Re: CVE-2023-33460, ruby-yajl affected?
Thanks all for the discussion. @Tobias, thanks for marking the CVE in the list. Best regards Anton Am Mi., 5. Juli 2023 um 17:56 Uhr schrieb Tobias Frost : > On Wed, Jul 05, 2023 at 09:06:15AM +, Bastien Roucaričs wrote: > > Le mercredi 5 juillet 2023, 04:52:48 UTC Anton Gladky a écrit : > > > Hello, > > > > > > I am looking into CVE-2023-33460 and I am not sure that ruby-yajl > > > is affected. There is no direct dependency on yajl, where the > vulnerability > > > was detected. > > ruby-yajl include a old version of yajl 1.01.12 > > > > The vuln code was introduced by > https://github.com/lloyd/yajl/commit/cfa9f8fcb12d80dd5ebf94f5e6a607aab4d225fb > in version 2.1.0 in 2010 > > This matches my investation, however, a small correction: This commit is > already part of version 2.0.0. > > I've added note in data/CVE/list accordingly. > > -- > Cheers, > tobi > >
[SECURITY] [DSA 5448-1] linux security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5448-1 secur...@debian.org https://www.debian.org/security/ Salvatore Bonaccorso July 05, 2023 https://www.debian.org/security/faq - - Package: linux CVE ID : CVE-2023-2124 CVE-2023-2156 CVE-2023-2269 CVE-2023-3090 CVE-2023-3212 CVE-2023-3268 CVE-2023-3269 CVE-2023-3390 CVE-2023-31084 CVE-2023-32250 CVE-2023-32254 CVE-2023-35788 Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2023-2124 Kyle Zeng, Akshay Ajayan and Fish Wang discovered that missing metadata validation may result in denial of service or potential privilege escalation if a corrupted XFS disk image is mounted. CVE-2023-2156 It was discovered that the IPv6 RPL protocol implementation in the Linux kernel did not properly handled user-supplied data, resulting in a triggerable assertion. An unauthenticated remote attacker can take advantage of this flaw for denial of service. CVE-2023-2269 Zheng Zhang reported that improper handling of locking in the device mapper implementation may result in denial of service. CVE-2023-3090 It was discovered that missing initialization in ipvlan networking may lead to an out-of-bounds write vulnerability, resulting in denial of service or potentially the execution of arbitrary code. CVE-2023-3212 Yang Lan that missing validation in the GFS2 filesystem could result in denial of service via a NULL pointer dereference when mounting a malformed GFS2 filesystem. CVE-2023-3268 It was discovered that an out-of-bounds memory access in relayfs could result in denial of service or an information leak. CVE-2023-3269 Ruihan Li discovered that incorrect lock handling for accessing and updating virtual memory areas (VMAs) may result in privilege escalation. CVE-2023-3390 A use-after-free flaw in the netfilter subsystem caused by incorrect error path handling may result in denial of service or privilege escalation. CVE-2023-31084 It was discovered that the DVB Core driver does not properly handle locking of certain events, allowing a local user to cause a denial of service. CVE-2023-32250 / CVE-2023-32254 Quentin Minster discovered two race conditions in KSMBD, a kernel server which implements the SMB3 protocol, which could result in denial of service or potentially the execution of arbitrary code. CVE-2023-35788 Hangyu Hua discovered an out-of-bounds write vulnerability in the Flower classifier which may result in denial of service or the execution of arbitrary code. For the stable distribution (bookworm), these problems have been fixed in version 6.1.37-1. We recommend that you upgrade your linux packages. For the detailed security status of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmSlxzBfFIAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0TqhA//aamUmnSElduaBWsCIn+Bbz1QeZgUqeAtdLVyAR8DHhWOW5CQtaIYAGCN bH8zYl4DULQNoWccNJKAB6mmh+eLK74L4W9Kkd4C3HL2g2CACDijoO79BlOE35VW 33/S+bhg5gzC1qyv5A6HKt9QltyIA6cI9B+WPPG+uA79T/+12mWI7XbGUYiOaNeR WgOFK8iOhg7KemZqUFsbsG4qRGN0fzGHsU8KOLmF83hP6ObbPZKvVIdRHm0z7ff1 Xba6El+i75LRx0Fqv6tQ3pZE43blXJZIlesUw1M44U493FINmUNTpPAkbJPlHbOb zBC61YcNiPhzyDu2bux+fyoNIfZxh4u9THm8SqWz5mejIFcjGgA9tNsQE3o9c1q/ bZ/QyWoYYOCNBUeLTfOOHuTLlxK7HslTIp4A7J2uLrUiTrmPXldXmIl0FsFc4l+8 qkBaZ+p58XbB7K02VIkr39gFx90GbF+Na0AaUoPGPyQBLz0X87uY6FyOCBY/SbyU 3ARTQT4O55jX+zgK7cUasrS/jVIDEczMIWkf0yHbL4a6ihiNc2Isc1s0gjTF26ji AAE3BdIXi/V+CU4pHX8uq9BVwrDT0rm5BLgLJEo7n/oAWg6Tiq77TGOovQ1mgqF1 TTCY/41xmwkD9UflCu5gdq7jyIqDKPBxjemTZuMhoztQXL9D9tI= =MBf4 -END PGP SIGNATURE-
