- Arch-security - lists.archlinux.org

[ASA-202101-18] opensmtpd: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-18 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-35679 CVE-2020-35680 Package : opensmtpd Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1381 Summary ======= The package opensmtpd before version 6.8.0p2-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 6.8.0p2-1. # pacman -Syu "opensmtpd>=6.8.0p2-1" The problems have been fixed upstream in version 6.8.0p2. Workaround ========== None. Description =========== - CVE-2020-35679 (information disclosure) smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups. - CVE-2020-35680 (denial of service) smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between the SMTP engine and the filters layer. Impact ====== A malicious remote user might read memory or crash the service. References ========== https://github.com/openbsd/src/commit/79a034b4aed29e965f45a13409268290c9910… https://github.com/openbsd/src/commit/6c3220444ed06b5796dedfd53a0f4becd903c… https://security.archlinux.org/CVE-2020-35679 https://security.archlinux.org/CVE-2020-35680

1 0

[ASA-202101-17] thunderbird: arbitrary code execution
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-17 ========================================== Severity: Critical Date : 2021-01-12 CVE-ID : CVE-2020-16044 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1440 Summary ======= The package thunderbird before version 78.6.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 78.6.1-1. # pacman -Syu "thunderbird>=78.6.1-1" The problem has been fixed upstream in version 78.6.1. Workaround ========== None. Description =========== A security issue was found in Firefox before 84.0.2 and Thunderbird before 78.6.1-1. A malicious peer could have modified a COOKIE-ECHO chunk in an SCTP packet in a way that potentially resulted in a use- after-free. Mozilla presumes that with enough effort it could have been exploited to run arbitrary code. Impact ====== A malicious remote user could forge an SCTP packet and possibly execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2021-02/ https://www.mozilla.org/en-US/security/advisories/mfsa2021-01/#CVE-2020-160… https://bugzilla.mozilla.org/show_bug.cgi?id=1683964 https://hg.mozilla.org/mozilla-central/rev/08ba03dc8d4420e04e7c77fee3013e68… https://hg.mozilla.org/mozilla-central/rev/8c09f4813fc7e8f44605b6092262199b… https://hg.mozilla.org/mozilla-central/rev/5991645a87d2abf289686d09d943229c… https://security.archlinux.org/CVE-2020-16044

1 0

[ASA-202101-16] nodejs: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-16 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-8265 CVE-2020-8287 Package : nodejs Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1400 Summary ======= The package nodejs before version 15.5.1-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========== Upgrade to 15.5.1-1. # pacman -Syu "nodejs>=15.5.1-1" The problems have been fixed upstream in version 15.5.1. Workaround ========== None. Description =========== - CVE-2020-8265 (arbitrary code execution) The nodejs release lines 15.x, 14.x, 12.x and 10.x are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. - CVE-2020-8287 (url request injection) The nodejs release lines 15.x, 14.x, 12.x and 10.x allow two copies of a header field in an HTTP request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. Impact ====== A malicious user could achieve data exfiltration through HTTP headers or execute arbitrary code through poor API usage. References ========== https://groups.google.com/g/nodejs-sec/c/kyzmwvQdUfs/m/7mjPCzY2BAAJ https://github.com/nodejs-private/node-private/issues/227 https://hackerone.com/bugs?subject=nodejs&report_id=988103 https://github.com/nodejs/node/commit/9834ef85a0a549a45a98f04dc51af1782a712… https://github.com/nodejs/node/commit/4f8772f9b731118628256189b73cd202149bb… https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268… https://github.com/nodejs/node/commit/7f178663ebffc82c9f8a5a1b6bf2da0c263a3… https://github.com/nodejs/node/commit/357e2857c8385c303782ced2ac8b568df06d4… https://hackerone.com/bugs?report_id=1002188&subject=nodejs https://github.com/nodejs-private/llhttp-private/pull/3 https://github.com/nodejs/node/commit/e0c9a2285cfe18642d15d5ed9b7122755c6e6… https://github.com/nodejs/node/commit/c5dbe831b714b3a98c59ba2406b791fb27016… https://github.com/nodejs/node/commit/641f786bb1a1f6eb1ff8750782ed939780f2b… https://github.com/nodejs/node/commit/7ecac8143f0a91785ed0bd3b4d9aab5d98419… https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50e… https://github.com/nodejs/node/commit/4a30ac8c755d0701e773831ce22153b66bb36… https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc… https://github.com/nodejs/node/commit/fc70ce08f5818a286fb5899a1bc3aff5965a7… https://github.com/nodejs/node/commit/aa6b97fb99d7528649fadb4c6a894e078fe43… https://security.archlinux.org/CVE-2020-8265 https://security.archlinux.org/CVE-2020-8287

