openSUSE Security Update: Security update for barrier
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2021:1595-1
Rating:             moderate
References:         
Cross-References:   CVE-2021-42072 CVE-2021-42073
Affected Products:
                    openSUSE Backports SLE-15-SP3
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:

   This update for barrier fixes the following issues:

   Updated to version 2.4.0:

   Barrier now supports client identity verification (fixes CVE-2021-42072,
   CVE-2021-42073).

   Previously a malicious client could connect to Barrier server without any
   authentication and send application-level messages. This made the attack
   surface of Barrier significantly larger. Additionally, in case the
   malicious client got possession of a valid screen name by brute forcing or
   other means it could modify the clipboard contents of the server. To
   support seamless upgrades from older versions of Barrier this is currently
   disabled by default. The feature can be enabled in the settings dialog. If
   enabled, older clients of Barrier will be rejected. Barrier now uses
   SHA256 fingerprints for establishing security of encrypted SSL
   connections. After upgrading client to new version the existing server
   fingerprint will need to be approved again. Client and server will show
   both SHA1 and SHA256 server fingerprints to allow interoperability with
   older versions of Barrier.

   Bugfixes:

   * Fixed build failure on mips*el and riscv64 architecture.
   * Barrier no longer uses openssl CLI tool for any operations and hooks
     into the openssl library directly.
   * More X11 clipboard MIME types have been mapped to corresponding
     converters (#344).
   * Fixed setup of multiple actions associated with a hotkey.
   * Fixed setup of hotkeys with special characters such as comma and
     semicolon (#778).
   * Fixed transfer of non-ASCII characters coming from a Windows server in
     certain cases (#527).
   * Barrier will now regenerate server certificate if it's invalid instead
     of failing to launch (#802)
   * Added support for additional keys on Sun Microsystems USB keyboards
     (#784).
   * Updated Chinese translation.
   * Updated Slovak translation.
   * Theme icons are now preferred to icons distributed together with Barrier
     (#471).

   Features:

   * Added --drop-target option that improves drag and drop support on
     Windows when Barrier is being run as a portable app.
   * The --enable-crypto command line option has been made the default to
     reduce chances of accidental security mishaps when configuring Barrier
     from command line. A new --disable-crypto command line option has been
     added to explicitly disable encryption.
   * Added support for randomart images for easier comparison of SSL
     certificate fingerprints. The algorithm is identical to what OpenSSH
     uses.
   * Implemented a configuration option for Server GUI auto-start.
   * Made it possible to use keyboard instead of mouse to modify screen
     layout.
   * Added support for keyboard backlight media keys
   * Added support for Eisu_toggle and Muhenkan keys
   * Added --profile-dir option that allows to select custom profile
     directory.

   submitted upstream at https://github.com/symless/synergy-core/pull/6261

   * Bug #4749 - Clipboard thread race condition causes assertion
   * Bug #4720 - Plugin download shows 'Could not get Linux package
   * Bug #4712 - Unable to send clipboard with size above 1KB when
   * Bug #4690 - Log line 'activeDesktop' does not use logging
   * Enhancement #4901 - Auto restart when running from GUI in
   * Bug #4650 - SSL error log message repeats excessively and
   * Bug #4601 - Large clipboard data with SSL causes 'protocol is
   * Bug #4593 - Locking Windows server causes SSL_ERROR_SSL to
   * Bug #4538 - Windows service crashes intermittently with no
   * Bug #4566 - Client or server crashes with 'ssl handshake
   * Bug #4706 - Installer is not output to build config dir
   * Bug #4704 - Plugin 'ns' release build is overwritten with
   * Bug #4697 - Timing can allow an SSL socket to be used after
   * Enhancement #4661 - Log error but do not crash when failing
   * Enhancement #4708 - Download ns plugin for specific Mac
   * Enhancement #4587 - Include OpenSSL binaries in source for
   * Enhancement #4695 - Automatically upload plugins as


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP3:

      zypper in -t patch openSUSE-2021-1595=1



Package List:

   - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le x86_64):

      barrier-2.4.0-bp153.2.3.1


References:

   https://www.suse.com/security/cve/CVE-2021-42072.html
   https://www.suse.com/security/cve/CVE-2021-42073.html