Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -1 articles for you...
198
security advisoryhigh severityarbitrary code executionArch Linux: 202110-6 High Severity: Nodejs-Lts-Erbium Multiple Issues
The package nodejs-lts-erbium before version 12.22.7-1 is vulnerable to multiple issues including arbitrary code execution, url request injection and certificate verification bypass. . Arch Linux Security Advisory ASA-202110-6 ======================================== Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-22939 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960 Package : nodejs-lts-erbium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2285 Summary ====== The package nodejs-lts-erbium before version 12.22.7-1 is vulnerable to multiple issues including arbitrary code execution, url request injection and certificate verification bypass. Resolution ========= Upgrade to 12.22.7-1. # pacman -Syu "nodejs-lts-erbium> =12.22.7-1" The problems have been fixed upstream in version 12.22.7. Workaround ========= None. Description ========== - CVE-2021-22939 (certificate verification bypass) If the Node.js https API in versions before 16.6.2, 14.17.5 and 12.22.5 was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. - CVE-2021-22940 (arbitrary code execution) Node.js before versions 16.6.2, 14.17.5 and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. The issue is a follow on to CVE-2021-22930 as the issue was not completely resolved in the fix for CVE-2021-22930. - CVE-2021-22959 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). - CVE-2021-22960 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing the body of chunked requests. Thisleads to HTTP Request Smuggling (HRS) under certain conditions. Impact ===== Incorrect use of the https API could lead to expired certificates being accepted. Furthermore a remote attacker could execute arbitrary code or inject HTTP requests through crafted queries. References ========= https://bugs.archlinux.org/task/72412 https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#incomplete-validation-of-rejectunauthorized-parameter-low-cve-2021-22939 https://hackerone.com/reports/1278254 https://github.com/nodejs/node/commit/6c7fff6f1d53dfb6c2b184ee41809b8d7614cb80 https://github.com/nodejs/node/commit/35b86110e45083a75d7dc8e6be5a930b262494f6 https://github.com/nodejs/node/commit/1780bbc3291357f7c3370892eb311fc7a62afe8d https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-after-free-on-close-http2-on-stream-canceling-high-cve-2021-22940 https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/pull/39622 https://github.com/nodejs/node/commit/a3c33d4ce78f74d1cf1765704af5b427aa3840a6 https://github.com/nodejs/node/commit/2008c9722fcf7591e39013691f303934b622df7b https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-due-to-spaced-in-headers-medium-cve-2021-22959 https://hackerone.com/reports/1238099 https://hackerone.com/reports/1238709 https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3b91 https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9fdd4 https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a0f0 https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-when-parsing-the-body-medium-cve-2021-22960 https://security.archlinux.org/CVE-2021-22939 https://security.archlinux.org/CVE-2021-22940 https://security.archlinux.org/CVE-2021-22959 https://security.archlinux.org/CVE-2021-22960 . The latest Arch Linux Security Notice concerning python-3.7 points out significant vulnerabilities across various threat categories. It isadvised to apply updates immediately!. nodejs security update, Arch Linux advisory, code execution risk. . LinuxSecurity.com Team
Oct 21, 2021
ArchLinux
198
security advisoryarbitrary code executionArch LinuxArch Linux: 202110-5 High Severity: NodeJS Remote Code Execution Advisory
