- Arch-security - lists.archlinux.org

[ASA-202106-44] connman: arbitrary code execution
by Jonas Witschel 18 Jun '21

18 Jun '21

Arch Linux Security Advisory ASA-202106-44 ========================================== Severity: High Date : 2021-06-16 CVE-ID : CVE-2021-33833 Package : connman Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2055 Summary ======= The package connman before version 1.40-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.40-1. # pacman -Syu "connman>=1.40-1" The problem has been fixed upstream in version 1.40. Workaround ========== None. Description =========== A security issue has been found in the dnsproxy component of connman in releases 1.32 to 1.39. Unpacking of NAME and RDATA/RDLENGTH fields with TYPE A/AAAA in the uncompress function uses a memcpy with insufficient bounds checking, which can overflow a stack buffer. Impact ====== A remote attacker might be able to execute arbitrary code on the victim's host. References ========== https://www.openwall.com/lists/oss-security/2021/06/09/1 https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=eceb2… https://security.archlinux.org/CVE-2021-33833

1 0

[ASA-202106-43] grub: multiple issues
by Jonas Witschel 18 Jun '21

18 Jun '21

Arch Linux Security Advisory ASA-202106-43 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2020-14372 CVE-2020-25632 CVE-2020-25647 CVE-2020-27749 CVE-2020-27779 CVE-2021-20225 CVE-2021-20233 Package : grub Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1629 Summary ======= The package grub before version 2:2.06-1 is vulnerable to multiple issues including access restriction bypass and arbitrary code execution. Resolution ========== Upgrade to 2:2.06-1. # pacman -Syu "grub>=2:2.06-1" The problems have been fixed upstream in version 2.06. Workaround ========== None. Description =========== - CVE-2020-14372 (arbitrary code execution) GRUB2 enables the use of the command acpi even when secure boot is signaled by the firmware. An attacker with local root privileges can drop a small SSDT in /boot/efi and modify grub.cfg to instruct grub to load said SSDT. The SSDT then gets run by the kernel and it overwrites the kernel lockdown configuration enabling the attacker to load unsigned kernel modules and kexec unsigned code. - CVE-2020-25632 (arbitrary code execution) The rmmod implementation for grub2 is flawed, allowing an attacker to unload a module used as a dependency without checking if any other dependent module is still loaded. This leads to a use-after-free scenario possibly allowing an attacker to execute arbitrary code and by-pass Secure Boot protections. - CVE-2020-25647 (arbitrary code execution) grub_usb_device_initialize() is called to handle USB device initialization. It reads out the descriptors it needs from the USB device and uses that data to fill in some USB data structures. grub_usb_device_initialize() performs very little bounds checking and simply assumes the USB device provides sane values. This behavior can trigger memory corruption. If properly exploited, this would lead to arbitrary code execution allowing the attacker to bypass the Secure Boot mechanism. - CVE-2020-27749 (arbitrary code execution) grub_parser_split_cmdline() expands variable names present in the supplied command line in to their corresponding variable contents and uses a 1kB stack buffer for temporary storage without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution. An attacker may use this to circumvent Secure Boot protections. - CVE-2020-27779 (access restriction bypass) The GRUB2's cutmem command does not honor Secure Boot locking. This allows an privileged attacker to remove address ranges from memory creating an opportunity to circumvent Secure Boot protections after proper triage of grub's memory layout. - CVE-2021-20225 (arbitrary code execution) The option parser in GRUB2 allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. - CVE-2021-20233 (arbitrary code execution) There's a flaw in GRUB2 menu rendering code setparam_prefix() in the menu rendering code. It performs a length calculation under the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters. This allow an attacker to corrupt memory by one byte for each quote in the input. Impact ====== When secure boot is enabled, complete subversion of the integrity prospects can be achieved through malicious use of existing commands, side-loaded modules, command acpi, rmmod, variable referencing and option parsers. References ========== https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=3e8e4c0549240fa2… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=7630ec5397fe4182… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=128c16a682034263… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=4ea7bae51f97e49c… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=d298b41f90cbf1f2… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=2a330dba93ff11bc… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=2f533a89a8dfcacb… https://security.archlinux.org/CVE-2020-14372 https://security.archlinux.org/CVE-2020-25632 https://security.archlinux.org/CVE-2020-25647 https://security.archlinux.org/CVE-2020-27749 https://security.archlinux.org/CVE-2020-27779 https://security.archlinux.org/CVE-2021-20225 https://security.archlinux.org/CVE-2021-20233

