- Arch-security - lists.archlinux.org

[ASA-202111-1] jenkins: multiple issues
by Jonas Witschel 09 Nov '21

09 Nov '21

Arch Linux Security Advisory ASA-202111-1 ========================================= Severity: Critical Date : 2021-11-05 CVE-ID : CVE-2021-21685 CVE-2021-21686 CVE-2021-21687 CVE-2021-21688 CVE-2021-21689 CVE-2021-21690 CVE-2021-21691 CVE-2021-21692 CVE-2021-21693 CVE-2021-21694 CVE-2021-21695 CVE-2021-21696 CVE-2021-21697 Package : jenkins Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2526 Summary ======= The package jenkins before version 2.319-1 is vulnerable to multiple issues including arbitrary filesystem access and sandbox escape. Resolution ========== Upgrade to 2.319-1. # pacman -Syu "jenkins>=2.319-1" The problems have been fixed upstream in version 2.319. Workaround ========== If you are unable to immediately upgrade to Jenkins 2.319 right away, you can install the Remoting Security Workaround Plugin. It will prevent all agent-to-controller file access using FilePath APIs. Because it is more restrictive than Jenkins 2.319, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it. Description =========== - CVE-2021-21685 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. FilePath#mkdirs does not check permission to create parent directories. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21686 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. File path filters do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21687 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. FilePath#untar does not check permission to create symbolic links when unarchiving a symbolic link. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21688 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. FilePath#reading(FileVisitor) does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, #copyRecursiveTo). This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21689 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. FilePath#unzip and FilePath#untar were not subject to any access control. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21690 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21691 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. Creating symbolic links is possible without the symlink permission. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21692 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. The operations FilePath#renameTo and FilePath#moveAllChildrenTo only check read permission on the source path. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21693 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. When creating temporary files, permission to create files is only checked after they’ve been created. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21694 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21695 (arbitrary filesystem access) A security issue has been found in Jenkins before version 2.319. FilePath#listFiles lists files outside directories with agent read access when following symbolic links. This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. - CVE-2021-21696 (sandbox escape) Jenkins before version 2.319 does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs. This directory is used by the "Pipeline: Shared Groovy Libraries" Plugin to store copies of shared libraries. This allows attackers in control of agent processes to replace the code of a trusted library with a modified variant, resulting in unsandboxed code execution in the Jenkins controller process. Jenkins 2.319 prohibits agent read/write access to the libs/ directory inside build directories. - CVE-2021-21697 (arbitrary filesystem access) Agents are allowed some limited access to files on the Jenkins controller file system. The directories agents are allowed to access in Jenkins before 2.319 include the directories storing build-related information, intended to allow agents to store build-related metadata during build execution. As a consequence, this allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions (build.xml and some Pipeline-related metadata). Jenkins 2.319 prevents agents from accessing contents of build directories unless it’s for builds currently running on the agent attempting to access the directory. Impact ====== Agent processes could read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. References ========== https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2423 https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2428 https://security.archlinux.org/CVE-2021-21685 https://security.archlinux.org/CVE-2021-21686 https://security.archlinux.org/CVE-2021-21687 https://security.archlinux.org/CVE-2021-21688 https://security.archlinux.org/CVE-2021-21689 https://security.archlinux.org/CVE-2021-21690 https://security.archlinux.org/CVE-2021-21691 https://security.archlinux.org/CVE-2021-21692 https://security.archlinux.org/CVE-2021-21693 https://security.archlinux.org/CVE-2021-21694 https://security.archlinux.org/CVE-2021-21695 https://security.archlinux.org/CVE-2021-21696 https://security.archlinux.org/CVE-2021-21697

1 0

[ASA-202110-12] bind: denial of service
by Jonas Witschel 01 Nov '21

01 Nov '21

Arch Linux Security Advisory ASA-202110-12 ========================================== Severity: Medium Date : 2021-10-29 CVE-ID : CVE-2021-25219 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2502 Summary ======= The package bind before version 9.16.22-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.16.22-1. # pacman -Syu "bind>=9.16.22-1" The problem has been fixed upstream in version 9.16.22. Workaround ========== Setting "lame-ttl 0;" in the BIND configuration prevents the performance issue. Description =========== In BIND before version 9.16.22, exploitation of broken authoritative servers using a flaw in response processing can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it possible for its internal data structures to grow almost infinitely, which may cause significant delays in client query processing. Impact ====== A malicious DNS client could trigger queries to broken authoritative DNS servers, resulting in high CPU usage and service degradation of the BIND server. References ========== https://kb.isc.org/v1/docs/cve-2021-25219 https://github.com/isc-projects/bind9/commit/8fe18c0566c41228a568157287f5a4… https://security.archlinux.org/CVE-2021-25219

