openSUSE Security Update: Security update for privoxy
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2021:0460-1
Rating:             moderate
References:         #1183129 
Cross-References:   CVE-2021-20272 CVE-2021-20273 CVE-2021-20274
                    CVE-2021-20275 CVE-2021-20276
CVSS scores:
                    CVE-2021-20272 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2021-20273 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2021-20274 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2021-20275 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2021-20276 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:
                    openSUSE Backports SLE-15-SP2
______________________________________________________________________________

   An update that fixes 5 vulnerabilities is now available.

Description:

   This update for privoxy fixes the following issues:

   Update to version 3.0.32:

     - Security/Reliability (boo#1183129)

       - ssplit(): Remove an assertion that could be triggered with a crafted
         CGI request. Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272
         Reported by: Joshua Rogers (Opera)
       - cgi_send_banner(): Overrule invalid image types. Prevents a crash
         with a crafted CGI request if Privoxy is toggled off. Commit
         e711c505c48. OVE-20210206-0001. CVE-2021-20273 Reported by: Joshua
         Rogers (Opera)
       - socks5_connect(): Don't try to send credentials when none are
         configured. Fixes a crash due to a NULL-pointer dereference when the
         socks server misbehaves. Commit 85817cc55b9. OVE-20210207-0001.
         CVE-2021-20274 Reported by: Joshua Rogers (Opera)
       - chunked_body_is_complete(): Prevent an invalid read of size two.
         Commit a912ba7bc9c. OVE-20210205-0001. CVE-2021-20275 Reported by:
         Joshua Rogers (Opera)
       - Obsolete pcre: Prevent invalid memory accesses with an invalid
         pattern passed to pcre_compile(). Note that the obsolete pcre code
         is scheduled to be removed before the 3.0.33 release. There has been
         a warning since 2008 already. Commit 28512e5b624. OVE-20210222-0001.
         CVE-2021-20276 Reported by: Joshua Rogers (Opera)

     - Bug fixes:

       - Properly parse the client-tag-lifetime directive. Previously it was
         not accepted as an obsolete hash value was being used. Reported by:
         Joshua Rogers (Opera)
       - decompress_iob(): Prevent reading of uninitialized data. Reported
         by: Joshua Rogers (Opera).
       - decompress_iob(): Don't advance cur past eod when looking for the
         end of the file name and comment.
       - decompress_iob(): Cast value to unsigned char before shifting.
         Prevents a left-shift of a negative value which is undefined
         behaviour. Reported by: Joshua Rogers (Opera)
       - gif_deanimate(): Confirm that that we have enough data before doing
         any work. Fixes a crash when fuzzing with an empty document.
         Reported by: Joshua Rogers (Opera).
       - buf_copy(): Fail if there's no data to write or nothing to do.
         Prevents undefined behaviour "applying zero offset to null pointer".
         Reported by: Joshua Rogers (Opera)
       - log_error(): Treat LOG_LEVEL_FATAL as fatal even when --stfu is
         being used while fuzzing. Reported by: Joshua Rogers (Opera).
       - Respect DESTDIR when considering whether or not to install config
         files with ".new" extension.
       - OpenSSL ssl_store_cert(): Fix two error messages.
       - Fix a couple of format specifiers.
       - Silence compiler warnings when compiling with NDEBUG.
       - fuzz_server_header(): Fix compiler warning.
       - fuzz_client_header(): Fix compiler warning.
       - cgi_send_user_manual(): Also reject requests if the user-manual
         directive specifies a https:// URL. Previously Privoxy would try and
         fail to open a local file.

     - General improvements:

       - Log the TLS version and the the cipher when debug 2 is enabled.
       - ssl_send_certificate_error(): Respect HEAD requests by not sending a
         body.
       - ssl_send_certificate_error(): End the body with a single new line.
       - serve(): Increase the chances that the host is logged when closing a
         server socket.
       - handle_established_connection(): Add parentheses to clarify an
         expression Suggested by: David Binderman
       - continue_https_chat(): Explicitly unset
         CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE if process_encrypted_request()
         fails. This makes it more obvious that the connection will not be
         reused. Previously serve() relied on
         CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED being unset.
         Inspired by a patch from Joshua Rogers (Opera).
       - decompress_iob(): Add periods to a couple of log messages
       - Terminate the body of the HTTP snipplets with a single new line
         instead of "\r\n".
       - configure: Add --with-assertions option and only enable assertions
         when it is used
       - windows build: Use --with-brotli and --with-mbedtls by default and
         enable dynamic error checking.
       - gif_deanimate(): Confirm we've got an image before trying to write
         it Saves a pointless buf_copy() call.
       - OpenSSL ssl_store_cert(): Remove a superfluous space before the
         serial number.

     - Action file improvements:

       - Disable fast-redirects for .golem.de/
       - Unblock requests to adri*.
       - Block requests for trc*.taboola.com/
       - Disable fast-redirects for .linkedin.com/

     - Filter file improvements:

       - Make the second pcrs job of the img-reorder filter greedy again. The
         ungreedy version broke the img tags on:
         https://bulk.fefe.de/scalability/.

     - Privoxy-Log-Parser:

       - Highlight a few more messages.
       - Clarify the --statistics output. The shown "Reused connections" are
         server connections so name them appropriately.
       - Bump version to 0.9.3.

     - Privoxy-Regression-Test:

       - Add the --check-bad-ssl option to the --help output.
       - Bump version to 0.7.3.

     - Documentation:

       - Add pushing the created tag to the release steps in the developer
         manual.
       - Clarify that 'debug 32768' should be used in addition to the other
         debug directives when reporting problems.
       - Add a 'Third-party licenses and copyrights' section to the user
         manual.

   This update was imported from the openSUSE:Leap:15.2:Update update project.


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP2:

      zypper in -t patch openSUSE-2021-460=1



Package List:

   - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64):

      privoxy-3.0.32-bp152.4.9.1

   - openSUSE Backports SLE-15-SP2 (noarch):

      privoxy-doc-3.0.32-bp152.4.9.1


References:

   https://www.suse.com/security/cve/CVE-2021-20272.html
   https://www.suse.com/security/cve/CVE-2021-20273.html
   https://www.suse.com/security/cve/CVE-2021-20274.html
   https://www.suse.com/security/cve/CVE-2021-20275.html
   https://www.suse.com/security/cve/CVE-2021-20276.html
   https://bugzilla.suse.com/1183129