1 0

[ASA-202106-42] go: multiple issues
by Jonas Witschel 18 Jun '21

18 Jun '21

Arch Linux Security Advisory ASA-202106-42 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198 Package : go Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2006 Summary ======= The package go before version 2:1.16.5-1 is vulnerable to multiple issues including insufficient validation, url request injection and denial of service. Resolution ========== Upgrade to 2:1.16.5-1. # pacman -Syu "go>=2:1.16.5-1" The problems have been fixed upstream in version 1.16.5. Workaround ========== None. Description =========== - CVE-2021-33195 (insufficient validation) A security issue has been found in Go before version 1.16.5. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in net, and their respective methods on the Resolver type may return arbitrary values retrieved from DNS which do not follow the established RFC 1035 rules for domain names. If these names are used without further sanitization, for instance unsafely included in HTML, they may allow for injection of unexpected content. Note that LookupTXT may still return arbitrary values that could require sanitization before further use. - CVE-2021-33196 (denial of service) A security issue has been found in Go before version 1.16.5. Due to a pre-allocation optimization in zip.NewReader, a malformed archive which indicates it has a significant number of files can cause either a panic or memory exhaustion. - CVE-2021-33197 (url request injection) A security issue has been found in Go before version 1.16.5. ReverseProxy in net/http/httputil could be made to forward certain hop- by-hop headers, including Connection. In case the target of the ReverseProxy was itself a reverse proxy, this would let an attacker drop arbitrary headers, including those set by the ReverseProxy.Director. - CVE-2021-33198 (denial of service) A security issue has been found in Go before version 1.16.5. The SetString and UnmarshalText methods of math/big.Rat may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents. Impact ====== An attacker could crash an application with crafted input, inject malicious and unexpected content or drop HTTP headers by posing as a reverse proxy. References ========== https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI/m/r_EP-NlKBgAJ https://github.com/golang/go/issues/46241 https://github.com/golang/go/commit/df6a737cc899507d3090e995abd1e1ed1a30cee3 https://github.com/golang/go/issues/46242 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33912 https://github.com/golang/go/commit/895fb1bb6fc0d3c01c5ef7c8cbaf033d1fff9ad7 https://github.com/golang/go/issues/46313 https://github.com/golang/go/commit/0410005dc458f23fb15f64354f9a24ca8f2fe044 https://github.com/golang/go/issues/45910 https://github.com/golang/go/commit/9210eaf7dc704612a6eda97c482012f779fd833b https://security.archlinux.org/CVE-2021-33195 https://security.archlinux.org/CVE-2021-33196 https://security.archlinux.org/CVE-2021-33197 https://security.archlinux.org/CVE-2021-33198

1 0

[ASA-202106-41] python-django: multiple issues
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-41 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-33203 CVE-2021-33571 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2026 Summary ======= The package python-django before version 3.2.4-1 is vulnerable to multiple issues including insufficient validation and directory traversal. Resolution ========== Upgrade to 3.2.4-1. # pacman -Syu "python-django>=3.2.4-1" The problems have been fixed upstream in version 3.2.4. Workaround ========== None. Description =========== - CVE-2021-33203 (directory traversal) A security issue has been found in Django before version 3.2.4. Staff members could use the admindocs TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by the developers to also expose the file contents, then not only the existence but also the file contents would have been exposed. - CVE-2021-33571 (insufficient validation) A security issue has been found in Django before version 3.2.4. URLValidator, validate_ipv4_address(), and validate_ipv46_address() didn't prohibit leading zeros in octal literals. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. validate_ipv4_address() and validate_ipv46_address() validators were not affected on Python 3.9.5+. Impact ====== User accounts with staff privileges could check for the existence of arbitrary files, and possibly disclose their contents. Additionally, leading zeros in IPv4 addresses could be used to bypass IP-based access restrictions. References ========== https://www.djangoproject.com/weblog/2021/jun/02/security-releases/#s-cve-2… https://github.com/django/django/commit/dfaba12cda060b8b292ae1d271b44bf810b… https://www.djangoproject.com/weblog/2021/jun/02/security-releases/#s-cve-2… https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070… https://security.archlinux.org/CVE-2021-33203 https://security.archlinux.org/CVE-2021-33571

1 0

[ASA-202106-40] radare2: denial of service
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-40 ========================================== Severity: Low Date : 2021-06-15 CVE-ID : CVE-2021-32613 Package : radare2 Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1950 Summary ======= The package radare2 before version 5.3.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.3.1-1. # pacman -Syu "radare2>=5.3.1-1" The problem has been fixed upstream in version 5.3.1. Workaround ========== None. Description =========== In radare2 through 5.3.0 there is a double free vulnerability in the pyc parser via a crafted file which can lead to denial of service. Impact ====== A crafted Python bytecode file could crash the parser. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1959939 https://github.com/radareorg/radare2/issues/18679 https://github.com/radareorg/radare2/commit/049de62730f4954ef9a642f2eeebbca… https://security.archlinux.org/CVE-2021-32613