The package nodejs-lts-fermium before version 14.18.1-1 is vulnerable to multiple issues including arbitrary code execution, url request injection and certificate verification bypass. . Arch Linux Security Advisory ASA-202110-5 ======================================== Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-22939 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960 Package : nodejs-lts-fermium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2284 Summary ====== The package nodejs-lts-fermium before version 14.18.1-1 is vulnerable to multiple issues including arbitrary code execution, url request injection and certificate verification bypass. Resolution ========= Upgrade to 14.18.1-1. # pacman -Syu "nodejs-lts-fermium> =14.18.1-1" The problems have been fixed upstream in version 14.18.1. Workaround ========= None. Description ========== - CVE-2021-22939 (certificate verification bypass) If the Node.js https API in versions before 16.6.2, 14.17.5 and 12.22.5 was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. - CVE-2021-22940 (arbitrary code execution) Node.js before versions 16.6.2, 14.17.5 and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. The issue is a follow on to CVE-2021-22930 as the issue was not completely resolved in the fix for CVE-2021-22930. - CVE-2021-22959 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). - CVE-2021-22960 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing the body of chunked requests.This leads to HTTP Request Smuggling (HRS) under certain conditions. Impact ===== Incorrect use of the https API could lead to expired certificates being accepted. Furthermore a remote attacker could execute arbitrary code or inject HTTP requests through crafted queries. References ========= https://bugs.archlinux.org/task/72413 https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#incomplete-validation-of-rejectunauthorized-parameter-low-cve-2021-22939 https://hackerone.com/reports/1278254 https://github.com/nodejs/node/commit/6c7fff6f1d53dfb6c2b184ee41809b8d7614cb80 https://github.com/nodejs/node/commit/35b86110e45083a75d7dc8e6be5a930b262494f6 https://github.com/nodejs/node/commit/1780bbc3291357f7c3370892eb311fc7a62afe8d https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-after-free-on-close-http2-on-stream-canceling-high-cve-2021-22940 https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/pull/39622 https://github.com/nodejs/node/commit/a3c33d4ce78f74d1cf1765704af5b427aa3840a6 https://github.com/nodejs/node/commit/2008c9722fcf7591e39013691f303934b622df7b https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-due-to-spaced-in-headers-medium-cve-2021-22959 https://hackerone.com/reports/1238099 https://hackerone.com/reports/1238709 https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3b91 https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9fdd4 https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a0f0 https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-when-parsing-the-body-medium-cve-2021-22960 https://security.archlinux.org/CVE-2021-22939 https://security.archlinux.org/CVE-2021-22940 https://security.archlinux.org/CVE-2021-22959 https://security.archlinux.org/CVE-2021-22960 . The nodejs-lts-fermium package on Arch Linux has several vulnerabilities that necessitate a prompt update to secure the system.. NodejsFixes, Linux Package Security, Arch Linux Update, System Vulnerabilities. . LinuxSecurity.com Team
Oct 21, 2021
ArchLinux
198
security advisorymedium severityarch linuxArch Linux ASA-202107-28 Medium: Varnish URL Injection Threat
The package varnish before version 6.6.1-1 is vulnerable to url request injection. . Arch Linux Security Advisory ASA-202107-28 ========================================= Severity: Medium Date : 2021-07-14 CVE-ID : CVE-2021-36740 Package : varnish Type : url request injection Remote : Yes Link : https://security.archlinux.org/AVG-2154 Summary ====== The package varnish before version 6.6.1-1 is vulnerable to url request injection. Resolution ========= Upgrade to 6.6.1-1. # pacman -Syu "varnish> =6.6.1-1" The problem has been fixed upstream in version 6.6.1. Workaround ========= The issue can be mitigated by turning off support for HTTP/2, using sudo varnishadm param.set feature -http2 or by preventing connection reuse with the following configuration: sub vcl_backend_fetch { set bereq.http.Connection = "close"; } Description ========== Varnish Cache before version 6.6.1, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. Impact ===== A remote attacker could inject arbitrary HTTP requests through an HTTP/2 POST request with a large Content-Length header. References ========= https://vinyl-cache.org/security/VSV00007.html https://github.com/varnishcache/varnish-cache/commit/7d73bc843ea9bff79e33773f1cfe2dffa7d03ea1 https://security.archlinux.org/CVE-2021-36740 . The Debian Security Advisory DSA-2021-03 highlights a critical vulnerability in the OpenSSL package before version 1.1.1k.. Arch Linux,Varnish,Software Update,Security Advisory,Internet Attack. . Severity: Medium. LinuxSecurity.com Team