1 0

[ASA-202101-15] nodejs-lts-fermium: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-15 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-8265 CVE-2020-8287 Package : nodejs-lts-fermium Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1401 Summary ======= The package nodejs-lts-fermium before version 14.15.4-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========== Upgrade to 14.15.4-1. # pacman -Syu "nodejs-lts-fermium>=14.15.4-1" The problems have been fixed upstream in version 14.15.4. Workaround ========== None. Description =========== - CVE-2020-8265 (arbitrary code execution) The nodejs release lines 15.x, 14.x, 12.x and 10.x are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. - CVE-2020-8287 (url request injection) The nodejs release lines 15.x, 14.x, 12.x and 10.x allow two copies of a header field in an HTTP request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. Impact ====== A malicious user could achieve data exfiltration through HTTP headers or execute arbitrary code through poor API usage. References ========== https://groups.google.com/g/nodejs-sec/c/kyzmwvQdUfs/m/7mjPCzY2BAAJ https://github.com/nodejs-private/node-private/issues/227 https://hackerone.com/bugs?subject=nodejs&report_id=988103 https://github.com/nodejs/node/commit/9834ef85a0a549a45a98f04dc51af1782a712… https://github.com/nodejs/node/commit/4f8772f9b731118628256189b73cd202149bb… https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268… https://github.com/nodejs/node/commit/7f178663ebffc82c9f8a5a1b6bf2da0c263a3… https://github.com/nodejs/node/commit/357e2857c8385c303782ced2ac8b568df06d4… https://hackerone.com/bugs?report_id=1002188&subject=nodejs https://github.com/nodejs-private/llhttp-private/pull/3 https://github.com/nodejs/node/commit/e0c9a2285cfe18642d15d5ed9b7122755c6e6… https://github.com/nodejs/node/commit/c5dbe831b714b3a98c59ba2406b791fb27016… https://github.com/nodejs/node/commit/641f786bb1a1f6eb1ff8750782ed939780f2b… https://github.com/nodejs/node/commit/7ecac8143f0a91785ed0bd3b4d9aab5d98419… https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50e… https://github.com/nodejs/node/commit/4a30ac8c755d0701e773831ce22153b66bb36… https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc… https://github.com/nodejs/node/commit/fc70ce08f5818a286fb5899a1bc3aff5965a7… https://github.com/nodejs/node/commit/aa6b97fb99d7528649fadb4c6a894e078fe43… https://security.archlinux.org/CVE-2020-8265 https://security.archlinux.org/CVE-2020-8287

1 0

[ASA-202101-14] nodejs-lts-erbium: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-14 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-8265 CVE-2020-8287 Package : nodejs-lts-erbium Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1402 Summary ======= The package nodejs-lts-erbium before version 12.20.1-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========== Upgrade to 12.20.1-1. # pacman -Syu "nodejs-lts-erbium>=12.20.1-1" The problems have been fixed upstream in version 12.20.1. Workaround ========== None. Description =========== - CVE-2020-8265 (arbitrary code execution) The nodejs release lines 15.x, 14.x, 12.x and 10.x are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. - CVE-2020-8287 (url request injection) The nodejs release lines 15.x, 14.x, 12.x and 10.x allow two copies of a header field in an HTTP request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. Impact ====== A malicious user could achieve data exfiltration through HTTP headers or execute arbitrary code through poor API usage. References ========== https://groups.google.com/g/nodejs-sec/c/kyzmwvQdUfs/m/7mjPCzY2BAAJ https://github.com/nodejs-private/node-private/issues/227 https://hackerone.com/bugs?subject=nodejs&report_id=988103 https://github.com/nodejs/node/commit/9834ef85a0a549a45a98f04dc51af1782a712… https://github.com/nodejs/node/commit/4f8772f9b731118628256189b73cd202149bb… https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268… https://github.com/nodejs/node/commit/7f178663ebffc82c9f8a5a1b6bf2da0c263a3… https://github.com/nodejs/node/commit/357e2857c8385c303782ced2ac8b568df06d4… https://hackerone.com/bugs?report_id=1002188&subject=nodejs https://github.com/nodejs-private/llhttp-private/pull/3 https://github.com/nodejs/node/commit/e0c9a2285cfe18642d15d5ed9b7122755c6e6… https://github.com/nodejs/node/commit/c5dbe831b714b3a98c59ba2406b791fb27016… https://github.com/nodejs/node/commit/641f786bb1a1f6eb1ff8750782ed939780f2b… https://github.com/nodejs/node/commit/7ecac8143f0a91785ed0bd3b4d9aab5d98419… https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50e… https://github.com/nodejs/node/commit/4a30ac8c755d0701e773831ce22153b66bb36… https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc… https://github.com/nodejs/node/commit/fc70ce08f5818a286fb5899a1bc3aff5965a7… https://github.com/nodejs/node/commit/aa6b97fb99d7528649fadb4c6a894e078fe43… https://security.archlinux.org/CVE-2020-8265 https://security.archlinux.org/CVE-2020-8287

