 Summary ======= The package openjpeg2 before version 2.4.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.4.0-1. # pacman -Syu "openjpeg2>=2.4.0-1" The problems have been fixed upstream in version 2.4.0. Workaround ========== None. Description =========== - CVE-2019-12973 (denial of service) In OpenJPEG before version 2.4.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616. - CVE-2020-6851 (arbitrary code execution) OpenJPEG before version 2.4.0 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation. - CVE-2020-8112 (arbitrary code execution) opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG before version 2.4.0 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851. - CVE-2020-15389 (denial of service) jp2/opj_decompress.c in OpenJPEG before version 2.4.0 has a use-after- free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double- free may also be possible. This is related to calling opj_image_destroy twice. - CVE-2020-27814 (arbitrary code execution) A heap-buffer overwrite error was discovered in lib/openjp2/mqc.c in OpenJPEG before version 2.4.0. The vulnerability causes an out-of- bounds write, which may lead to remote denial of service or possibly remote code execution. - CVE-2020-27824 (denial of service) In OpenJPEG before version 2.4.0, if too many decomposition levels are supplied to the encoder, it could cause a global buffer overflow to out-of-bounds read in the opj_dwt_calc_explicit_stepsizes() function. - CVE-2020-27841 (denial of service) An out-of-bounds read was discovered in lib/openjp2/pi.c:623 in OpenJPEG before version 2.4.0. - CVE-2020-27842 (denial of service) A null pointer dereference issue was found in lib/openjp2/tgt.c when a small precincts size, the option "-TP C" and non (0,0) grid offset are given in OpenJPEG before version 2.4.0. - CVE-2020-27843 (denial of service) An out-of-bounds read was found in opj_t2_encode_packet when small precincts and an origin shift are given in OpenJPEG before version 2.4.0. - CVE-2020-27845 (denial of service) An out-of-bounds read was discovered in lib/openjp2/pi.c:312 in OpenJPEG before version 2.4.0. Impact ====== A local attacker might be able to execute arbitrary code or crash the application via crafted JPEG content. References ========== https://bugs.archlinux.org/task/68906 https://github.com/uclouvain/openjpeg/issues/1222 https://github.com/uclouvain/openjpeg/pull/1185 https://github.com/uclouvain/openjpeg/commit/21399f6b7d318fcdf4406d5e88723c… https://github.com/uclouvain/openjpeg/commit/3aef207f90e937d4931daf6d411e09… https://github.com/uclouvain/openjpeg/issues/1228 https://github.com/uclouvain/openjpeg/pull/1229 https://github.com/uclouvain/openjpeg/commit/024b8407392cb0b82b04b58ed25609… https://github.com/uclouvain/openjpeg/issues/1231 https://github.com/uclouvain/openjpeg/pull/1232 https://github.com/uclouvain/openjpeg/commit/05f9b91e60debda0e83977e5e63b2e… https://github.com/uclouvain/openjpeg/issues/1261 https://github.com/uclouvain/openjpeg/pull/1262 https://github.com/uclouvain/openjpeg/commit/e8e258ab049240c2dd1f1051b4e773… https://github.com/uclouvain/openjpeg/issues/1283 https://github.com/uclouvain/openjpeg/pull/1303 https://github.com/uclouvain/openjpeg/commit/4ce7d285a55d29b79880d0566d4b01… https://github.com/uclouvain/openjpeg/issues/1286 https://github.com/uclouvain/openjpeg/pull/1292 https://github.com/uclouvain/openjpeg/commit/6daf5f3e1ec6eff03b7982889874a3… https://github.com/uclouvain/openjpeg/issues/1293 https://github.com/uclouvain/openjpeg/pull/1295 https://github.com/uclouvain/openjpeg/pull/1300 https://github.com/uclouvain/openjpeg/commit/c9380ed0f8cc4794fc71d556ea23ae… https://github.com/uclouvain/openjpeg/commit/00383e162ae2f8fc951f5745bf1011… https://github.com/uclouvain/openjpeg/issues/1294 https://github.com/uclouvain/openjpeg/pull/1296 https://github.com/uclouvain/openjpeg/commit/fbd30b064f8f9607d500437b6fedc4… https://github.com/uclouvain/openjpeg/issues/1297 https://github.com/uclouvain/openjpeg/pull/1298 https://github.com/uclouvain/openjpeg/commit/38d661a3897052c7ff0b39b30c29cb… https://github.com/uclouvain/openjpeg/issues/1302 https://github.com/uclouvain/openjpeg/pull/1304 https://github.com/uclouvain/openjpeg/commit/8f5aff1dff510a964d3901d0fba281… https://security.archlinux.org/CVE-2019-12973 https://security.archlinux.org/CVE-2020-6851 https://security.archlinux.org/CVE-2020-8112 https://security.archlinux.org/CVE-2020-15389 https://security.archlinux.org/CVE-2020-27814 https://security.archlinux.org/CVE-2020-27824 https://security.archlinux.org/CVE-2020-27841 https://security.archlinux.org/CVE-2020-27842 https://security.archlinux.org/CVE-2020-27843 https://security.archlinux.org/CVE-2020-27845

