- Arch-security - lists.archlinux.org

[ASA-202102-43] thrift: denial of service
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-43 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2020-13949 Package : thrift Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1568 Summary ======= The package thrift before version 0.14.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.14.0-1. # pacman -Syu "thrift>=0.14.0-1" The problem has been fixed upstream in version 0.14.0. Workaround ========== None. Description =========== Applications using Thrift before version 0.14.0 would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. Impact ====== Malicious clients could send crafted messages crashing the server. References ========== https://www.openwall.com/lists/oss-security/2021/02/11/2 https://security.archlinux.org/CVE-2020-13949

1 0

[ASA-202102-42] openssl: multiple issues
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-42 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2021-23840 CVE-2021-23841 Package : openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1581 Summary ======= The package openssl before version 1.1.1.j-1 is vulnerable to multiple issues including denial of service and incorrect calculation. Resolution ========== Upgrade to 1.1.1.j-1. # pacman -Syu "openssl>=1.1.1.j-1" The problems have been fixed upstream in version 1.1.1.j. Workaround ========== None. Description =========== - CVE-2021-23840 (incorrect calculation) Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). - CVE-2021-23841 (denial of service) The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Impact ====== A malicious certificate can be crafted to crash the application, or behave in some incorrect way. References ========== https://www.openssl.org/news/secadv/20210216.txt https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a51b9e1d0cf0b… https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9b1129239f3ebb… https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8130d654d1de92… https://security.archlinux.org/CVE-2021-23840 https://security.archlinux.org/CVE-2021-23841

1 0

[ASA-202102-41] tar: denial of service
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-41 ========================================== Severity: Low Date : 2021-02-27 CVE-ID : CVE-2021-20193 Package : tar Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1462 Summary ======= The package tar before version 1.34-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.34-1. # pacman -Syu "tar>=1.34-1" The problem has been fixed upstream in version 1.34. Workaround ========== None. Description =========== An issue was discovered in GNU Tar before version 1.34. There is a memory leak in read_header() in list.c in the tar application. Impact ====== A crafted tar archive can crash the application. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1917565 https://savannah.gnu.org/bugs/?59897 https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1… https://security.archlinux.org/CVE-2021-20193

1 0

[ASA-202102-40] bind: arbitrary code execution
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-40 ========================================== Severity: High Date : 2021-02-27 CVE-ID : CVE-2020-8625 Package : bind Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1589 Summary ======= The package bind before version 9.16.12-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 9.16.12-1. # pacman -Syu "bind>=9.16.12-1" The problem has been fixed upstream in version 9.16.12. Workaround ========== None. Description =========== A security issue was found in BIND 9.5.0 up to 9.11.27, 9.12.0 up to 9.16.11, and versions BIND 9.11.3-S1 up to 9.11.27-S1 and 9.16.8-S1 up to 9.16.11-S1 of BIND Supported Preview Edition, as well as the release versions 9.17.0 and 9.17.1 of the BIND 9.17 development branch. A vulnerability in BIND's GSSAPI security policy can be targeted by a buffer overflow attack. Impact ====== A malicious server could execute code on the host. References ========== https://kb.isc.org/docs/cve-2020-8625 https://downloads.isc.org/isc/bind9/9.16.12/patches/CVE-2020-8625.patch https://security.archlinux.org/CVE-2020-8625

1 0

[ASA-202102-39] ipmitool: arbitrary code execution
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-39 ========================================== Severity: High Date : 2021-02-27 CVE-ID : CVE-2020-5208 Package : ipmitool Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1596 Summary ======= The package ipmitool before version 1.8.18-7 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.8.18-7. # pacman -Syu "ipmitool>=1.8.18-7" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19. Impact ====== A remote server could execute arbitrary code on the client. References ========== https://bugs.archlinux.org/task/69708 https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp https://github.com/ipmitool/ipmitool/commit/e824c23316ae50beb7f7488f2055ac6… https://github.com/ipmitool/ipmitool/commit/840fb1cbb4fb365cb9797300e3374d4… https://github.com/ipmitool/ipmitool/commit/41d7026946fafbd4d1ec0bcaca3ea30… https://github.com/ipmitool/ipmitool/commit/9452be87181a6e83cfcc768b3ed8321… https://github.com/ipmitool/ipmitool/commit/d45572d71e70840e0d4c50bf4821849… https://github.com/ipmitool/ipmitool/commit/7ccea283dd62a05a320c1921e3d8d71… https://security.archlinux.org/CVE-2020-5208

