NVD Description

Note: Versions mentioned in the description apply only to the upstream cyrus-sasl2 package and not the cyrus-sasl2 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

Remediation

Upgrade Debian:9 cyrus-sasl2 to version 2.1.27~101-g0780600+dfsg-3+deb9u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-24407
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4FIXU75Q6RBNK6UYM7MQ3TCFGXR7AX4U/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H26R4SMGM3WHXX4XYNNJB4YGFIL5UNF4/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZC6BMPI3V3MC2IGNLN377ETUWO7QBIH/
• http://www.openwall.com/lists/oss-security/2022/02/23/4
• https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst
• https://lists.debian.org/debian-lts-announce/2022/03/msg00002.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FIXU75Q6RBNK6UYM7MQ3TCFGXR7AX4U/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H26R4SMGM3WHXX4XYNNJB4YGFIL5UNF4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZC6BMPI3V3MC2IGNLN377ETUWO7QBIH/
• https://security.netapp.com/advisory/ntap-20221007-0003/
• https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28
• https://www.debian.org/security/2022/dsa-5087
• https://www.oracle.com/security-alerts/cpujul2022.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

Remediation

Upgrade Debian:9 expat to version 2.2.0-2+deb9u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-45960
• https://bugzilla.mozilla.org/show_bug.cgi?id=1217609
• https://github.com/libexpat/libexpat/issues/531
• https://github.com/libexpat/libexpat/pull/534
• http://www.openwall.com/lists/oss-security/2022/01/17/3
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://security.gentoo.org/glsa/202209-24
• https://security.netapp.com/advisory/ntap-20220121-0004/
• https://www.debian.org/security/2022/dsa-5073
• https://www.tenable.com/security/tns-2022-05

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Debian:9 expat to version 2.2.0-2+deb9u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-22827
• http://www.openwall.com/lists/oss-security/2022/01/17/3
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://github.com/libexpat/libexpat/pull/539
• https://security.gentoo.org/glsa/202209-24
• https://www.debian.org/security/2022/dsa-5073
• https://www.tenable.com/security/tns-2022-05

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Debian:9 expat to version 2.2.0-2+deb9u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-22825
• http://www.openwall.com/lists/oss-security/2022/01/17/3
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://github.com/libexpat/libexpat/pull/539
• https://security.gentoo.org/glsa/202209-24
• https://www.debian.org/security/2022/dsa-5073
• https://www.tenable.com/security/tns-2022-05

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Debian:9 expat to version 2.2.0-2+deb9u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-22826
• http://www.openwall.com/lists/oss-security/2022/01/17/3
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://github.com/libexpat/libexpat/pull/539
• https://security.gentoo.org/glsa/202209-24
• https://www.debian.org/security/2022/dsa-5073
• https://www.tenable.com/security/tns-2022-05

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

Remediation

Upgrade Debian:9 git to version 1:2.11.0-3+deb9u5 or higher.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1387
• https://security-tracker.debian.org/tracker/CVE-2019-1387
• https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/T/#u
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/
• https://security.gentoo.org/glsa/202003-30
• https://security.gentoo.org/glsa/202003-42
• https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/
• https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html
• https://access.redhat.com/errata/RHSA-2020:0124
• https://access.redhat.com/errata/RHSA-2020:0228
• https://access.redhat.com/errata/RHSA-2019:4356
• https://access.redhat.com/errata/RHSA-2020:0002
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-1387
• https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/
• https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
• https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.

Remediation

Upgrade Debian:9 git to version 1:2.11.0-3+deb9u5 or higher.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1352
• https://security-tracker.debian.org/tracker/CVE-2019-1352
• https://security.gentoo.org/glsa/202003-30
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352
• https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html
• https://access.redhat.com/errata/RHSA-2020:0228
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-1352
• https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.

