Vulnerability Roundup 15 #21457

grahamc · 2016-12-28T11:52:37Z

Here are all the vulnerabilities from https://lwn.net/Vulnerabilities
since our last roundup.

cc: @joachifm @michalpalka @abbradar @bachp @LnL7 @the-kenny @Mic92 @FRidh @bjornfor @vcunat.

Note: The list of people CC'd on this issue participated in the last
roundup. If you participate on this roundup, I'll cc you on the next
one. If you don't participate in the next one, you won't be CC'd on
the one after that. If you would like to be CC'd on the next roundup,
add a comment to the most recent vulnerability roundup.
If you would like to be CC'd on all roundups, leave a comment and
tell @grahamc so.

Permanent CC's: @joepie91, @phanimahesh, @NixOS/security-notifications
(if you no longer want to be CC'd, ask to be removed from this list)

Notes on the list

The reports have been roughly grouped by the package name. This
isn't perfect, but is intended to help identify if a whole group
of reports is resolved already.
Some issues will be duplicated, because it affects multiple
packages. For example, there are sometimes problems that impact
thunderbird, and firefox. LWN might report in one vulnerability
"thunderbird firefox". These names have been split to make sure
both packages get addressed.
By each issue is a link to code search for the package name, and
a Github search by filename. These are to help, but may not return
results when we do in fact package the software. If a search
doesn't turn up, please try altering the search criteria or
looking in nixpkgs manually before asserting we don't have it.
This issue is created by https://github.com/NixOS/security

Instructions:

Triage a report: If we don't have the software or our version isn't
vulnerable, tick the box or add a comment with the report number,
stating it isn't vulnerable.
Fix the issue: If we do have the software and it is vulnerable,
either leave a comment on this issue saying so, even open a pull
request with the fix. If you open a PR, make sure to tag this
issue so we can coordinate.
When an entire section is completed, move the section to the
"Triaged and Resolved Issues" details block below.

Upon Completion ...

Run the issue through reformat one last time
Review commits since last roundup for backport candidates
Send an update e-mail to nix-security-announce@googlegroups.com
Update the database at https://github.com/NixOS/security

Without further ado...

Assorted (17 issues)

gstreamer-plugins-good (2 issues)

#318382 (search, files) gstreamer-plugins-good: heap buffer overflows
#709839 (search, files) gstreamer-plugins-good: denial of service

The text was updated successfully, but these errors were encountered:

grahamc · 2016-12-28T12:14:06Z

I tried updating botan with

commit 81879537edc27b40075563fff55a59ad06526d17
Author: Graham Christensen <graham@grahamc.com>
Date:   Wed Dec 28 07:08:13 2016 -0500

    botan: 1.10.13 -> 1.10.14
    
    CVE-2016-9132

diff --git a/pkgs/development/libraries/botan/default.nix b/pkgs/development/libraries/botan/default.nix
index 6e8a8cd..69e8f17 100644
--- a/pkgs/development/libraries/botan/default.nix
+++ b/pkgs/development/libraries/botan/default.nix
@@ -2,7 +2,7 @@
 
 callPackage ./generic.nix (args // {
   baseVersion = "1.10";
-  revision = "13";
-  sha256 = "144vl65z7bys43sxgb09mbisyf2nmh49wh0d957y0ksa9cyrgv13";
+  revision = "14";
+  sha256 = "072czy26vfjcqjww4qccsd29fzkb6mb8czamr4x76rdi9lwhpv8h";
   extraConfigureFlags = "--with-gnump";
 })

but get a build error:

In file included from src/asn1/ber_dec.cpp:11:0:
build/include/botan/internal/safeint.h: In constructor 'Botan::Integer_Overflow_Detected::Integer_Overflow_Detected(const string&, int)':
build/include/botan/internal/safeint.h:20:67: error: 'to_string' is not a member of 'std'
          Exception("Integer overflow detected at " + file + ":" + std::to_string(line))
                                                                   ^
build/include/botan/internal/safeint.h:20:67: note: suggested alternatives:
In file included from build/include/botan/exceptn.h:12:0,
                 from build/include/botan/asn1_int.h:12,
                 from build/include/botan/asn1_oid.h:11,
                 from build/include/botan/ber_dec.h:11,
                 from src/asn1/ber_dec.cpp:8:
build/include/botan/parsing.h:56:23: note:   'Botan::to_string'
 BOTAN_DLL std::string to_string(u64bit n, size_t min_len = 0);
                       ^
In file included from build/include/botan/asn1_oid.h:11:0,
                 from build/include/botan/ber_dec.h:11,
                 from src/asn1/ber_dec.cpp:8:
build/include/botan/asn1_int.h:94:13: note:   'Botan::ASN1::to_string'
 std::string to_string(const BER_Object& obj);
             ^
make: *** [Makefile:633: build/lib/asn1_ber_dec.o] Error 1

the-kenny · 2016-12-28T12:18:43Z

@grahamc Can you add me to the permanent-CC list please?