Jul 16, 2021
•Medium
ArchLinux
198
security advisorydenial of servicehigh severityArch Linux: 202105-3 High Severity: Ceph Multiple Issues Summary
The package ceph before version 15.2.12-1 is vulnerable to multiple issues including insufficient validation, cross-site scripting, denial of service and url request injection. . Arch Linux Security Advisory ASA-202105-3 ======================================== Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-3509 CVE-2021-3524 CVE-2021-3531 CVE-2021-20288 Package : ceph Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1826 Summary ====== The package ceph before version 15.2.12-1 is vulnerable to multiple issues including insufficient validation, cross-site scripting, denial of service and url request injection. Resolution ========= Upgrade to 15.2.12-1. # pacman -Syu "ceph> =15.2.12-1" The problems have been fixed upstream in version 15.2.12. Workaround ========= None. Description ========== - CVE-2021-3509 (cross-site scripting) A security issue was found in ceph before version 15.2.12. In order to make the JWT token inaccessible through cross-site scripting (XSS), it was moved from localStorage to httpOnly Cookie (CVE-2020-27839). But token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS. - CVE-2021-3524 (url request injection) A security issue was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) before version 15.2.12. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. In addition, the prior bug fix for CVE-2020-10753 did not account for the use of \r as a header separator, thus a new flaw has been created. - CVE-2021-3531 (denial of service) A security issue was found in the Red Hat Ceph Storage RGW before version 15.2.12. When processing a GET Request for a swift URL that ends with two slashes it can cause the rgw to crash, resulting in a denial of service. - CVE-2021-20288(insufficient validation) An authentication flaw was found in ceph before version 15.2.11. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associated with another user, as ceph does not force the reuse of old keys to generate new ones. Impact ===== A remote attacker could obtain a user's access token using cross-site scripting, inject headers into requests to bypass CORS, crash the server using a crafted request, or reuse old authentication keys. References ========= https://bugs.archlinux.org/task/70450 https://bugzilla.redhat.com/show_bug.cgi?id=1950116 https://github.com/ceph/ceph/commit/7a1ca8d372da3b6a4fc3d221a0e5f72d1d61c27b https://bugzilla.redhat.com/show_bug.cgi?id=1951674 https://github.com/ceph/ceph/commit/94f7c87a78b05ec856a5ee1ff62af136331776a3 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2021-3531 https://github.com/ceph/ceph/commit/b87e64e3206210580f4a6df2d77f9ae3f1033039 https://www.openwall.com/lists/oss-security/2021/04/14/2 https://bugzilla.redhat.com/show_bug.cgi?id=1938031 https://github.com/ceph/ceph/commit/1f57617d5edb45a8a696eac7c910e8fc44c934a3 https://github.com/ceph/ceph/commit/9f3efe7cd1a780b91e5c8cfee192a0c51d0151dc https://security.archlinux.org/CVE-2021-3509 https://security.archlinux.org/CVE-2021-3524 https://security.archlinux.org/CVE-2021-3531 https://security.archlinux.org/CVE-2021-20288 . Debian Linux Security Notice DLA-1234-1 for glibc emphasizes essential updates that tackle various vulnerabilities.. Arch Linux, Ceph Package, High Severity Issues, Security Fixes. . LinuxSecurity.com Team
May 20, 2021
ArchLinux
198
security advisorysoftware updatecode executionArch Linux: ASA-202102-37 Medium Severity Python Code Execution Issues