1 0

[ASA-202101-13] nodejs-lts-dubnium: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-13 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-8265 CVE-2020-8287 Package : nodejs-lts-dubnium Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1403 Summary ======= The package nodejs-lts-dubnium before version 10.23.1-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========== Upgrade to 10.23.1-1. # pacman -Syu "nodejs-lts-dubnium>=10.23.1-1" The problems have been fixed upstream in version 10.23.1. Workaround ========== None. Description =========== - CVE-2020-8265 (arbitrary code execution) The nodejs release lines 15.x, 14.x, 12.x and 10.x are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. - CVE-2020-8287 (url request injection) The nodejs release lines 15.x, 14.x, 12.x and 10.x allow two copies of a header field in an HTTP request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. Impact ====== A malicious user could achieve data exfiltration through HTTP headers or execute arbitrary code through poor API usage. References ========== https://groups.google.com/g/nodejs-sec/c/kyzmwvQdUfs/m/7mjPCzY2BAAJ https://github.com/nodejs-private/node-private/issues/227 https://hackerone.com/bugs?subject=nodejs&report_id=988103 https://github.com/nodejs/node/commit/9834ef85a0a549a45a98f04dc51af1782a712… https://github.com/nodejs/node/commit/4f8772f9b731118628256189b73cd202149bb… https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268… https://github.com/nodejs/node/commit/7f178663ebffc82c9f8a5a1b6bf2da0c263a3… https://github.com/nodejs/node/commit/357e2857c8385c303782ced2ac8b568df06d4… https://hackerone.com/bugs?report_id=1002188&subject=nodejs https://github.com/nodejs-private/llhttp-private/pull/3 https://github.com/nodejs/node/commit/e0c9a2285cfe18642d15d5ed9b7122755c6e6… https://github.com/nodejs/node/commit/c5dbe831b714b3a98c59ba2406b791fb27016… https://github.com/nodejs/node/commit/641f786bb1a1f6eb1ff8750782ed939780f2b… https://github.com/nodejs/node/commit/7ecac8143f0a91785ed0bd3b4d9aab5d98419… https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50e… https://github.com/nodejs/node/commit/4a30ac8c755d0701e773831ce22153b66bb36… https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc… https://github.com/nodejs/node/commit/fc70ce08f5818a286fb5899a1bc3aff5965a7… https://github.com/nodejs/node/commit/aa6b97fb99d7528649fadb4c6a894e078fe43… https://security.archlinux.org/CVE-2020-8265 https://security.archlinux.org/CVE-2020-8287

1 0

[ASA-202101-12] python-cairosvg: denial of service
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-12 ========================================== Severity: Low Date : 2021-01-12 CVE-ID : CVE-2021-21236 Package : python-cairosvg Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1412 Summary ======= The package python-cairosvg before version 2.5.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.5.1-1. # pacman -Syu "python-cairosvg>=2.5.1-1" The problem has been fixed upstream in version 2.5.1. Workaround ========== None. Description =========== In python-cairosvg before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to regular expression denial of service (REDoS). If an attacker provides a malicious SVG, it can make python-cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. Impact ====== A malicious user could craft a SVG that takes a very long time to process, resulting in a denial of service. References ========== https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf https://github.com/Kozea/CairoSVG/commit/063185b60588a41d4df661ad70f9f7b699… https://security.archlinux.org/CVE-2021-21236

