July 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1228128] New: VUL-0: CVE-2024-40647: python-sentry-sdk: environment variables exposed to subprocesses despite the `env={}` argument being set
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228128 Bug ID: 1228128 Summary: VUL-0: CVE-2024-40647: python-sentry-sdk: environment variables exposed to subprocesses despite the `env={}` argument being set Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/414560/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: python-maintainers(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK < 2.8.0 allows the environment variables to be passed to subprocesses despite the `env={}` setting. In Python's `subprocess` calls, all environment variables are passed to subprocesses by default. However, if you specifically do not want them to be passed to subprocesses, you may use `env` argument in `subprocess` calls. Due to the bug in Sentry SDK, with the Stdlib integration enabled (which is enabled by default), this expectation is not fulfilled, and all environment variables are being passed to subprocesses instead. The issue has been patched in pull request #3251 and is included in sentry-sdk==2.8.0. We strongly recommend upgrading to the latest SDK version. However, if it's not possible, and if passing environment variables to child processes poses a security risk for you, you can disable all default integrations. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-40647 https://www.cve.org/CVERecord?id=CVE-2024-40647 https://docs.python.org/3/library/subprocess.html https://docs.sentry.io/platforms/python/integrations/default-integrations https://docs.sentry.io/platforms/python/integrations/default-integrations/#… https://github.com/getsentry/sentry-python/commit/763e40aa4cb57ecced467f48f… https://github.com/getsentry/sentry-python/pull/3251 https://github.com/getsentry/sentry-python/releases/tag/2.8.0 https://github.com/getsentry/sentry-python/security/advisories/GHSA-g92j-qh… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1226933] New: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 126.0.6478.126
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1226933 Bug ID: 1226933 Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 126.0.6478.126 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: gmbr3(a)opensuse.org Reporter: rfrohl(a)suse.com QA Contact: qa-bugs(a)suse.de CC: Andreas.Stieger(a)gmx.de, m.szczepaniak.000(a)gmail.com Target Milestone: --- Found By: --- Blocker: --- The Stable channel has been updated to 126.0.6478.126/127 for Windows, Mac and 126.0.6478.126 for Linux which will roll out over the coming days/weeks. - CVE-2024-6290: Use after free in Dawn. Reported by wgslfuzz on 2024-05-23 - CVE-2024-6291: Use after free in Swiftshader. Reported by Cassidy Kim(@cassidy6564) on 2023-11-15 - CVE-2024-6292: Use after free in Dawn. Reported by wgslfuzz on 2024-05-24 - CVE-2024-6293: Use after free in Dawn. Reported by wgslfuzz on 2024-06-09 https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-des… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1225690] New: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 125.0.6422.141
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1225690 Bug ID: 1225690 Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 125.0.6422.141 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: andrea.mattiazzo(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The Stable channel has been updated to 125.0.6422.141/.142 for Windows, Mac and 125.0.6422.141 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed. This update includes 11 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information. - CVE-2024-5493: Heap buffer overflow in WebRTC. - CVE-2024-5494: Use after free in Dawn. - CVE-2024-5495: Use after free in Dawn. - CVE-2024-5496: Use after free in Media Session. - CVE-2024-5497: Out of bounds memory access in Keyboard Inputs. - CVE-2024-5498: Use after free in Presentation API. - CVE-2024-5499: Out of bounds write in Streams API. As usual, our ongoing internal security work was responsible for a wide range of fixes: [343518382] Various fixes from internal audits, fuzzing and other initiatives Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL. [0] https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-des… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1222468] New: VUL-0: CVE-2024-22189: caddy: quic-go: memory exhaustion attack against QUIC's connection ID mechanism
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1222468 Bug ID: 1222468 Summary: VUL-0: CVE-2024-22189: caddy: quic-go: memory exhaustion attack against QUIC's connection ID mechanism Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/400376/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: camila.matos(a)suse.com QA Contact: qa-bugs(a)suse.de CC: camila.matos(a)suse.com, jkowalczyk(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1222461 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1222461 +++ quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22189 https://www.cve.org/CVERecord?id=CVE-2024-22189 https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c… https://github.com/quic-go/quic-go/security/advisories/GHSA-c33x-xqrf-c478 https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-manageme… https://www.youtube.com/watch?v=JqXtYcZAtIA&t=3683s https://bugzilla.redhat.com/show_bug.cgi?id=2273513 -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1227299] New: "Storage" does not appear in left menu and URL doesn't work