Remediation

Upgrade Debian:9 git to version 1:2.11.0-3+deb9u5 or higher.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1349
• https://security-tracker.debian.org/tracker/CVE-2019-1349
• https://security.gentoo.org/glsa/202003-30
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349
• https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html
• https://access.redhat.com/errata/RHSA-2020:0228
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-1349
• https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/

NVD Description

Note: Versions mentioned in the description apply only to the upstream gzip package and not the gzip package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

Remediation

Upgrade Debian:9 gzip to version 1.6-5+deb9u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-1271
• https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f0589cb63d6
• https://access.redhat.com/security/cve/CVE-2022-1271
• https://bugzilla.redhat.com/show_bug.cgi?id=2073310
• https://git.tukaani.org/?p=xz.git%3Ba=commit%3Bh=69d1b3fc29677af8ade8dc15dba83f0589cb63d6
• https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html
• https://security.gentoo.org/glsa/202209-01
• https://security.netapp.com/advisory/ntap-20220930-0006/
• https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch
• https://www.openwall.com/lists/oss-security/2022/04/07/8

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade Debian:9 sqlite3 to version 3.16.2-5+deb9u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2019-5827
• https://seclists.org/bugtraq/2019/Aug/19
• https://crbug.com/952406
• https://www.debian.org/security/2019/dsa-4500
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CPM7VPE27DUNJLXM4F5PAAEFFWOEND6X/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FKN4GPMBQ3SDXWB4HL45II5CZ7P2E4AI/
• https://security.gentoo.org/glsa/202003-16
• https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_30.html
• https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html
• https://usn.ubuntu.com/4205-1/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-5827
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CPM7VPE27DUNJLXM4F5PAAEFFWOEND6X/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKN4GPMBQ3SDXWB4HL45II5CZ7P2E4AI/

NVD Description

Note: Versions mentioned in the description apply only to the upstream xz-utils package and not the xz-utils package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

Remediation

Upgrade Debian:9 xz-utils to version 5.2.2-1.2+deb9u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-1271
• https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f0589cb63d6
• https://access.redhat.com/security/cve/CVE-2022-1271
• https://bugzilla.redhat.com/show_bug.cgi?id=2073310
• https://git.tukaani.org/?p=xz.git%3Ba=commit%3Bh=69d1b3fc29677af8ade8dc15dba83f0589cb63d6
• https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html
• https://security.gentoo.org/glsa/202209-01
• https://security.netapp.com/advisory/ntap-20220930-0006/
• https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch
• https://www.openwall.com/lists/oss-security/2022/04/07/8

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

Remediation

Upgrade Debian:9 perl to version 5.24.1-3+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-10878
• https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
• https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8
• https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c
• https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
• https://security.netapp.com/advisory/ntap-20200611-0001/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/
• https://security.gentoo.org/glsa/202006-03
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.oracle.com//security-alerts/cpujul2021.html
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-10878
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html

Overview

openjdk-jre is a free and open-source implementation of the Java Platform, Standard Edition (Java SE).

Affected versions of this package are vulnerable to Sandbox Bypass. It was discovered that the boundary checks in the java.nio.Buffer class in the Libraries component of OpenJDK could have been bypassed when class instance was accessed concurrently. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Remediation

Upgrade openjdk-jre to version 7.0.261, 8.0.251, 11.0.7, 14.0.1 or higher.

References

• Oracle Patch Notes
• RedHat Bugzilla Bug

Overview

openjdk-jre is a free and open-source implementation of the Java Platform, Standard Edition (Java SE).

Affected versions of this package are vulnerable to Access Control Bypass via the Scripting component APIs. An attacker can gain unauthorized creation, deletion, or modification access to critical data by supplying crafted data through a web service or by leveraging untrusted code execution in sandboxed environments.

Remediation

Upgrade openjdk-jre to version 8.0.462, 11.0.28 or higher.

References

• GitHub Commit
• GitHub Commit
• Oracle Security Advisory
• Red Hat Bugzilla Bug

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

Remediation

Upgrade Debian:9 perl to version 5.24.1-3+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-10543
• https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
• https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed
• https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
• https://security.netapp.com/advisory/ntap-20200611-0001/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/
• https://security.gentoo.org/glsa/202006-03
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.oracle.com//security-alerts/cpujul2021.html
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-10543
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

Remediation

There is no fixed version for Debian:9 curl.

References

• https://security-tracker.debian.org/tracker/CVE-2022-22576
• https://hackerone.com/reports/1526328
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20220609-0008/
• https://www.debian.org/security/2022/dsa-5197

NVD Description

Note: Versions mentioned in the description apply only to the upstream gcc-6 package and not the gcc-6 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.

Remediation

There is no fixed version for Debian:9 gcc-6.