1 0

[ASA-202102-38] isync: directory traversal
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-38 ========================================== Severity: High Date : 2021-02-27 CVE-ID : CVE-2021-20247 Package : isync Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-1598 Summary ======= The package isync before version 1.3.5-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 1.3.5-1. # pacman -Syu "isync>=1.3.5-1" The problem has been fixed upstream in version 1.3.5. Workaround ========== None. Description =========== A security issue was found in isync/mbsync before versions 1.3.5 and 1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur, allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the opposite end of the synchronization channel. Impact ====== A compromised server could traverse files on the system. References ========== https://www.openwall.com/lists/oss-security/2021/02/22/1 https://sourceforge.net/p/isync/isync/ci/fe5d59f8e3169944e57eb1c60155c9ebd4… https://security.archlinux.org/CVE-2021-20247

1 0

[ASA-202102-37] python: multiple issues
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-37 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2021-3177 CVE-2021-23336 Package : python Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1465 Summary ======= The package python before version 3.9.2-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========== Upgrade to 3.9.2-1. # pacman -Syu "python>=3.9.2-1" The problems have been fixed upstream in version 3.9.2. Workaround ========== None. Description =========== - CVE-2021-3177 (arbitrary code execution) Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely. - CVE-2021-23336 (url request injection) The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. The package python-django contains a copy of urllib.parse.parse_qsl() which was added to backport some security fixes. A further security fix has been issued in versions 3.1.7, 3.0.13 and 2.2.19 such that parse_qsl() no longer allows using ; as a query parameter separator by default. Impact ====== A malicious format string could execute code and a malicious user could send crafted HTTP queries poisoning the cache. References ========== https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_r… https://bugs.python.org/issue42938 https://github.com/python/cpython/pull/24239 https://github.com/python/cpython/commit/c347cbe694743cee120457aa6626712f77… https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933 https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/ https://bugs.python.org/issue42967 https://github.com/python/cpython/pull/24297 https://github.com/python/cpython/commit/c9f07813ab8e664d8c34413c4fc2d4f86c… https://www.djangoproject.com/weblog/2021/feb/19/security-releases/ https://github.com/django/django/commit/8f6d431b08cbb418d9144b976e7b9725466… https://security.archlinux.org/CVE-2021-3177 https://security.archlinux.org/CVE-2021-23336

1 0

[ASA-202102-36] python-cryptography: incorrect calculation
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-36 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2020-36242 Package : python-cryptography Type : incorrect calculation Remote : No Link : https://security.archlinux.org/AVG-1541 Summary ======= The package python-cryptography before version 3.4-1 is vulnerable to incorrect calculation. Resolution ========== Upgrade to 3.4-1. # pacman -Syu "python-cryptography>=3.4-1" The problem has been fixed upstream in version 3.4. Workaround ========== None. Description =========== In python-cryptography before version 3.3.2, certain sequences of update calls to symmetrically encrypt multiple gigabytes of data could result in an integer overflow, leading to mishandling of buffers. Impact ====== Unintentional use of the API could lead to buffer mishandling, causing application crashes or incorrectly encrypted data. References ========== https://github.com/pyca/cryptography/security/advisories/GHSA-rhm9-p9w5-fwm7 https://github.com/pyca/cryptography/issues/5615 https://github.com/pyca/cryptography/pull/5747 https://github.com/pyca/cryptography/commit/82b6ce28389f0a317bc55ba2091a74b… https://security.archlinux.org/CVE-2020-36242

1 0

[ASA-202102-35] python-httplib2: denial of service
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-35 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2021-21240 Package : python-httplib2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1546 Summary ======= The package python-httplib2 before version 0.19.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.19.0-1. # pacman -Syu "python-httplib2>=0.19.0-1" The problem has been fixed upstream in version 0.19.0. Workaround ========== The issue can be mitigated by using "httplib2.USE_WWW_AUTH_STRICT_PARSING = True". Description =========== In python-httplib2 before version 0.19.0, a malicious server which responds with a long series of "\xa0" characters in the "www- authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library. Impact ====== A malicious server can crash the application with crafted HTTP responses. References ========== https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m https://github.com/httplib2/httplib2/pull/182 https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d70… https://security.archlinux.org/CVE-2021-21240

1 0

[ASA-202102-34] intel-ucode: information disclosure
by Morten Linderud 01 Mar '21

01 Mar '21

Arch Linux Security Advisory ASA-202102-34 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2020-8696 CVE-2020-8698 Package : intel-ucode Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1588 Summary ======= The package intel-ucode before version 20210216-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 20210216-1. # pacman -Syu "intel-ucode>=20210216-1" The problems have been fixed upstream in version 20210216. Workaround ========== None. Description =========== - CVE-2020-8696 (information disclosure) Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. - CVE-2020-8698 (information disclosure) Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Impact ====== An authenticated attacker could disclose information. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/release… https://security.archlinux.org/CVE-2020-8696 https://security.archlinux.org/CVE-2020-8698

1 0