1 0

[ASA-202106-39] thefuck: arbitrary file overwrite
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-39 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-34363 Package : thefuck Type : arbitrary file overwrite Remote : No Link : https://security.archlinux.org/AVG-2062 Summary ======= The package thefuck before version 3.31-1 is vulnerable to arbitrary file overwrite. Resolution ========== Upgrade to 3.31-1. # pacman -Syu "thefuck>=3.31-1" The problem has been fixed upstream in version 3.31. Workaround ========== None. Description =========== The thefuck package before 3.31 allows path traversal that leads to arbitrary file deletion via the "undo archive operation" feature. Impact ====== An attacker could delete arbitrary files by tricking a user to use the "undo archive operation" feature on a crafted archive file. References ========== https://vuln.ryotak.me/advisories/48 https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e02… https://security.archlinux.org/CVE-2021-34363

1 0

[ASA-202106-38] aspnet-runtime-3.1: denial of service
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-38 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-31957 Package : aspnet-runtime-3.1 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2047 Summary ======= The package aspnet-runtime-3.1 before version 3.1.16.sdk116-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.1.16.sdk116-1. # pacman -Syu "aspnet-runtime-3.1>=3.1.16.sdk116-1" The problem has been fixed upstream in version 3.1.16.sdk116. Workaround ========== None. Description =========== A denial of service vulnerability exists in .NET 5.0 before Runtime 5.0.7 and SDK 5.0.204 as well as .NET Core 3.1 before Runtime 3.1.16 and SDK 3.1.116 in ASP.NET. Impact ====== A remote attacker could crash an ASP.NET application. References ========== https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31957 https://github.com/dotnet/announcements/issues/189 https://security.archlinux.org/CVE-2021-31957

1 0

[ASA-202106-37] aspnet-runtime: denial of service
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-37 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-31957 Package : aspnet-runtime Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2046 Summary ======= The package aspnet-runtime before version 5.0.7.sdk204-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.0.7.sdk204-1. # pacman -Syu "aspnet-runtime>=5.0.7.sdk204-1" The problem has been fixed upstream in version 5.0.7.sdk204. Workaround ========== None. Description =========== A denial of service vulnerability exists in .NET 5.0 before Runtime 5.0.7 and SDK 5.0.204 as well as .NET Core 3.1 before Runtime 3.1.16 and SDK 3.1.116 in ASP.NET. Impact ====== A remote attacker could crash an ASP.NET application. References ========== https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31957 https://github.com/dotnet/announcements/issues/189 https://security.archlinux.org/CVE-2021-31957

1 0

[ASA-202106-36] nginx: arbitrary code execution
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-36 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-23017 Package : nginx Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1988 Summary ======= The package nginx before version 1.20.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.20.1-1. # pacman -Syu "nginx>=1.20.1-1" The problem has been fixed upstream in version 1.20.1. Workaround ========== The issue can be mitigated by removing the "resolver" directive from the configuration file. Description =========== A security issue in nginx resolver was identified, which might allow an attacker to cause 1-byte memory overwrite by using a specially crafted DNS response, resulting in worker process crash or, potentially, in arbitrary code execution. The issue only affects nginx if the "resolver" directive is used in the configuration file. Further, the attack is only possible if an attacker is able to forge UDP packets from the DNS server. Impact ====== A remote attacker could crash the nginx server, or potentially execute arbitrary code, using a crafted DNS server response. References ========== https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html http://nginx.org/download/patch.2021.resolver.txt https://github.com/nginx/nginx/commit/7199ebc203f74fd9e44595474de6bdc41740c… https://security.archlinux.org/CVE-2021-23017

1 0

[ASA-202106-35] drupal: cross-site scripting
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-35 ========================================== Severity: High Date : 2021-06-15 CVE-ID : CVE-2021-33829 Package : drupal Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2069 Summary ======= The package drupal before version 9.1.10-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 9.1.10-1. # pacman -Syu "drupal>=9.1.10-1" The problem has been fixed upstream in version 9.1.10. Workaround ========== None. Description =========== Drupal core uses the third-party CKEditor library. This library has an error in parsing HTML that could lead to a cross-site scripting (XSS) attack. CKEditor 4.16.1 and later, as bundled with Drupal 9.1.9, include the fix. Impact ====== A remote attacker could execute arbitrary JavaScript code through cross-site scripting using crafted HTML code. References ========== https://www.drupal.org/sa-core-2021-003 https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#… https://security.archlinux.org/CVE-2021-33829

1 0