References

• https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup
• https://security-tracker.debian.org/tracker/CVE-2018-12886
• https://www.gnu.org/software/gcc/gcc-8/changes.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

Remediation

Upgrade Debian:9 libssh2 to version 1.7.0-1+deb9u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2019-17498
• https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/
• https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498
• https://github.com/libssh2/libssh2/pull/402/commits/1c6fa92b77e34d089493fe6d3e2c6c8775858b94
• https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/
• https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480
• https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html
• http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html
• https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html
• https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/
• https://security.netapp.com/advisory/ntap-20220909-0004/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

Remediation

Upgrade Debian:9 libssh2 to version 1.7.0-1+deb9u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2019-13115
• https://security.netapp.com/advisory/ntap-20190806-0002/
• https://support.f5.com/csp/article/K13322484
• https://support.f5.com/csp/article/K13322484?utm_source=f5support&utm_medium=RSS
• https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/
• https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa
• https://github.com/libssh2/libssh2/pull/350
• https://blog.semmle.com/libssh2-integer-overflow/
• https://libssh2.org/changes.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13115
• http://packetstormsecurity.com/files/172834/libssh2-1.8.2-Out-Of-Bounds-Read.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html
• https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/
• https://support.f5.com/csp/article/K13322484?utm_source=f5support&amp%3Butm_medium=RSS

NVD Description

Note: Versions mentioned in the description apply only to the upstream nettle package and not the nettle package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.

Remediation

Upgrade Debian:9 nettle to version 3.3-1+deb9u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-20305
• https://www.debian.org/security/2021/dsa-4933
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQKWVVMAIDAJ7YAA3VVO32BHLDOH2E63/
• https://security.gentoo.org/glsa/202105-31
• https://bugzilla.redhat.com/show_bug.cgi?id=1942533
• https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQKWVVMAIDAJ7YAA3VVO32BHLDOH2E63/
• https://security.netapp.com/advisory/ntap-20211022-0002/

Overview

openjdk-jre is a free and open-source implementation of the Java Platform, Standard Edition (Java SE).

Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data (MAID) via serialization filter changes via jdk.serialFilter property modification.

Remediation

Upgrade openjdk-jre to version 7.0.251, 8.0.241, 11.0.6, 13.0.2 or higher.

References

• Oracle Security Advisory
• RedHat Bugzilla Bug

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.

Remediation

Upgrade Debian:9 sqlite3 to version 3.16.2-5+deb9u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2018-20346
• https://support.apple.com/HT209443
• https://support.apple.com/HT209446
• https://support.apple.com/HT209447
• https://support.apple.com/HT209448
• https://support.apple.com/HT209450
• https://support.apple.com/HT209451
• https://crbug.com/900910
• https://www.synology.com/security/advisory/Synology_SA_18_61
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20346
• https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/
• https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc
• https://security.gentoo.org/glsa/201904-21
• https://access.redhat.com/articles/3758321
• https://blade.tencent.com/magellan/index_en.html
• https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
• https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e
• https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html
• https://news.ycombinator.com/item?id=18685296
• https://sqlite.org/src/info/940f2adc8541a838
• https://sqlite.org/src/info/d44318f59044162e
• https://worthdoingbadly.com/sqlitebug/
• https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg113218.html
• https://www.sqlite.org/releaselog/3_25_3.html
• https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
• https://www.oracle.com/security-alerts/cpuapr2020.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1659379
• https://bugzilla.redhat.com/show_bug.cgi?id=1659677
• http://www.securityfocus.com/bid/106323
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20346
• https://usn.ubuntu.com/4019-1/
• https://usn.ubuntu.com/4019-2/
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/
• https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.

Remediation

Upgrade Debian:9 sqlite3 to version 3.16.2-5+deb9u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2018-20506
• https://support.apple.com/kb/HT209443
• https://support.apple.com/kb/HT209446
• https://support.apple.com/kb/HT209447
• https://support.apple.com/kb/HT209448
• https://support.apple.com/kb/HT209450
• https://support.apple.com/kb/HT209451
• https://seclists.org/bugtraq/2019/Jan/28
• https://seclists.org/bugtraq/2019/Jan/29
• https://seclists.org/bugtraq/2019/Jan/31
• https://seclists.org/bugtraq/2019/Jan/32
• https://seclists.org/bugtraq/2019/Jan/33
• https://seclists.org/bugtraq/2019/Jan/39
• https://sqlite.org/src/info/940f2adc8541a838
• https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://security.netapp.com/advisory/ntap-20190502-0004/
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html
• http://seclists.org/fulldisclosure/2019/Jan/62
• http://seclists.org/fulldisclosure/2019/Jan/64
• http://seclists.org/fulldisclosure/2019/Jan/66
• http://seclists.org/fulldisclosure/2019/Jan/67
• http://seclists.org/fulldisclosure/2019/Jan/68
• http://seclists.org/fulldisclosure/2019/Jan/69
• http://www.securityfocus.com/bid/106698
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20506
• https://usn.ubuntu.com/4019-1/
• https://usn.ubuntu.com/4019-2/
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

