Docker grafana/grafana:6.7.0-beta1-ubuntu

Overview

Affected versions of this package are vulnerable to Improper Check for Dropped Privileges. An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Remediation

There is no fixed version for bash.

References

• CONFIRM
• Debian Security Tracker
• GitHub Commit
• MISC
• MISC
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Improper Input Validation chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for coreutils.

References

• Debian Security Tracker
• OSS security Advisory
• OSS security Advisory
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Directory Traversal dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

• Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

• Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

There is no fixed version for dpkg.

References

• Debian Security Tracker
• OSS security Advisory
• Security Focus
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Improper Input Validation. The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

Remediation

There is no fixed version for glibc.

References

• CONFIRM
• CONFIRM
• Debian Security Tracker
• GENTOO
• https://sourceware.org/bugzilla/show_bug.cgi?id=19519
• OSS security Advisory
• Security Focus
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Information Exposure. On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

Remediation

Upgrade glibc to version or higher.

References

• Debian Security Tracker
• FEDORA
• Fedora Security Update
• MISC
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Integer Underflow. An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

Remediation

There is no fixed version for glibc.

References

• ADVISORY
• Debian Security Tracker
• FEDORA
• FEDORA
• GENTOO
• MISC
• MISC

Overview

Affected versions of this package are vulnerable to Use After Free. A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

Remediation

Upgrade glibc to version or higher.

References

• CONFIRM
• CONFIRM
• Debian Security Tracker
• GENTOO
• Netapp Security Advisory
• RedHat Bugzilla Bug
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch. Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.

Remediation

There is no fixed version for gnupg2.

References

• CONFIRM
• CONFIRM
• CONFIRM
• FEDORA
• FEDORA
• MISC
• MISC
• SUSE
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm. A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.

Remediation

There is no fixed version for gnupg2.

References

• ADVISORY
• Debian Security Tracker
• MISC
• MISC
• MISC
• RedHat Bugzilla Bug
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

Remediation

There is no fixed version for krb5.

References

• CVE Details
• Debian Security Tracker
• GitHub Additional Information
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Cryptographic Issues. ** DISPUTED ** In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack.

Remediation

There is no fixed version for libgcrypt20.

References

• CVE Details
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• MISC
• OpenSuse Security Announcement
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Resource Management Errors. GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.

Remediation

There is no fixed version for libtasn1-6.

References

• CONFIRM
• CVE Details
• Debian Security Tracker
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Security Focus
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Buffer Overflow. LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Remediation

There is no fixed version for lz4.

References

• ADVISORY
• Apache Security Advisory
• Apache Security Advisory
• Apache Security Advisory
• Apache Security Advisory
• Apache Security Advisory
• Debian Security Tracker
• GitHub Diff
• GitHub Issue
• GitHub PR
• GitHub PR
• MISC
• MISC
• MISC
• MLIST
• MLIST
• MLIST
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read. There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for ncurses.

References

• Debian Security Tracker
• GENTOO
• MISC
• MISC
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read. There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Remediation

There is no fixed version for ncurses.

References

• Debian Security Tracker
• GENTOO
• MISC
• MISC
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Improper Initialization slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.

Remediation

There is no fixed version for openldap.

References

• CVE Details
• Debian Security Tracker
• MISC
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Information Exposure. There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

Remediation

Upgrade openssl to version or higher.

References

• ADVISORY
• Bugtraq Mailing List
• Bugtraq Mailing List
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• DEBIAN
• Debian Security Advisory
• Debian Security Tracker
• FEDORA
• FEDORA
• FEDORA
• GENTOO
• MISC
• MISC
• MISC
• Netapp Security Advisory
• OpenSSL Security Advisory
• OpenSuse Security Announcement
• UBUNTU
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data. Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Remediation

Upgrade openssl to version or higher.

References

• ADVISORY
• BUGTRAQ
• BUGTRAQ
• Bugtraq Mailing List
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• DEBIAN
• DEBIAN
• Debian Security Tracker
• FEDORA
• FEDORA
• GENTOO
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST
• N/A
• Netapp Security Advisory
• OpenSSL Security Advisory
• SUSE
• SUSE
• SUSE
• SUSE
• UBUNTU
• UBUNTU
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data. In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Remediation

Upgrade openssl to version or higher.

References

• ADVISORY
• BUGTRAQ
• BUGTRAQ
• Bugtraq Mailing List
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• DEBIAN
• DEBIAN
• Debian Security Tracker
• FEDORA
• FEDORA
• GENTOO
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST
• N/A
• Netapp Security Advisory
• OpenSSL Security Advisory
• SUSE
• SUSE
• SUSE
• SUSE
• UBUNTU
• UBUNTU
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Use of Insufficiently Random Values. OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).