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1227299 Bug ID: 1227299 Summary: "Storage" does not appear in left menu and URL doesn't work Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Cockpit Assignee: Cockpit-bugs(a)suse.de Reporter: robert.simai(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Tumbleweed all current, installed Cockpit including cockpit-storaged. But it doesn't appear in the left menu (between Logs and Networking). For the desired URL https://IP-ADDRESS:9090/storage Cockpit responds with "Not found". Not sure if it's related but I have another TW system that I used for coding with the Starter Kit and there the storage module appears and is functional. -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1225938] New: Package python311-css-parser missing - needed by Gajim
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1225938 Bug ID: 1225938 Summary: Package python311-css-parser missing - needed by Gajim Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: holgi(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Package python311-css-parser missing - needed by Gajim -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1226099] New: VUL-0: CVE-2024-5742: nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1226099 Bug ID: 1226099 Summary: VUL-0: CVE-2024-5742: nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/409081/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: crrodriguez(a)opensuse.org Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- When nano is killed while it has a modified buffer, it saves this buffer to an emergency .save file and then chmods and chowns this file to the permissions and owner of the original file. This means that when nano is run as root and edits a user-owned file in a directory that is writable by that user, it gives a malicious user a window of opportunity to replace the .save file with a malicious symlink to a root-owned file. To be exploitable, it requires that the malicious user is able to kill the nano run by root. The original reporters of the problem said this: We think it will mostly have an impact on multi-user systems. Where an admin might open a user's file -- for example to fix a broken config file. This could be in a user directory, requiring the admin to either become the user, or become root. If an admin does the latter, this attack can be performed - as long as the user can kill nano of course. One such example might be when root is logged in over `ssh` to a low-privilege user machine and the user can turn off the wifi on that machine. https://bugzilla.redhat.com/show_bug.cgi?id=2277586 https://git.savannah.gnu.org/cgit/nano.git/commit/?id=5e7a3c2e7e118c7f12d5d… References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-5742 https://bugzilla.redhat.com/show_bug.cgi?id=2278574 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1228628] New: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 127.0.6533.88
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228628 Bug ID: 1228628 Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 127.0.6533.88 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: gmbr3(a)opensuse.org Reporter: gianluca.gabrielli(a)suse.com QA Contact: qa-bugs(a)suse.de CC: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Critical CVE-2024-6990: Uninitialized Use in Dawn. Reported by gelatin dessert on 2024-07-15 High CVE-2024-7255: Out of bounds read in WebTransport. Reported by Marten Richter on 2024-07-13 High CVE-2024-7256: Insufficient data validation in Dawn. Reported by gelatin dessert on 2024-07-23 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1227393] New: VUL-0: CVE-2024-39844: znc: arbitrary code embedded into the kick reason executed while kicking someone on a channel
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1227393 Bug ID: 1227393 Summary: VUL-0: CVE-2024-39844: znc: arbitrary code embedded into the kick reason executed while kicking someone on a channel Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/412810/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mpluskal(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-39844 https://seclists.org/oss-sec/2024/q3/23 https://github.com/znc/znc/commit/8cbf8d628174ddf23da680f3f117dc54da0eb06e https://www.cve.org/CVERecord?id=CVE-2024-39844 https://github.com/znc/znc/releases/tag/znc-1.9.1 https://wiki.znc.in/Category:ChangeLog https://wiki.znc.in/ChangeLog/1.9.1 http://www.openwall.com/lists/oss-security/2024/07/03/9 -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1220403] New: VUL-0: CVE-2024-23837: libhtp: excessive processing time of HTTP headers can lead to denial of service
by bugzilla_noreply＠suse.com 23 Aug '24

23 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1220403 Bug ID: 1220403 Summary: VUL-0: CVE-2024-23837: libhtp: excessive processing time of HTTP headers can lead to denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/395171/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: otto.hollmann(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: carlos.lopez(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23837 https://www.cve.org/CVERecord?id=CVE-2024-23837 https://github.com/OISF/libhtp/commit/20ac301d801cdf01b3f021cca08a22a87f477… https://github.com/OISF/libhtp/security/advisories/GHSA-f9wf-rrjj-qx8m https://redmine.openinfosecfoundation.org/issues/6444 -- You are receiving this mail because: You are on the CC list for the bug.

1 5