Remediation

Upgrade Debian:9 curl to version 7.52.1-5+deb9u11 or higher.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-8177
• https://security-tracker.debian.org/tracker/CVE-2020-8177
• https://www.debian.org/security/2021/dsa-4881
• https://curl.se/docs/CVE-2020-8177.html
• https://hackerone.com/reports/887462
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://www.oracle.com/security-alerts/cpujan2022.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

Remediation

Upgrade Debian:9 curl to version 7.52.1-5+deb9u10 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2019-5436
• https://seclists.org/bugtraq/2020/Feb/36
• https://curl.haxx.se/docs/CVE-2019-5436.html
• https://support.f5.com/csp/article/K55133295
• https://support.f5.com/csp/article/K55133295?utm_source=f5support&utm_medium=RSS
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436
• https://www.debian.org/security/2020/dsa-4633
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/
• https://security.gentoo.org/glsa/202003-29
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
• http://www.openwall.com/lists/oss-security/2019/09/11/6
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://security.netapp.com/advisory/ntap-20190606-0004/
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-5436
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/
• https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

Remediation

Upgrade Debian:9 expat to version 2.2.0-2+deb9u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-46143
• https://github.com/libexpat/libexpat/issues/532
• https://github.com/libexpat/libexpat/pull/538
• http://www.openwall.com/lists/oss-security/2022/01/17/3
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://security.gentoo.org/glsa/202209-24
• https://security.netapp.com/advisory/ntap-20220121-0006/
• https://www.debian.org/security/2022/dsa-5073
• https://www.tenable.com/security/tns-2022-05

NVD Description

Note: Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even if they are connected by non-physical means such as SSH (hence bypassing PAM's nullok_secure configuration). This notably affects environments such as virtual machines automatically generated with a default blank root password, allowing all local users to escalate privileges.

Remediation

Upgrade Debian:9 shadow to version 1:4.4-4.1+deb9u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2017-20002
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=877374
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914957
• https://lists.debian.org/debian-lts-announce/2021/03/msg00020.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.

Remediation

Upgrade Debian:9 systemd to version 232-25+deb9u14 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-1712
• https://github.com/systemd/systemd/commit/1068447e6954dc6ce52f099ed174c442cb89ed54
• https://github.com/systemd/systemd/commit/637486261528e8aa3da9f26a4487dc254f4b7abb
• https://github.com/systemd/systemd/commit/bc130b6858327b382b07b3985cf48e2aa9016b2d
• https://github.com/systemd/systemd/commit/ea0d0ede03c6f18dbc5036c5e9cccf97e415ccc2
• https://www.openwall.com/lists/oss-security/2020/02/05/1
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1712
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-1712
• https://lists.debian.org/debian-lts-announce/2022/06/msg00025.html

Overview

openjdk-jre is a free and open-source implementation of the Java Platform, Standard Edition (Java SE).

Affected versions of this package are vulnerable to Access Control Bypass in the HTTP client. An attacker can obtain sensitive information by sending specially crafted HTTP requests that exploit improper header handling.

Remediation

Upgrade openjdk-jre to version 11.0.28, 17.0.16, 21.0.8, 24.0.2 or higher.

References

• Oracle Security Advisory
• Red Hat Bugzilla Bug

NVD Description

Note: Versions mentioned in the description apply only to the upstream python2.7 package and not the python2.7 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Remediation

There is no fixed version for Debian:9 python2.7.