The package python before version 3.9.2-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. . Arch Linux Security Advisory ASA-202102-37 ========================================= Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2021-3177 CVE-2021-23336 Package : python Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1465 Summary ====== The package python before version 3.9.2-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========= Upgrade to 3.9.2-1. # pacman -Syu "python> =3.9.2-1" The problems have been fixed upstream in version 3.9.2. Workaround ========= None. Description ========== - CVE-2021-3177 (arbitrary code execution) Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely. - CVE-2021-23336 (url request injection) The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. The package python-django contains a copy of urllib.parse.parse_qsl() which was added to backport some security fixes. A further security fix has been issued in versions 3.1.7, 3.0.13 and 2.2.19such that parse_qsl() no longer allows using ; as a query parameter separator by default. Impact ===== A malicious format string could execute code and a malicious user could send crafted HTTP queries poisoning the cache. References ========= https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html https://bugs.python.org/issue42938 https://github.com/python/cpython/pull/24239 https://github.com/python/cpython/commit/c347cbe694743cee120457aa6626712f7799a932 https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/ https://bugs.python.org/issue42967 https://github.com/python/cpython/pull/24297 https://github.com/python/cpython/commit/c9f07813ab8e664d8c34413c4fc2d4f86c061a92 https://www.djangoproject.com/weblog/2021/feb/19/security-releases/ https://github.com/django/django/commit/8f6d431b08cbb418d9144b976e7b972546607851 https://security.archlinux.org/CVE-2021-3177 https://security.archlinux.org/CVE-2021-23336 . A number of vulnerabilities identified in the Python module on Arch Linux classified with medium risk. It is advisable to perform an update to mitigate these threats.. Arch Linux Security, Python Update, Code Execution Issues, Request Injection, Package Upgrade. . Severity: Medium. LinuxSecurity.com Team
Mar 01, 2021
•Medium
ArchLinux
198
security advisorysecurity issuemedium severityArch Linux: ASA-202102-28 Medium: Python-Django URL Request Injection
The package python-django before version 3.1.7-1 is vulnerable to url request injection. . Arch Linux Security Advisory ASA-202102-28 ========================================= Severity: Medium Date : 2021-02-20 CVE-ID : CVE-2021-23336 Package : python-django Type : url request injection Remote : Yes Link : https://security.archlinux.org/AVG-1593 Summary ====== The package python-django before version 3.1.7-1 is vulnerable to url request injection. Resolution ========= Upgrade to 3.1.7-1. # pacman -Syu "python-django> =3.1.7-1" The problem has been fixed upstream in version 3.1.7. Workaround ========= None. Description ========== The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. The package python-django contains a copy of urllib.parse.parse_qsl() which was added to backport some security fixes. A further security fix has been issued in versions 3.1.7, 3.0.13 and 2.2.19 such that parse_qsl() no longer allows using ; as a query parameter separator by default. Impact ===== A remote attacker is able to insert malicious requests in the webproxy cache. References ========= https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/ https://bugs.python.org/issue42967 https://github.com/python/cpython/pull/24297 https://github.com/python/cpython/commit/c9f07813ab8e664d8c34413c4fc2d4f86c061a92 https://www.djangoproject.com/weblog/2021/feb/19/security-releases/ https://github.com/django/django/commit/8f6d431b08cbb418d9144b976e7b972546607851 https://security.archlinux.org/CVE-2021-23336 . Explore Arch Linux Advisory ASA-202102-29 detailing a medium-risk vulnerability related to URL request injection in python-django, including key updates and mitigation strategies.. Arch Linux, Python-Django, URL Injection, Security Advisory. . Severity: Medium. LinuxSecurity.com Team
Feb 22, 2021
•Medium
ArchLinux
198
security advisoryhigh severitysoftware updateArch Linux: ASA-202101-13 High Severity: Nodejs-LTS-Dubnium Issues
