October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1226223] New: VUL-0: CVE-2024-22423: yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1226223 Bug ID: 1226223 Summary: VUL-0: CVE-2024-22423: yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/401050/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment variables. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2024.04.09 fixes this issue by properly escaping `%`. It replaces them with `%%cd:~,%`, a variable that expands to nothing, leaving only the leading percent. It is recommended to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using `--exec`, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade, avoid using any output template expansion in `--exec` other than `{}` (filepath); if expansion in `--exec` is needed, verify the fields you are using do not contain `"`, `|` or `&`; and/or instead of using `--exec`, write the info json and load the fields from it instead. References: https://github.com/yt-dlp/yt-dlp/commit/de015e930747165dbb8fcd360f8775fd973… https://github.com/yt-dlp/yt-dlp/releases/tag/2021.04.11 https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42h4-v29r-42qg http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22423 https://www.cve.org/CVERecord?id=CVE-2024-22423 https://github.com/yt-dlp/yt-dlp/commit/ff07792676f404ffff6ee61b5638c9dc1a3… https://github.com/yt-dlp/yt-dlp/releases/tag/2024.04.09 https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-hjq6-52gw-2g7p https://bugzilla.redhat.com/show_bug.cgi?id=2270691 https://www.kb.cert.org/vuls/id/123335 https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-comma… https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalik… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1215701] New: VUL-0: CVE-2023-40581: yt-dlp: template expansion in `--exec` flag
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1215701 Bug ID: 1215701 Summary: VUL-0: CVE-2023-40581: yt-dlp: template expansion in `--exec` flag Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/379815/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: rfrohl(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata values may be used in the shell commands. The metadata fields can be combined with the `%q` conversion, which is intended to quote/escape these values so they can be safely passed to the shell. However, the escaping used for `cmd` (the shell used by Python's `subprocess` on Windows) does not properly escape special characters, which can allow for remote code execution if `--exec` is used directly with maliciously crafted remote data. This vulnerability only impacts `yt-dlp` on Windows, and the vulnerability is present regardless of whether `yt-dlp` is run from `cmd` or from `PowerShell`. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2023.09.24 fixes this issue by properly escaping each special character. `\n` will be replaced by `\r` as no way of escaping it has been found. It is recommended to upgrade yt-dlp to version 2023.09.24 as soon as possible. Also, always be careful when using --exec, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade: 1. Avoid using any output template expansion in --exec other than {} (filepath). 2. If expansion in --exec is needed, verify the fields you are using do not contain ", | or &. 3. Instead of using --exec, write the info json and load the fields from it instead. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40581 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1202553] VUL-1: CVE-2022-35164: libredwg: Heap use-after-free via bit_copy_chain
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1202553 Camila Camargo de Matos <camila.matos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|jengelh(a)inai.de |security-team(a)suse.de -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226375] New: VUL-0: CVE-2024-37884: nextcloud: users can delete old versions of read-only shared files
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1226375 Bug ID: 1226375 Summary: VUL-0: CVE-2024-37884: nextcloud: users can delete old versions of read-only shared files Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/410998/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos(a)schirra.net Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3. References: https://github.com/nextcloud/server/pull/43727 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-37884 https://www.cve.org/CVERecord?id=CVE-2024-37884 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x… https://hackerone.com/reports/2290680 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1227297] New: VUL-0: CVE-2020-28595: PrusaSlicer: out-of-bounds write in the Obj.cpp load_obj() functionality
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227297 Bug ID: 1227297 Summary: VUL-0: CVE-2020-28595: PrusaSlicer: out-of-bounds write in the Obj.cpp load_obj() functionality Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/277703/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: code(a)bnavigator.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- An out-of-bounds write vulnerability exists in the Obj.cpp load_obj() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4b040b856). A specially crafted obj file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28595 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1219 https://www.cve.org/CVERecord?id=CVE-2020-28595 https://bugzilla.redhat.com/show_bug.cgi?id=2294728 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1227776] New: VUL-0: CVE-2024-23794: otrs: incorrect privilege assignment in the inline editing functionality leads to privilege escalation
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227776 Bug ID: 1227776 Summary: VUL-0: CVE-2024-23794: otrs: incorrect privilege assignment in the inline editing functionality leads to privilege escalation Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/414102/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: chris(a)computersalat.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- An incorrect privilege assignment vulnerability in the inline editing functionality of OTRS can lead to privilege escalation. This flaw allows an agent with read-only permissions to gain full access to a ticket. This issue arises in very rare instances when an admin has previously enabled the setting 'RequiredLock' of 'AgentFrontend::Ticket::InlineEditing::Property###Watch' in the system configuration.This issue affects OTRS: * 8.0.X * 2023.X * from 2024.X through 2024.4.x References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23794 https://www.cve.org/CVERecord?id=CVE-2024-23794 https://otrs.com/release-notes/otrs-security-advisory-2024-06/ -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1227777] New: VUL-0: CVE-2024-6540: otrs: improper filtering of fields when using the export function in the ticket overview of the external interface could allow access to sensitive information
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227777 Bug ID: 1227777 Summary: VUL-0: CVE-2024-6540: otrs: improper filtering of fields when using the export function in the ticket overview of the external interface could allow access to sensitive information Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/414103/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: chris(a)computersalat.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Improper filtering of fields when using the export function in the ticket overview of the external interface could allow an authorized user to download a list of tickets containing information about tickets of other customers. The problem only occurs if the TicketSearchLegacyEngine has been disabled by the administrator. This issue affects OTRS: 8.0.X, 2023.X, from 2024.X through 2024.4.x References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-6540 https://www.cve.org/CVERecord?id=CVE-2024-6540 https://otrs.com/release-notes/otrs-security-advisory-2024-07/ -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1192703] VUL-1: CVE-2021-43610: belle-sip: before 5.0.20, an unauthenticated SIP message with an empty From header can crash the application
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1192703 Camila Camargo de Matos <camila.matos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|gcomes.obs(a)gmail.com |security-team(a)suse.de -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1229427] New: VUL-0: CVE-2024-39338: python-nbdime: axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1229427 Bug ID: 1229427 Summary: VUL-0: CVE-2024-39338: python-nbdime: axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/417034/ OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Security Assignee: python-maintainers(a)suse.com Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1229421 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1229421 +++ axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-39338 https://www.cve.org/CVERecord?id=CVE-2024-39338 https://github.com/axios/axios/releases https://jeffhacks.com/advisories/2024/06/24/CVE-2024-39338.html https://bugzilla.redhat.com/show_bug.cgi?id=2304369 -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1222859] New: VUL-0: CVE-2024-32019: netdata: local privilege escalation and command execution via untrusted search path
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1222859 Bug ID: 1222859 Summary: VUL-0: CVE-2024-32019: netdata: local privilege escalation and command execution via untrusted search path Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/401694/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mia(a)0x0.st Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32019 https://www.cve.org/CVERecord?id=CVE-2024-32019 https://github.com/netdata/netdata/pull/17377 https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93 https://bugzilla.redhat.com/show_bug.cgi?id=2274984 -- You are receiving this mail because: You are on the CC list for the bug.

1 2