References

• https://security-tracker.debian.org/tracker/CVE-2015-20107
• https://bugs.python.org/issue24778
• https://github.com/python/cpython/issues/68966
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46KWPTI72SSEOF53DOYQBQOCN4QQB2GE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/53TQZFLS6O3FLIMVSXFEEPZSWLDZLBOX/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/57NECACX333A3BBZM2TR2VZ4ZE3UG3SN/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DBVY4YC2P6EPZZ2DROOXHDOWZ4BJFLW/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QIKVSW3H6W2GQGDE5DTIWLGFNH6KKEW/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKGMYDVKI3XNM27B6I6RQ6QV3TVJAUCG/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERYMM2QVDPOJLX4LYXWYIQN5FOIJLDRY/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F3LNY2NHM6J22O6Q5ANOE3SZRK3OACKR/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCIO2W4DUVVMI6L52QCC4TT2B3K5VWHS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FIRUTX47BJD2HYJDLMI7JJBVCYFAPKAQ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GPCLGZZJPVXFWUWVV5WCD5FNUAFLKBDN/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HAI2GBC7WKH7J5NH6J2IW5RT3VF2SF5M/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAY6VBNVEFUXKJF37WFHYXUSRDEK34N3/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MYG3EMFR7ZHC46TDNM7SNWO64A3W7EUF/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ONXSGLASNLGFL57YU6WT6Y5YURSFV43U/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTTZGLD2YBMMG6U6F5HOTPOGGPBIURMA/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIOJUZ5JMEMGSKNISTOVI4PDP36FDL5Y/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W5664BGZVTA46LQDNTYX5THG6CN4FYJX/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XO2H6CKWLRGTTZCGUQVELW6LUH437Q3O/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y4E2WBEJ42CGLGDHD6ZXOLZ2W6G3YOVD/
• https://python-security.readthedocs.io/vuln/mailcap-shell-injection.html
• https://security.netapp.com/advisory/ntap-20220616-0001/
• https://security.gentoo.org/glsa/202305-02
• https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
• https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46KWPTI72SSEOF53DOYQBQOCN4QQB2GE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/53TQZFLS6O3FLIMVSXFEEPZSWLDZLBOX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57NECACX333A3BBZM2TR2VZ4ZE3UG3SN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DBVY4YC2P6EPZZ2DROOXHDOWZ4BJFLW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIKVSW3H6W2GQGDE5DTIWLGFNH6KKEW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKGMYDVKI3XNM27B6I6RQ6QV3TVJAUCG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERYMM2QVDPOJLX4LYXWYIQN5FOIJLDRY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3LNY2NHM6J22O6Q5ANOE3SZRK3OACKR/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCIO2W4DUVVMI6L52QCC4TT2B3K5VWHS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FIRUTX47BJD2HYJDLMI7JJBVCYFAPKAQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GPCLGZZJPVXFWUWVV5WCD5FNUAFLKBDN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAI2GBC7WKH7J5NH6J2IW5RT3VF2SF5M/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAY6VBNVEFUXKJF37WFHYXUSRDEK34N3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYG3EMFR7ZHC46TDNM7SNWO64A3W7EUF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONXSGLASNLGFL57YU6WT6Y5YURSFV43U/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTTZGLD2YBMMG6U6F5HOTPOGGPBIURMA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIOJUZ5JMEMGSKNISTOVI4PDP36FDL5Y/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5664BGZVTA46LQDNTYX5THG6CN4FYJX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO2H6CKWLRGTTZCGUQVELW6LUH437Q3O/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4E2WBEJ42CGLGDHD6ZXOLZ2W6G3YOVD/

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (--ssl-reqd on the command line orCURLOPT_USE_SSL set to CURLUSESSL_CONTROL or CURLUSESSL_ALL withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations withoutTLS contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Remediation

Upgrade Debian:9 curl to version 7.52.1-5+deb9u16 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-22946
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/
• https://hackerone.com/reports/1334111
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html
• http://seclists.org/fulldisclosure/2022/Mar/29
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20211029-0003/
• https://security.netapp.com/advisory/ntap-20220121-0008/
• https://support.apple.com/kb/HT213183
• https://www.debian.org/security/2022/dsa-5197
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

Remediation

Upgrade Debian:9 curl to version 7.52.1-5+deb9u13 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-8286
• https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf
• https://security.netapp.com/advisory/ntap-20210122-0007/
• https://support.apple.com/kb/HT212325
• https://support.apple.com/kb/HT212326
• https://support.apple.com/kb/HT212327
• https://www.debian.org/security/2021/dsa-4881
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
• http://seclists.org/fulldisclosure/2021/Apr/50
• http://seclists.org/fulldisclosure/2021/Apr/51
• http://seclists.org/fulldisclosure/2021/Apr/54
• https://security.gentoo.org/glsa/202012-14
• https://curl.se/docs/CVE-2020-8286.html
• https://hackerone.com/reports/1048457
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

Remediation

There is no fixed version for Debian:9 curl.