1 0

[ASA-202012-20] lib32-gdk-pixbuf2: denial of service
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-20 ========================================== Severity: Medium Date : 2020-12-09 CVE-ID : CVE-2020-29385 Package : lib32-gdk-pixbuf2 Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1329 Summary ======= The package lib32-gdk-pixbuf2 before version 2.42.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.42.2-1. # pacman -Syu "lib32-gdk-pixbuf2>=2.42.2-1" The problem has been fixed upstream in version 2.42.2. Workaround ========== None. Description =========== A security issue was found in gdk-pixbuf2 2.40.0 up to 2.42.0. A malformed GIF image could lead to an endless loop in the write_indexes function in gdk-pixbuf/lzw.c, taking full CPU resources and leading to a denial of service. Impact ====== An attacker might be able to cause a denial of service via a crafted GIF image. References ========== https://mail.gnome.org/archives/distributor-list/2020-December/msg00000.html https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/164 https://gitlab.gnome.org/GNOME/gdk-pixbuf/uploads/2838c96bb111a93d845b95c53… https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/92 https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/bdd3acbd48a575d418ba6bf1… https://security.archlinux.org/CVE-2020-29385

1 0

[ASA-202012-19] gdk-pixbuf2: denial of service
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-19 ========================================== Severity: Medium Date : 2020-12-09 CVE-ID : CVE-2020-29385 Package : gdk-pixbuf2 Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1328 Summary ======= The package gdk-pixbuf2 before version 2.42.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.42.2-1. # pacman -Syu "gdk-pixbuf2>=2.42.2-1" The problem has been fixed upstream in version 2.42.2. Workaround ========== None. Description =========== A security issue was found in gdk-pixbuf2 2.40.0 up to 2.42.0. A malformed GIF image could lead to an endless loop in the write_indexes function in gdk-pixbuf/lzw.c, taking full CPU resources and leading to a denial of service. Impact ====== An attacker might be able to cause a denial of service via a crafted GIF image. References ========== https://mail.gnome.org/archives/distributor-list/2020-December/msg00000.html https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/164 https://gitlab.gnome.org/GNOME/gdk-pixbuf/uploads/2838c96bb111a93d845b95c53… https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/92 https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/bdd3acbd48a575d418ba6bf1… https://security.archlinux.org/CVE-2020-29385

1 0

[ASA-202012-18] nsd: denial of service
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-18 ========================================== Severity: Low Date : 2020-12-09 CVE-ID : CVE-2020-28935 Package : nsd Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1327 Summary ======= The package nsd before version 4.3.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.3.4-1. # pacman -Syu "nsd>=4.3.4-1" The problem has been fixed upstream in version 4.3.4. Workaround ========== None. Description =========== NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system. Impact ====== A local attacker might be able to cause a denial of service of the host. References ========== https://www.nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt https://github.com/NLnetLabs/unbound/issues/303 https://nlnetlabs.nl/downloads/unbound/patch_cve-2020-28935_unbound.diff https://github.com/NLnetLabs/unbound/commit/ad387832979b6ce4c93f64fe706301c… https://github.com/NLnetLabs/unbound/commit/19f8f4d9f99a44906ab9dcc46d44da2… https://nlnetlabs.nl/downloads/nsd/patch_cve-2020-28935_nsd.diff https://github.com/NLnetLabs/nsd/commit/a4caec3137a1bc9eca05d38d66e2bce572c… https://security.archlinux.org/CVE-2020-28935

1 0

[ASA-202012-17] unbound: denial of service
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-17 ========================================== Severity: Low Date : 2020-12-09 CVE-ID : CVE-2020-28935 Package : unbound Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1326 Summary ======= The package unbound before version 1.13.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.13.0-1. # pacman -Syu "unbound>=1.13.0-1" The problem has been fixed upstream in version 1.13.0. Workaround ========== None. Description =========== NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system. Impact ====== A local attacker might be able to cause a denial of service of the host. References ========== https://www.nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt https://github.com/NLnetLabs/unbound/issues/303 https://nlnetlabs.nl/downloads/unbound/patch_cve-2020-28935_unbound.diff https://github.com/NLnetLabs/unbound/commit/ad387832979b6ce4c93f64fe706301c… https://github.com/NLnetLabs/unbound/commit/19f8f4d9f99a44906ab9dcc46d44da2… https://nlnetlabs.nl/downloads/nsd/patch_cve-2020-28935_nsd.diff https://github.com/NLnetLabs/nsd/commit/a4caec3137a1bc9eca05d38d66e2bce572c… https://security.archlinux.org/CVE-2020-28935