1 0

[ASA-202110-11] freerdp: arbitrary code execution
by Jonas Witschel 01 Nov '21

01 Nov '21

Arch Linux Security Advisory ASA-202110-11 ========================================== Severity: Medium Date : 2021-10-29 CVE-ID : CVE-2021-41159 CVE-2021-41160 Package : freerdp Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2488 Summary ======= The package freerdp before version 2:2.4.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2:2.4.1-1. # pacman -Syu "freerdp>=2:2.4.1-1" The problems have been fixed upstream in version 2.4.1. Workaround ========== CVE-2021-41159 can be mitigated by using a /gt:http connection or a direct connection without gateway. No known mitigation exists for CVE-2021-41160. Description =========== - CVE-2021-41159 (arbitrary code execution) A security issue has been found in FreeRDP before version 2.4.1. Improper client input validation for gateway connections (/gt:rpc) allows a malicious gateway to overwrite client memory. - CVE-2021-41160 (arbitrary code execution) A security issue has been found in FreeRDP before version 2.4.1. A malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send 0 width/height or out of bound rectangles to trigger out of bound writes. With 0 width or heigth the memory allocation will be 0 but the missing bounds checks allow writing to the pointer at this (not allocated) region. Impact ====== A malicious RDP server or gateway could cause remote code execution on a connected client. References ========== https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vh34-m9h7-95xq https://github.com/FreeRDP/FreeRDP/commit/07b789c88010766c230c8f10ac748523b… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7c9r-6r2q-93qg https://github.com/FreeRDP/FreeRDP/commit/217e0caa181fc1690cf84dd6a3ba1a4f9… https://security.archlinux.org/CVE-2021-41159 https://security.archlinux.org/CVE-2021-41160

1 0

[ASA-202110-10] wpewebkit: multiple issues
by Jonas Witschel 01 Nov '21

01 Nov '21

Arch Linux Security Advisory ASA-202110-10 ========================================== Severity: Medium Date : 2021-10-29 CVE-ID : CVE-2021-30846 CVE-2021-30851 CVE-2021-42762 Package : wpewebkit Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2484 Summary ======= The package wpewebkit before version 2.34.1-1 is vulnerable to multiple issues including arbitrary code execution and sandbox escape. Resolution ========== Upgrade to 2.34.1-1. # pacman -Syu "wpewebkit>=2.34.1-1" The problems have been fixed upstream in version 2.34.1. Workaround ========== None. Description =========== - CVE-2021-30846 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.34.0. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30851 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.34.0. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-42762 (sandbox escape) BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133. Impact ====== A remote attacker could execute arbitrary code or escape the confinements of the security sandbox through crafted web content. References ========== https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30846 https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30851 https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-42762 https://bugs.webkit.org/show_bug.cgi?id=231479 https://trac.webkit.org/changeset/284451/webkit https://security.archlinux.org/CVE-2021-30846 https://security.archlinux.org/CVE-2021-30851 https://security.archlinux.org/CVE-2021-42762

1 0

[ASA-202110-9] webkit2gtk: multiple issues
by Jonas Witschel 01 Nov '21

01 Nov '21

Arch Linux Security Advisory ASA-202110-9 ========================================= Severity: Medium Date : 2021-10-29 CVE-ID : CVE-2021-30846 CVE-2021-30851 CVE-2021-42762 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2483 Summary ======= The package webkit2gtk before version 2.34.1-1 is vulnerable to multiple issues including arbitrary code execution and sandbox escape. Resolution ========== Upgrade to 2.34.1-1. # pacman -Syu "webkit2gtk>=2.34.1-1" The problems have been fixed upstream in version 2.34.1. Workaround ========== None. Description =========== - CVE-2021-30846 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.34.0. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30851 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.34.0. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-42762 (sandbox escape) BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133. Impact ====== A remote attacker could execute arbitrary code or escape the confinements of the security sandbox through crafted web content. References ========== https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30846 https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30851 https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-42762 https://bugs.webkit.org/show_bug.cgi?id=231479 https://trac.webkit.org/changeset/284451/webkit https://security.archlinux.org/CVE-2021-30846 https://security.archlinux.org/CVE-2021-30851 https://security.archlinux.org/CVE-2021-42762