1 0

[ASA-202101-11] python-pillow: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-11 ========================================== Severity: Medium Date : 2021-01-12 CVE-ID : CVE-2020-35653 CVE-2020-35654 CVE-2020-35655 Package : python-pillow Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1438 Summary ======= The package python-pillow before version 8.1.0-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 8.1.0-1. # pacman -Syu "python-pillow>=8.1.0-1" The problems have been fixed upstream in version 8.1.0. Workaround ========== None. Description =========== - CVE-2020-35653 (information disclosure) In python-pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations. - CVE-2020-35654 (arbitrary code execution) In python-pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. - CVE-2020-35655 (denial of service) In python-pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over- read when decoding crafted SGI RLE image files because offsets and length tables are mishandled. Impact ====== A local malicious user might craft a malformed file to execute arbitrary code, read from memory or crash the application. References ========== https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security https://github.com/python-pillow/Pillow/pull/5174 https://github.com/python-pillow/Pillow/commit/2f409261eb1228e166868f8f0b5d… https://github.com/python-pillow/Pillow/pull/5175 https://github.com/python-pillow/Pillow/commit/eb8c1206d6b170d4e798a00db743… https://github.com/python-pillow/Pillow/commit/45a62e91b1f72e79989a7919af97… https://github.com/python-pillow/Pillow/pull/5173 https://github.com/python-pillow/Pillow/commit/7e95c63fa7f503f185d3d9eb16b9… https://github.com/python-pillow/Pillow/commit/9a2c9f722f78773e608d44710873… https://security.archlinux.org/CVE-2020-35653 https://security.archlinux.org/CVE-2020-35654 https://security.archlinux.org/CVE-2020-35655

1 0

[ASA-202101-10] gitlab: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-10 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-26414 CVE-2021-22166 CVE-2021-22167 CVE-2021-22168 CVE-2021-22171 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1416 Summary ======= The package gitlab before version 13.7.2-1 is vulnerable to multiple issues including authentication bypass, denial of service and information disclosure. Resolution ========== Upgrade to 13.7.2-1. # pacman -Syu "gitlab>=13.7.2-1" The problems have been fixed upstream in version 13.7.2. Workaround ========== None. Description =========== - CVE-2020-26414 (denial of service) An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string. The issue is mitigated in GitLab version 13.7.2, 13.6.4, and 13.5.6. - CVE-2021-22166 (denial of service) An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method. The issue is mitigated in GitLab version 13.7.2. - CVE-2021-22167 (information disclosure) An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers within a specific project page allow attackers to have temporary read access to a public repository with project features restricted only to members. The issue is mitigated in GitLab version 13.7.2, 13.6.4, and 13.5.6. - CVE-2021-22168 (denial of service) A regular expression denial of service issue has been discovered in the NuGet API affecting all versions of GitLab starting from version 12.8. The issue is mitigated in GitLab version 13.7.2, 13.6.4, and 13.5.6. - CVE-2021-22171 (authentication bypass) Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ would allow stealing a user's API access token. The issue is mitigated in GitLab version 13.7.2, 13.6.4, and 13.5.6. Note: A way to bypass the fix released in GitLab version 13.7.2, 13.6.4, and 13.5.6 has been found and was subsequently fixed in version 13.7.4, 13.6.5, and 13.5.7. Impact ====== A malicious authenticated user might crash the application through a malformed HTTP request or project name, bypass authentication or disclose private information. References ========== https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2… https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2… https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2… https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2… https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2… https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2… https://gitlab.com/gitlab-org/gitlab-foss/-/commit/fa70ce1068babe592d348497… https://gitlab.com/gitlab-org/gitlab-foss/-/commit/e861919633e0aac16509c041… https://security.archlinux.org/CVE-2020-26414 https://security.archlinux.org/CVE-2021-22166 https://security.archlinux.org/CVE-2021-22167 https://security.archlinux.org/CVE-2021-22168 https://security.archlinux.org/CVE-2021-22171

1 0

[ASA-202101-9] php: insufficient validation
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-9 ========================================= Severity: Medium Date : 2021-01-12 CVE-ID : CVE-2020-7071 Package : php Type : insufficient validation Remote : No Link : https://security.archlinux.org/AVG-1415 Summary ======= The package php before version 7.4.14-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 7.4.14-1. # pacman -Syu "php>=7.4.14-1" The problem has been fixed upstream in version 7.4.14. Workaround ========== None. Description =========== A security issue was found in the php_url_parse_ex() function in PHP, which leads to FILTER_VALIDATE_URL accepting URLs with invalid userinfo. It is fixed in versions 8.0.1, 7.4.14 and 7.3.26. Impact ====== A malicious remote user might bypass URL validation. References ========== https://bugs.archlinux.org/task/69242 https://bugs.php.net/bug.php?id=77423 https://git.php.net/?p=php-src.git;a=commitdiff;h=b7f837381ef642d7fb369bfd0… https://git.php.net/?p=php-src.git;a=commitdiff;h=5346d0ae69f290c7704a39cd1… https://git.php.net/?p=php-src.git;a=commitdiff;h=d4f5aed22193106271510efd6… https://security.archlinux.org/CVE-2020-7071

1 0