[SECURITY] [DSA 5447-1] mediawiki security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-5447-1 secur...@debian.org https://www.debian.org/security/ Moritz Muehlenhoff July 05, 2023 https://www.debian.org/security/faq - - Package: mediawiki CVE ID : CVE-2023-29141 CVE-2023-36674 CVE-2023-36675 Debian Bug : 1039075 Multiple security issues were discovered in MediaWiki, a website engine for collaborative work, which could result in cross-site scripting, a bypass of vandalism protections or information disclosure. For the oldstable distribution (bullseye), these problems have been fixed in version 1:1.35.11-1~deb11u1. For the stable distribution (bookworm), these problems have been fixed in version 1:1.39.4-1~deb12u1. We recommend that you upgrade your mediawiki packages. For the detailed security status of mediawiki please refer to its security tracker page at: https://security-tracker.debian.org/tracker/mediawiki Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -BEGIN PGP SIGNATURE- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmSlqxIACgkQEMKTtsN8 TjbJRBAAodt+4EzI/HLq3hr2OU6K3WE6W2ThrPSMNev0TLyCTw7GeX4avi3cKjNL wqdPWGE4BjC6YAb5qU6Z9rqL00megvqihL5kaf010++jXk1/9uruENkOSj+KJuWt qLIvX3MYH4EU5gLRD6we8+LzTJQX46UNXtUVSQ7ixZNegzWGbZ8usI046x3YwAHV MTf5tn3M/XBKdhd9UcvffB+qM4Dkyyr1+/tJXyIzxYq8RbHDFW8ggvKZTJ1xSXVY 4G0G4k+kQEvWtyUvIzypj5hdAI2zzSUXstFKl64dMwS35hXq8HrORJZwYVTgmLw5 6D346wYr5SelP++NO5Ap+nGmjc4bn3UxAMnc6EvCKC5L9nO8dYviMMe7EyLqyKhd rPXJXV0c+Yxznn3SRh9iRoVXwkfEmE+JT562qvk3ozu548AH8NzRaCEdv7Dzuxhg BSrZMbOozDTmMiEUbe7beKfhSwo8tpRqlVlcA4Pk+v2TnEE6sQN6+gwrLaOyv7N9 zwlofFHrjMyR68oFyNg9+cWhuLpca+NUjJE1mzk7V+2ehh1bH83YNAeStYqYqgK1 oJcKNS/xVhCOm246TOwCROw5FwO7oZTYy44BUXrMZh+t/Srf2ko7lsYlPLWoz8t0 gfZ47YMraeNoiewkq7Ij8RvhL/ZKOlB45MHlWewh0KR97HwItOE= =1rTe -END PGP SIGNATURE-
Re: CVE-2023-33460, ruby-yajl affected?
On Wed, Jul 05, 2023 at 09:06:15AM +, Bastien Roucariès wrote: > Le mercredi 5 juillet 2023, 04:52:48 UTC Anton Gladky a écrit : > > Hello, > > > > I am looking into CVE-2023-33460 and I am not sure that ruby-yajl > > is affected. There is no direct dependency on yajl, where the vulnerability > > was detected. > ruby-yajl include a old version of yajl 1.01.12 > > The vuln code was introduced by > https://github.com/lloyd/yajl/commit/cfa9f8fcb12d80dd5ebf94f5e6a607aab4d225fb > in version 2.1.0 in 2010 This matches my investation, however, a small correction: This commit is already part of version 2.0.0. I've added note in data/CVE/list accordingly. -- Cheers, tobi
Re: CVE-2023-33460, ruby-yajl affected?
Le mercredi 5 juillet 2023, 04:52:48 UTC Anton Gladky a écrit : > Hello, > > I am looking into CVE-2023-33460 and I am not sure that ruby-yajl > is affected. There is no direct dependency on yajl, where the vulnerability > was detected. ruby-yajl include a old version of yajl 1.01.12 The vuln code was introduced by https://github.com/lloyd/yajl/commit/cfa9f8fcb12d80dd5ebf94f5e6a607aab4d225fb in version 2.1.0 in 2010 Now the question is why this package use a so old version Bastien > > Should ruby-yajl be unmarked as affected by this CVE? > > Thank you > > Anton >
External check
CVE-2020-23064: TODO: check CVE-2021-45985: missing from list CVE-2021-46059: missing from list CVE-2021-46141: missing from list CVE-2023-24535: TODO: check CVE-2023-3117: TODO: check in https://bugzilla.redhat.com/show_bug.cgi?id=2213260, duplicate of CVE-2023-3390 CVE-2023-3255: missing from list CVE-2023-36632: TODO: check -- The output might be a bit terse, but the above ids are known elsewhere, check the references in the tracker. The second part indicates the status of that id in the tracker at the moment the script was run.