grahamc · 2016-12-28T12:22:00Z

Done, @the-kenny: NixOS/security@686a57a

grahamc · 2016-12-28T12:41:36Z

@wkennington second bump on Ceph, we're 2 major versions behind, 9.x hasn't seen an update in ages, and there don't seem to be any distros I can take the security patches from. I may mark as broken soon.

7c6f434c · 2016-12-28T12:48:35Z

re: botan: fixed, stable version wasn't enforcing C++11 for some reason.

grahamc · 2016-12-28T12:49:09Z

Thank you, @7c6f434c! botan patches: 04736ae...21d4d54

7c6f434c · 2016-12-28T13:37:42Z

imagemagick: I have updated to the latest repository release tag, no idea if it fixes all the vulnerabilities.

grahamc · 2016-12-28T13:55:13Z

image magick: 9ec867f...de99dc5

7c6f434c · 2016-12-28T14:06:01Z

Also updated dovecot

grahamc · 2016-12-28T14:08:06Z

dovecot: 35e3ea0

/cc #21457. The rebuild impact is probably only a few thousand. The new utility is put into $out/bin/.

/cc #21457. The rebuild impact is probably only a few thousand. The new utility is put into $out/bin/. (cherry picked from commit 421a7f3) Full bump done, as API+ABI only added new symbols in the meantime. https://abi-laboratory.pro/tracker/timeline/gdk-pixbuf/

vcunat · 2016-12-28T19:37:17Z

gdk-pixbuf: 421a7f3 and f3d3835.

LnL7 · 2016-12-28T21:04:55Z

@vcunat any idea what's going wrong with the openssh test?

vcunat · 2016-12-28T21:10:22Z

No idea. That's why I had reverted that update in 661b5a9.

grahamc · 2016-12-28T22:31:28Z

re SSH: I was able to reproduce the issue locally.

nlewo · 2016-12-28T22:43:42Z

qemu CVE-2016-9911 adressed by #21482.

should fix shellinabox vulnarabilities from NixOS#21457

grahamc · 2016-12-29T01:25:17Z

@vcunat, @LnL7

applying:

diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 073391f..80659f1 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -264,8 +264,7 @@ in
                 StandardInput = "socket";
               } else {
                 Restart = "always";
-                Type = "forking";
-                PIDFile = "/run/sshd.pid";
+                Type = "simple";
               });
           };
 
@@ -322,8 +321,6 @@ in
 
     services.openssh.extraConfig = mkOrder 0
       ''
-        PidFile /run/sshd.pid
-
         Protocol 2
 
         UsePAM yes

has fixed it for me:

 * sshd(8): Improve handling of SIGHUP by checking to see if sshd is
   already daemonised at startup and skipping the call to daemon(3)
   if it is. This ensures that a SIGHUP restart of sshd(8) will
   retain the same process-ID as the initial execution. sshd(8) will
   also now unlink the PidFile prior to SIGHUP restart and re-create
   it after a successful restart, rather than leaving a stale file in
   the case of a configuration error. bz#2641

what do you think of this solution / backporting?

should fix shellinabox vulnarabilities from #21457

should fix shellinabox vulnarabilities from #21457 (cherry picked from commit d6254e0)

vcunat · 2016-12-29T07:59:46Z

I know little about this stuff. In master it'll be good to switch to --with-systemd, I guess, though that's not security-related. /cc openssh maintainer @aneeshusa. Context: previous comment and 661b5a9.

grahamc · 2016-12-29T11:49:44Z

@vcunat / @aneeshusa -- they don't create any sort of --with-systemd flag. That patch was rejected. The change they made makes it properly realize it is already backgrounded and not background itself if it is called by an init system. That is why my patch works, without adding a --with-systemd flag.

LnL7 · 2016-12-29T12:14:27Z

That's also how I understood it, if simple also works with services.openssh.startWhenNeeded it should be fine.

grahamc · 2016-12-29T23:15:11Z

I marked ceph as broken.

grahamc · 2016-12-30T03:12:57Z

Thank you, everyone, for their work!