The package nodejs-lts-dubnium before version 10.23.1-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. . Arch Linux Security Advisory ASA-202101-13 ========================================= Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-8265 CVE-2020-8287 Package : nodejs-lts-dubnium Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1403 Summary ====== The package nodejs-lts-dubnium before version 10.23.1-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========= Upgrade to 10.23.1-1. # pacman -Syu "nodejs-lts-dubnium> =10.23.1-1" The problems have been fixed upstream in version 10.23.1. Workaround ========= None. Description ========== - CVE-2020-8265 (arbitrary code execution) The nodejs release lines 15.x, 14.x, 12.x and 10.x are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. - CVE-2020-8287 (url request injection) The nodejs release lines 15.x, 14.x, 12.x and 10.x allow two copies of a header field in an HTTP request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. Impact ===== A malicious user could achieve data exfiltration through HTTP headersor execute arbitrary code through poor APIusage. References ========= https://groups.google.com/g/nodejs-sec/c/kyzmwvQdUfs/m/7mjPCzY2BAAJ https://github.com/nodejs/node/commit/9834ef85a0a549a45a98f04dc51af1782a7126ee https://github.com/nodejs/node/commit/4f8772f9b731118628256189b73cd202149bbd97 https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268bb6 https://github.com/nodejs/node/commit/7f178663ebffc82c9f8a5a1b6bf2da0c263a30ed https://github.com/nodejs/node/commit/357e2857c8385c303782ced2ac8b568df06d4326 https://github.com/nodejs/node/commit/e0c9a2285cfe18642d15d5ed9b7122755c6e66e0 https://github.com/nodejs/node/commit/c5dbe831b714b3a98c59ba2406b791fb27016d79 https://github.com/nodejs/node/commit/641f786bb1a1f6eb1ff8750782ed939780f2b31a https://github.com/nodejs/node/commit/7ecac8143f0a91785ed0bd3b4d9aab5d98419b41 https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50ee4a https://github.com/nodejs/node/commit/4a30ac8c755d0701e773831ce22153b66bb36305 https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc14b https://github.com/nodejs/node/commit/fc70ce08f5818a286fb5899a1bc3aff5965a745e https://github.com/nodejs/node/commit/aa6b97fb99d7528649fadb4c6a894e078fe4323c https://security.archlinux.org/CVE-2020-8265 https://security.archlinux.org/CVE-2020-8287 . Critical alert for Arch Linux users regarding nodejs-lts-dubnium security flaws. Ensure your systems are updated immediately for protection.. Nodejs Risks, Arch Linux Security, Code Execution Risk. . LinuxSecurity.com Team
Jan 15, 2021
ArchLinux
198
security advisoryremote accesslow severityArch Linux: ASA-201501-9 Low: Curl URL Request Injection
The package curl before version 7.40.0-1 is vulnerable to an URL request injection issue when using a HTTP proxy. . Arch Linux Security Advisory ASA-201501-9 ======================================== Severity: Low Date : 2015-01-18 CVE-ID : CVE-2014-8150 Package : curl Type : url request injection Remote : Yes Link : https://wiki.archlinux.org/title/CVE Summary ====== The package curl before version 7.40.0-1 is vulnerable to an URL request injection issue when using a HTTP proxy. Resolution ========= Upgrade to 7.40.0-1. # pacman -Syu "curl> =7.40.0-1" The problem has been fixed upstream in version 7.40.0. Workaround ========= Only use URLs that are carefully stripped from line feeds and carriage returns. Description ========== When libcurl sends a request to a server via a HTTP proxy, it copies the entire URL into the request and sends if off. If the given URL contains line feeds and carriage returns those will be sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL. Many programs allow some kind of external sources to set the URL or provide partial pieces for the URL to ask for, and if the URL as received from the user is not stripped good enough this flaw allows malicious users to do additional requests in a way that was not intended, or just to insert request headers into the request that the program didn't intend. Impact ===== A remote attacker may be able to inject arbitrary HTTP headers, or even send a completely new HTTP request by placing CRLF in the URL passed to curl or libcurl. References ========= http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8150 https://curl.se/docs/CVE-2014-8150.html https://bugs.archlinux.org/task/43379 . Arch Linux Security Bulletin ASA-202101-5: Curl versions prior to 7.78.0-1 exhibit minor vulnerability pertaining to unsafe URL handling.. Arch Linux, URL Injection, Curl Security. . Severity: Low. LinuxSecurity.comTeam
Jan 19, 2015
•Low
ArchLinux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!