References

• https://security-tracker.debian.org/tracker/CVE-2022-27782
• http://www.openwall.com/lists/oss-security/2023/03/20/6
• https://hackerone.com/reports/1555796
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20220609-0009/
• https://www.debian.org/security/2022/dsa-5197

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

libcurl provides the CURLOPT_CERTINFO option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

Remediation

There is no fixed version for Debian:9 curl.

References

• https://security-tracker.debian.org/tracker/CVE-2022-27781
• https://hackerone.com/reports/1555441
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://security.gentoo.org/glsa/202212-01
• https://security.netapp.com/advisory/ntap-20220609-0009/
• https://www.debian.org/security/2022/dsa-5197

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

Remediation

Upgrade Debian:9 curl to version 7.52.1-5+deb9u13 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-8285
• https://security.netapp.com/advisory/ntap-20210122-0007/
• https://support.apple.com/kb/HT212325
• https://support.apple.com/kb/HT212326
• https://support.apple.com/kb/HT212327
• https://www.debian.org/security/2021/dsa-4881
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
• http://seclists.org/fulldisclosure/2021/Apr/51
• https://security.gentoo.org/glsa/202012-14
• https://curl.se/docs/CVE-2020-8285.html
• https://github.com/curl/curl/issues/6255
• https://hackerone.com/reports/1045844
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

Remediation

Upgrade Debian:9 curl to version 7.52.1-5+deb9u12 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-8231
• https://www.debian.org/security/2021/dsa-4881
• https://security.gentoo.org/glsa/202012-14
• https://curl.haxx.se/docs/CVE-2020-8231.html
• https://hackerone.com/reports/948876
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://www.oracle.com/security-alerts/cpuapr2022.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream cyrus-sasl2 package and not the cyrus-sasl2 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

Remediation

Upgrade Debian:9 cyrus-sasl2 to version 2.1.27~101-g0780600+dfsg-3+deb9u1 or higher.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19906
• https://security-tracker.debian.org/tracker/CVE-2019-19906
• https://seclists.org/bugtraq/2019/Dec/42
• https://support.apple.com/kb/HT211288
• https://support.apple.com/kb/HT211289
• https://www.debian.org/security/2019/dsa-4591
• https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/
• http://seclists.org/fulldisclosure/2020/Jul/23
• http://seclists.org/fulldisclosure/2020/Jul/24
• https://github.com/cyrusimap/cyrus-sasl/issues/587
• https://www.openldap.org/its/index.cgi/Incoming?id=9123
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-19906
• https://usn.ubuntu.com/4256-1/
• http://www.openwall.com/lists/oss-security/2022/02/23/4
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Remediation

Upgrade Debian:9 expat to version 2.2.0-2+deb9u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-23990
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/34NXVL2RZC2YZRV74ZQ3RNFB7WCEUP7D/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7FF2UH7MPXKTADYSJUAHI2Y5UHBSHUH/
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://github.com/libexpat/libexpat/pull/551
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34NXVL2RZC2YZRV74ZQ3RNFB7WCEUP7D/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7FF2UH7MPXKTADYSJUAHI2Y5UHBSHUH/
• https://security.gentoo.org/glsa/202209-24
• https://www.debian.org/security/2022/dsa-5073
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.tenable.com/security/tns-2022-05

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.

Remediation

Upgrade Debian:9 git to version 1:2.11.0-3+deb9u6 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-5260
• https://support.apple.com/kb/HT211141
• https://www.debian.org/security/2020/dsa-4657
• https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/
• https://security.gentoo.org/glsa/202004-13
• https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q
• https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b
• http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html
• https://lore.kernel.org/git/xmqqy2qy7xn8.fsf@gitster.c.googlers.com/
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
• http://www.openwall.com/lists/oss-security/2020/04/15/5
• http://www.openwall.com/lists/oss-security/2020/04/15/6
• http://www.openwall.com/lists/oss-security/2020/04/20/1
• https://usn.ubuntu.com/4329-1/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-5260
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/
• https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/
• https://github.com/sv3nbeast/CVE-2020-5260

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where some credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching any URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's "store" helper - Git's "cache" helper - the "osxkeychain" helper that ships in Git's "contrib" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability.