/cc NixOS#21457. The rebuild impact is probably only a few thousand. The new utility is put into $out/bin/. (cherry picked from commit 421a7f3) Full bump done, as API+ABI only added new symbols in the meantime. https://abi-laboratory.pro/tracker/timeline/gdk-pixbuf/

should fix shellinabox vulnarabilities from NixOS#21457 (cherry picked from commit d6254e0)

grahamc added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Dec 28, 2016

vcunat added a commit that referenced this issue Dec 28, 2016

gdk-pixbuf: security 2.36.0 -> 2.36.2

421a7f3

/cc #21457. The rebuild impact is probably only a few thousand. The new utility is put into $out/bin/.

grahamc mentioned this issue Dec 28, 2016

qemu: fix CVE-2016-9911, CVE 2016-9921 and 2016-9922 #21482

Closed

7 tasks

dbalan pushed a commit to dbalan/nixpkgs that referenced this issue Dec 29, 2016

Shellinabox 2.19 -> 2.20

59cf49b

should fix shellinabox vulnarabilities from NixOS#21457

dbalan mentioned this issue Dec 29, 2016

Shellinabox 2.19 -> 2.20 #21486

Closed

7 tasks

grahamc pushed a commit that referenced this issue Dec 29, 2016

shellinabox: 2.19 -> 2.20

d6254e0

should fix shellinabox vulnarabilities from #21457

grahamc pushed a commit that referenced this issue Dec 29, 2016

shellinabox: 2.19 -> 2.20

67c5f30

should fix shellinabox vulnarabilities from #21457 (cherry picked from commit d6254e0)

grahamc mentioned this issue Dec 29, 2016

Patch Openssh for Roundup #15 #21500

Merged

7 tasks

grahamc closed this as completed Dec 30, 2016

grahamc mentioned this issue Jan 4, 2017

Vulnerability Roundup 16 #21642

Closed

38 tasks

adrianpk added a commit to adrianpk/nixpkgs that referenced this issue May 31, 2024

shellinabox: 2.19 -> 2.20

5fa3147

should fix shellinabox vulnarabilities from NixOS#21457 (cherry picked from commit d6254e0)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Vulnerability Roundup 15 #21457

Vulnerability Roundup 15 #21457

grahamc commented Dec 28, 2016 •

edited

Loading

grahamc commented Dec 28, 2016 •

edited

Loading

the-kenny commented Dec 28, 2016

grahamc commented Dec 28, 2016

grahamc commented Dec 28, 2016

7c6f434c commented Dec 28, 2016

grahamc commented Dec 28, 2016 •

edited

Loading

7c6f434c commented Dec 28, 2016

grahamc commented Dec 28, 2016

7c6f434c commented Dec 28, 2016

grahamc commented Dec 28, 2016

vcunat commented Dec 28, 2016

LnL7 commented Dec 28, 2016

vcunat commented Dec 28, 2016 •

edited

Loading

grahamc commented Dec 28, 2016

nlewo commented Dec 28, 2016

grahamc commented Dec 29, 2016

vcunat commented Dec 29, 2016

grahamc commented Dec 29, 2016

LnL7 commented Dec 29, 2016

grahamc commented Dec 29, 2016

grahamc commented Dec 30, 2016

Vulnerability Roundup 15 #21457

Vulnerability Roundup 15 #21457

Comments

grahamc commented Dec 28, 2016 • edited Loading

Notes on the list

Instructions:

Upon Completion ...

Assorted (17 issues)

gstreamer-plugins-good (2 issues)

grahamc commented Dec 28, 2016 • edited Loading

the-kenny commented Dec 28, 2016

grahamc commented Dec 28, 2016

grahamc commented Dec 28, 2016

7c6f434c commented Dec 28, 2016

grahamc commented Dec 28, 2016 • edited Loading

7c6f434c commented Dec 28, 2016

grahamc commented Dec 28, 2016

7c6f434c commented Dec 28, 2016

grahamc commented Dec 28, 2016

vcunat commented Dec 28, 2016

LnL7 commented Dec 28, 2016

vcunat commented Dec 28, 2016 • edited Loading

grahamc commented Dec 28, 2016

nlewo commented Dec 28, 2016

grahamc commented Dec 29, 2016

vcunat commented Dec 29, 2016

grahamc commented Dec 29, 2016

LnL7 commented Dec 29, 2016

grahamc commented Dec 29, 2016

grahamc commented Dec 30, 2016

grahamc commented Dec 28, 2016 •

edited

Loading

grahamc commented Dec 28, 2016 •

edited

Loading

grahamc commented Dec 28, 2016 •

edited

Loading

vcunat commented Dec 28, 2016 •

edited

Loading