Remediation

Upgrade openssl to version or higher.

References

• ADVISORY
• BUGTRAQ
• CONFIRM
• CONFIRM
• CONFIRM
• DEBIAN
• Debian Security Tracker
• FEDORA
• Fedora Security Update
• MISC
• MISC
• MISC
• MISC
• N/A
• Netapp Security Advisory
• OpenSSL Security Advisory
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read. An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.

Remediation

There is no fixed version for pcre2.

References

• Debian Security Tracker
• FEDORA
• GENTOO
• MISC
• MISC
• MISC
• RedHat Bugzilla Bug
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.

Remediation

There is no fixed version for pcre3.

References

• ADVISORY
• ADVISORY
• CONFIRM
• CONFIRM
• CONFIRM
• FULLDISC
• FULLDISC
• MISC
• MISC

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.

Remediation

There is no fixed version for pcre3.

References

• ADVISORY
• ADVISORY
• CONFIRM
• CONFIRM
• FULLDISC
• FULLDISC
• MISC
• MISC

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion. In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

Remediation

There is no fixed version for pcre3.

References

• CVE Details
• Debian Security Tracker
• OSS security Advisory
• Security Focus
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Buffer Overflow regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. An application written in Perl would only be vulnerable to this flaw if it evaluates regular expressions supplied by the attacker. Evaluating regular expressions in this fashion is known to be dangerous since the regular expression engine does not protect against denial of service attacks in this usage scenario.]

Remediation

There is no fixed version for perl.

References

• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• Debian Security Tracker
• FEDORA
• GENTOO
• MISC
• MISC
• MISC
• MISC
• SUSE
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. An application written in Perl would only be vulnerable to this flaw if it evaluates regular expressions supplied by the attacker. Evaluating regular expressions in this fashion is known to be dangerous since the regular expression engine does not protect against denial of service attacks in this usage scenario.]

Remediation

There is no fixed version for perl.

References

• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• Debian Security Tracker
• FEDORA
• GENTOO
• MISC
• MISC
• SUSE
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write. Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. An application written in Perl would only be vulnerable to this flaw if it evaluates regular expressions supplied by the attacker. Evaluating regular expressions in this fashion is known to be dangerous since the regular expression engine does not protect against denial of service attacks in this usage scenario. Additionally, the target system needs a sufficient amount of memory to allocate partial expansions of the nested quantifiers prior to the overflow occurring. This requirement is unlikely to be met on 64bit systems.]

Remediation

There is no fixed version for perl.

References

• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• Debian Security Tracker
• FEDORA
• GENTOO
• MISC
• MISC
• SUSE
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource. An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used "group blacklisting" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.

Remediation

There is no fixed version for shadow.

References

• Debian Security Tracker
• Gentoo Security Advisory
• MISC
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees

Remediation

There is no fixed version for shadow.

References

• Debian Security Tracker
• RedHat Bugzilla Bug
• RedHat CVE Database
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to CVE-2019-19603. SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.

Remediation

Upgrade sqlite3 to version or higher.

References

• Debian Security Tracker
• GitHub Commit
• MISC
• N/A
• Netapp Security Advisory
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to CVE-2020-13631. SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

Remediation

Upgrade sqlite3 to version or higher.

References

• ADVISORY
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• CONFIRM
• Debian Security Tracker
• FEDORA
• FREEBSD
• FULLDISC
• FULLDISC
• FULLDISC
• FULLDISC
• GENTOO
• MISC
• MISC
• MISC
• MISC
• UBUNTU

Overview

Affected versions of this package are vulnerable to Improper Input Validation. SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

Remediation

Upgrade sqlite3 to version or higher.

References

• ADVISORY
• Debian Security Tracker
• FREEBSD
• GENTOO
• MISC
• MISC
• MISC
• MISC
• MISC
• MLIST
• MLIST
• Netapp Security Advisory
• UBUNTU

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.

Remediation

Upgrade sqlite3 to version or higher.

References

• Debian Security Tracker
• GitHub Commit
• N/A
• Netapp Security Advisory
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Improper Input Validation systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

Remediation

There is no fixed version for systemd.

References

• ADVISORY
• CONFIRM
• Debian Security Tracker
• FEDORA
• GitHub Issue

Overview

Affected versions of this package are vulnerable to NULL Pointer Dereference pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.

Remediation

There is no fixed version for tar.

References

• Debian Security Tracker
• MISC
• MISC
• MISC
• OpenSuse Security Announcement
• Ubuntu CVE Tracker