Remediation

Upgrade Debian:9 git to version 1:2.11.0-3+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-11008
• https://support.apple.com/kb/HT211183
• https://lists.debian.org/debian-lts-announce/2020/04/msg00015.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/
• http://seclists.org/fulldisclosure/2020/May/41
• https://security.gentoo.org/glsa/202004-13
• https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7
• https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q
• https://github.com/git/git/commit/c44088ecc4b0722636e0a305f9608d3047197282
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-11008
• https://usn.ubuntu.com/4334-1/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/

NVD Description

Note: Versions mentioned in the description apply only to the upstream gmp package and not the gmp package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.

Remediation

Upgrade Debian:9 gmp to version 2:6.1.2+dfsg-1+deb9u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-43618
• https://bugs.debian.org/994405
• https://gmplib.org/list-archives/gmp-bugs/2021-September/005077.html
• https://gmplib.org/repo/gmp-6.2/rev/561a9c25298e
• http://seclists.org/fulldisclosure/2022/Oct/8
• http://www.openwall.com/lists/oss-security/2022/10/13/3
• https://lists.debian.org/debian-lts-announce/2021/12/msg00001.html
• https://security.gentoo.org/glsa/202309-13
• https://security.netapp.com/advisory/ntap-20221111-0001/

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.

Remediation

Upgrade Debian:9 gnutls28 to version 3.5.8-5+deb9u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2019-3829
• https://gitlab.com/gnutls/gnutls/issues/694
• https://security.netapp.com/advisory/ntap-20190619-0004/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3829
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A3ETBUFBB4G7AITAOUYPGXVMBGVXKUAN/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7TJIBRJWGWSH6XIO2MXIQ3W6ES4R6I4/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WRSOL66LHP4SD3Y2ECJDOGT4K663ECDU/
• https://security.gentoo.org/glsa/201904-14
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html
• https://access.redhat.com/errata/RHSA-2019:3600
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3829
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-3829
• https://usn.ubuntu.com/3999-1/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3ETBUFBB4G7AITAOUYPGXVMBGVXKUAN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7TJIBRJWGWSH6XIO2MXIQ3W6ES4R6I4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WRSOL66LHP4SD3Y2ECJDOGT4K663ECDU/

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

Remediation

Upgrade Debian:9 krb5 to version 1.15-1+deb9u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-28196
• https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd
• https://security.netapp.com/advisory/ntap-20201202-0001/
• https://security.netapp.com/advisory/ntap-20210513-0002/
• https://www.debian.org/security/2020/dsa-4795
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/
• https://security.gentoo.org/glsa/202011-17
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream mercurial package and not the mercurial package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

Remediation

Upgrade Debian:9 mercurial to version 4.0-1+deb9u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2018-13346
• https://www.mercurial-scm.org/repo/hg/rev/faa924469635
• https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29
• https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
• https://access.redhat.com/errata/RHSA-2019:2276
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-13346

NVD Description

Note: Versions mentioned in the description apply only to the upstream mercurial package and not the mercurial package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.

Remediation

Upgrade Debian:9 mercurial to version 4.0-1+deb9u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2018-13348
• https://www.mercurial-scm.org/repo/hg/rev/90a274965de7
• https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29
• https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-13348

NVD Description

Note: Versions mentioned in the description apply only to the upstream nettle package and not the nettle package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

Remediation

Upgrade Debian:9 nettle to version 3.3-1+deb9u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-3580
• https://bugzilla.redhat.com/show_bug.cgi?id=1967983
• https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html
• https://security.gentoo.org/glsa/202401-24
• https://security.netapp.com/advisory/ntap-20211104-0006/

NVD Description

Note: Versions mentioned in the description apply only to the upstream nghttp2 package and not the nghttp2 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

Remediation

Upgrade Debian:9 nghttp2 to version 1.18.1-1+deb9u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-11080
• https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr
• https://www.debian.org/security/2020/dsa-4696
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/
• https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090
• https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html
• https://www.oracle.com//security-alerts/cpujul2021.html
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/
• https://www.oracle.com/security-alerts/cpuapr2022.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream nghttp2 package and not the nghttp2 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.