1 0

[ASA-202110-8] opera: multiple issues
by Jonas Witschel 01 Nov '21

01 Nov '21

Arch Linux Security Advisory ASA-202110-8 ========================================= Severity: High Date : 2021-10-29 CVE-ID : CVE-2021-37977 CVE-2021-37978 CVE-2021-37979 CVE-2021-37980 Package : opera Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2444 Summary ======= The package opera before version 80.0.4170.63-1 is vulnerable to multiple issues including arbitrary code execution and sandbox escape. Resolution ========== Upgrade to 80.0.4170.63-1. # pacman -Syu "opera>=80.0.4170.63-1" The problems have been fixed upstream in version 80.0.4170.63. Workaround ========== None. Description =========== - CVE-2021-37977 (arbitrary code execution) A use after free security issue has been found in the Garbage Collection component of the Chromium browser engine before version 94.0.4606.81. - CVE-2021-37978 (arbitrary code execution) A heap buffer overflow security issue has been found in the Blink component of the Chromium browser engine before version 94.0.4606.81. - CVE-2021-37979 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebRTC component of the Chromium browser engine before version 94.0.4606.81. - CVE-2021-37980 (sandbox escape) An inappropriate implementation security issue has been found in the Sandbox component of the Chromium browser engine before version 94.0.4606.81. Impact ====== A remote attacker could execute arbitrary code or disclose sensitive information through crafted web content. References ========== https://blogs.opera.com/desktop/changelog-for-80/ https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-des… https://crbug.com/1252878 https://crbug.com/1236318 https://crbug.com/1247260 https://crbug.com/1254631 https://security.archlinux.org/CVE-2021-37977 https://security.archlinux.org/CVE-2021-37978 https://security.archlinux.org/CVE-2021-37979 https://security.archlinux.org/CVE-2021-37980

1 0

[ASA-202110-7] chromium: multiple issues
by Jonas Witschel 01 Nov '21

01 Nov '21

Arch Linux Security Advisory ASA-202110-7 ========================================= Severity: High Date : 2021-10-29 CVE-ID : CVE-2021-37997 CVE-2021-37998 CVE-2021-37999 CVE-2021-38000 CVE-2021-38001 CVE-2021-38002 CVE-2021-38003 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2504 Summary ======= The package chromium before version 95.0.4638.69-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 95.0.4638.69-1. # pacman -Syu "chromium>=95.0.4638.69-1" The problems have been fixed upstream in version 95.0.4638.69. Workaround ========== None. Description =========== - CVE-2021-37997 (arbitrary code execution) A use after free security issue has been found in the Sign-In component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-37998 (arbitrary code execution) A use after free security issue has been found in the Garbage Collection component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-37999 (insufficient validation) An insufficient data validation security issue has been found in the New Tab Page component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-38000 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Intents component of the Chromium browser engine before version 95.0.4638.69. Google is aware that an exploit for CVE-2021-38000 exists in the wild. - CVE-2021-38001 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-38002 (arbitrary code execution) A use after free security issue has been found in the Web Transport component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-38003 (arbitrary code execution) An inappropriate implementation security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.69. Google is aware that an exploit for CVE-2021-38003 exists in the wild. Impact ====== A remote attacker could execute arbitrary code through crafted web content. Google is aware that exploits for two of the security issues exist in the wild. References ========== https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-des… https://crbug.com/1259864 https://crbug.com/1259587 https://crbug.com/1251541 https://crbug.com/1249962 https://crbug.com/1260577 https://crbug.com/1260940 https://crbug.com/1263462 https://security.archlinux.org/CVE-2021-37997 https://security.archlinux.org/CVE-2021-37998 https://security.archlinux.org/CVE-2021-37999 https://security.archlinux.org/CVE-2021-38000 https://security.archlinux.org/CVE-2021-38001 https://security.archlinux.org/CVE-2021-38002 https://security.archlinux.org/CVE-2021-38003