1 0

[ASA-202012-16] hostapd: proxy injection
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-16 ========================================== Severity: Medium Date : 2020-12-09 CVE-ID : CVE-2020-12695 Package : hostapd Type : proxy injection Remote : Yes Link : https://security.archlinux.org/AVG-1322 Summary ======= The package hostapd before version 2.9-4 is vulnerable to proxy injection. Resolution ========== Upgrade to 2.9-4. # pacman -Syu "hostapd>=2.9-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. This issue could allow a device connected to the local network (i.e., a device that has been authorized to transmit packets in the network in which the AP is located) to trigger the AP to initiate a HTTP (TCP/IP) connection to an arbitrary URL, including connections to servers in external networks. Impact ====== An attacker on the local network might be able to force the AP to initiate a HTTP (TCP/IP) connection to an arbitrary URL, including connections to servers in external networks. References ========== https://bugs.archlinux.org/task/68861 https://w1.fi/security/2020-1/upnp-subscribe-misbehavior-wps-ap.txt http://www.callstranger.com/ https://w1.fi/security/2020-1/0001-WPS-UPnP-Do-not-allow-event-subscription… https://w1.fi/security/2020-1/0002-WPS-UPnP-Fix-event-message-generation-us… https://w1.fi/security/2020-1/0003-WPS-UPnP-Handle-HTTP-initiation-failures… https://security.archlinux.org/CVE-2020-12695

1 0

[ASA-202012-15] minidlna: arbitrary code execution
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-15 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-28926 Package : minidlna Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1321 Summary ======= The package minidlna before version 1.3.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.3.0-1. # pacman -Syu "minidlna>=1.3.0-1" The problem has been fixed upstream in version 1.3.0. Workaround ========== None. Description =========== ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to the miniDLNA service using HTTP chunked encoding can lead to a signedness bug resulting in a buffer overflow in calls to memcpy/memmove. Impact ====== An attacker on the local network can execute arbitrary code via a malicious UPnP HTTP request. References ========== https://www.rootshellsecurity.net/remote-heap-corruption-bug-discovery-mini… https://sourceforge.net/p/minidlna/git/ci/9fba41008adebc1da0f4f6c6e27ae422a… https://security.archlinux.org/CVE-2020-28926

1 0

[ASA-202012-14] chromium: multiple issues
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-14 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-16037 CVE-2020-16038 CVE-2020-16039 CVE-2020-16040 CVE-2020-16041 CVE-2020-16042 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1323 Summary ======= The package chromium before version 87.0.4280.88-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure, insufficient validation and denial of service. Resolution ========== Upgrade to 87.0.4280.88-1. # pacman -Syu "chromium>=87.0.4280.88-1" The problems have been fixed upstream in version 87.0.4280.88. Workaround ========== None. Description =========== - CVE-2020-16037 (arbitrary code execution) A use after free security issue has been found in the clipboard component of the chromium browser before version 87.0.4280.88. - CVE-2020-16038 (arbitrary code execution) A use after free security issue has been found in the media component of the chromium browser before version 87.0.4280.88. - CVE-2020-16039 (arbitrary code execution) A use after free security issue has been found in the extensions component of the chromium browser before version 87.0.4280.88. - CVE-2020-16040 (insufficient validation) An insufficient data validation security issue has been found in the V8 component of the chromium browser before version 87.0.4280.88. - CVE-2020-16041 (denial of service) An out of bounds read security issue has been found in the networking component of the chromium browser before version 87.0.4280.88. - CVE-2020-16042 (information disclosure) An uninitialized use security issue has been found in the V8 component of the chromium browser before version 87.0.4280.88 and Firefox before 84.0. Impact ====== A remote attacker might be able to crash the application, read memory or execute arbitrary code. References ========== https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-des… https://crbug.com/1142331 https://crbug.com/1138683 https://crbug.com/1149177 https://crbug.com/1150649 https://crbug.com/1151865 https://crbug.com/1151890 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-160… https://bugzilla.mozilla.org/show_bug.cgi?id=1679003 https://security.archlinux.org/CVE-2020-16037 https://security.archlinux.org/CVE-2020-16038 https://security.archlinux.org/CVE-2020-16039 https://security.archlinux.org/CVE-2020-16040 https://security.archlinux.org/CVE-2020-16041 https://security.archlinux.org/CVE-2020-16042

1 0

[ASA-202012-13] pam: authentication bypass
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-13 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-27780 Package : pam Type : authentication bypass Remote : No Link : https://security.archlinux.org/AVG-1297 Summary ======= The package pam before version 1.5.0-2 is vulnerable to authentication bypass. Resolution ========== Upgrade to 1.5.0-2. # pacman -Syu "pam>=1.5.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== The issue can be mitigated by setting a non-empty password for the root user. Description =========== An authentication bypass issue was found in pam 1.5.0. Nonexistent users could authenticate if the root password was empty. Impact ====== In some unusual configurations, a remote user might be able to bypass authentication. References ========== https://github.com/linux-pam/linux-pam/blob/5b7ba35ebfd280c931933fedbf98cb7… https://github.com/linux-pam/linux-pam/pull/300 https://github.com/linux-pam/linux-pam/commit/30fdfb90d9864bcc254a62760aaa1… https://security.archlinux.org/CVE-2020-27780

1 0