1 0

[ASA-202110-6] nodejs-lts-erbium: multiple issues
by Jonas Witschel 21 Oct '21

21 Oct '21

Arch Linux Security Advisory ASA-202110-6 ========================================= Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-22939 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960 Package : nodejs-lts-erbium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2285 Summary ======= The package nodejs-lts-erbium before version 12.22.7-1 is vulnerable to multiple issues including arbitrary code execution, url request injection and certificate verification bypass. Resolution ========== Upgrade to 12.22.7-1. # pacman -Syu "nodejs-lts-erbium>=12.22.7-1" The problems have been fixed upstream in version 12.22.7. Workaround ========== None. Description =========== - CVE-2021-22939 (certificate verification bypass) If the Node.js https API in versions before 16.6.2, 14.17.5 and 12.22.5 was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. - CVE-2021-22940 (arbitrary code execution) Node.js before versions 16.6.2, 14.17.5 and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. The issue is a follow on to CVE-2021-22930 as the issue was not completely resolved in the fix for CVE-2021-22930. - CVE-2021-22959 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). - CVE-2021-22960 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. Impact ====== Incorrect use of the https API could lead to expired certificates being accepted. Furthermore a remote attacker could execute arbitrary code or inject HTTP requests through crafted queries. References ========== https://bugs.archlinux.org/task/72412 https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#incomp… https://hackerone.com/reports/1278254 https://github.com/nodejs-private/node-private/pull/276 https://github.com/nodejs/node/commit/6c7fff6f1d53dfb6c2b184ee41809b8d7614c… https://github.com/nodejs/node/commit/35b86110e45083a75d7dc8e6be5a930b26249… https://github.com/nodejs/node/commit/1780bbc3291357f7c3370892eb311fc7a62af… https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-af… https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/pull/39622 https://github.com/nodejs/node/commit/a3c33d4ce78f74d1cf1765704af5b427aa384… https://github.com/nodejs/node/commit/2008c9722fcf7591e39013691f303934b622d… https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-r… https://hackerone.com/reports/1238099 https://hackerone.com/reports/1238709 https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3… https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9f… https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a… https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-r… https://security.archlinux.org/CVE-2021-22939 https://security.archlinux.org/CVE-2021-22940 https://security.archlinux.org/CVE-2021-22959 https://security.archlinux.org/CVE-2021-22960

1 0

[ASA-202110-5] nodejs-lts-fermium: multiple issues
by Jonas Witschel 21 Oct '21

21 Oct '21

Arch Linux Security Advisory ASA-202110-5 ========================================= Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-22939 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960 Package : nodejs-lts-fermium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2284 Summary ======= The package nodejs-lts-fermium before version 14.18.1-1 is vulnerable to multiple issues including arbitrary code execution, url request injection and certificate verification bypass. Resolution ========== Upgrade to 14.18.1-1. # pacman -Syu "nodejs-lts-fermium>=14.18.1-1" The problems have been fixed upstream in version 14.18.1. Workaround ========== None. Description =========== - CVE-2021-22939 (certificate verification bypass) If the Node.js https API in versions before 16.6.2, 14.17.5 and 12.22.5 was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. - CVE-2021-22940 (arbitrary code execution) Node.js before versions 16.6.2, 14.17.5 and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. The issue is a follow on to CVE-2021-22930 as the issue was not completely resolved in the fix for CVE-2021-22930. - CVE-2021-22959 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). - CVE-2021-22960 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. Impact ====== Incorrect use of the https API could lead to expired certificates being accepted. Furthermore a remote attacker could execute arbitrary code or inject HTTP requests through crafted queries. References ========== https://bugs.archlinux.org/task/72413 https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#incomp… https://hackerone.com/reports/1278254 https://github.com/nodejs-private/node-private/pull/276 https://github.com/nodejs/node/commit/6c7fff6f1d53dfb6c2b184ee41809b8d7614c… https://github.com/nodejs/node/commit/35b86110e45083a75d7dc8e6be5a930b26249… https://github.com/nodejs/node/commit/1780bbc3291357f7c3370892eb311fc7a62af… https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-af… https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/pull/39622 https://github.com/nodejs/node/commit/a3c33d4ce78f74d1cf1765704af5b427aa384… https://github.com/nodejs/node/commit/2008c9722fcf7591e39013691f303934b622d… https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-r… https://hackerone.com/reports/1238099 https://hackerone.com/reports/1238709 https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3… https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9f… https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a… https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-r… https://security.archlinux.org/CVE-2021-22939 https://security.archlinux.org/CVE-2021-22940 https://security.archlinux.org/CVE-2021-22959 https://security.archlinux.org/CVE-2021-22960

1 0

[ASA-202110-4] nodejs: url request injection
by Jonas Witschel 21 Oct '21

21 Oct '21

Arch Linux Security Advisory ASA-202110-4 ========================================= Severity: Medium Date : 2021-10-21 CVE-ID : CVE-2021-22959 CVE-2021-22960 Package : nodejs Type : url request injection Remote : Yes Link : https://security.archlinux.org/AVG-2460 Summary ======= The package nodejs before version 16.11.1-1 is vulnerable to url request injection. Resolution ========== Upgrade to 16.11.1-1. # pacman -Syu "nodejs>=16.11.1-1" The problems have been fixed upstream in version 16.11.1. Workaround ========== None. Description =========== - CVE-2021-22959 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). - CVE-2021-22960 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. Impact ====== A remote attacker could inject HTTP requests through crafted queries. References ========== https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-r… https://hackerone.com/reports/1238099 https://hackerone.com/reports/1238709 https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3… https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9f… https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a… https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-r… https://security.archlinux.org/CVE-2021-22959 https://security.archlinux.org/CVE-2021-22960

1 0