Remediation

Upgrade Debian:9 nghttp2 to version 1.18.1-1+deb9u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2018-1000168
• https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/
• https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000168
• https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html
• https://access.redhat.com/errata/RHSA-2019:0366
• https://access.redhat.com/errata/RHSA-2019:0367
• http://www.securityfocus.com/bid/103952
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-1000168

Overview

openjdk-jre is a free and open-source implementation of the Java Platform, Standard Edition (Java SE).

Affected versions of this package are vulnerable to Access Restriction Bypass by an unauthenticated attacker with network access via multiple protocols. This is due to incorrect implementation of the ECDSA cryptographic signature in Java. Exploiting this vulnerability results in unauthorized creation, deletion, or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.

Notes:

1. This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.

2. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service that supplies data to the APIs.

Remediation

Upgrade openjdk-jre to version 7.0.341, 8.0.331, 11.0.15, 17.0.3, 18.0.1 or higher.

References

• Graalvm Release Notes
• JDK Release notes
• Neil Madden Blog - Psychic Signatures in Java
• Oracle Security Advisory
• PoC by Khaled Nassar
• PoC in GitHub

Overview

openjdk-jre is a free and open-source implementation of the Java Platform, Standard Edition (Java SE).

Affected versions of this package are vulnerable to Buffer Overflow. A flaw was found in the boundary checks in the java.nio buffer classes in the Libraries component of OpenJDK, where it is bypassed in certain cases. This flaw allows an untrusted Java application or applet o bypass Java sandbox restrictions.

Remediation

Upgrade openjdk-jre to version 7.0.261, 8.0.251, 11.0.7, 14.0.1 or higher.

References

• Oracle Update Advisory
• RedHat Bugzilla Bug

Overview

openjdk-jre is a free and open-source implementation of the Java Platform, Standard Edition (Java SE).

Affected versions of this package are vulnerable to Improper Input Validation in the way the readObject() method of the MethodType class in the Libraries component of OpenJDK checked argument types. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Remediation

Upgrade openjdk-jre to version 7.0.261, 8.0.251, 11.0.7, 14.0.1 or higher.

References

• RedHat Bugzilla Bug

Overview

openjdk-jre is a free and open-source implementation of the Java Platform, Standard Edition (Java SE).

Affected versions of this package are vulnerable to Improper Security Check in the TLS/SSL implementation in the JSSE component of OpenJDK, where it did not properly handle application data packets received before the handshake completion. This flaw allowed unauthorized injection of data at the beginning of a TLS session.

Remediation

Upgrade openjdk-jre to version 7.0.261, 8.0.251, 11.0.7, 14.0.1 or higher.

References

• RedHat Bugzilla Bug

Overview

openjdk-jre is a free and open-source implementation of the Java Platform, Standard Edition (Java SE).

Affected versions of this package are vulnerable to Information Exposure by allowing unauthenticated attackers with network access via multiple protocols to access critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs through a web service that supplies data to the APIs.

Remediation

Upgrade openjdk-jre to version 7.0.341, 8.0.331, 11.0.15, 17.0.3, 18.0.1 or higher.

References

• Oracle Security Report
• RedHat Bugzilla Bug

Overview

openjdk-jre is a free and open-source implementation of the Java Platform, Standard Edition (Java SE).

Affected versions of this package are vulnerable to Integer Coercion Error through the Apache Java XSLT library, via the processing of a malicious XSLT stylesheet. Exploiting this vulnerability can allow an attacker to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode.

Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service that supplies data to the APIs.

Remediation

Upgrade openjdk-jre to version 7.0.351, 8.0.342, 11.0.16, 17.0.4, 18.0.2 or higher.

References

• OpenJDK Security Advisory
• Oracle Security Advisory
• RedHat Bugzilla Bug
• PoC in GitHub

Overview

openjdk-jre is a free and open-source implementation of the Java Platform, Standard Edition (Java SE).

Affected versions of this package are vulnerable to Sandbox Bypass. A flaw was found in the way the Hotspot component of OpenJDK performed range check elimination. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

Remediation

Upgrade openjdk-jre to version 8.0.301, 11.0.12, 16.0.2 or higher.

References

• RedHat Bugzilla Bug

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service.

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-36229
• https://security.netapp.com/advisory/ntap-20210226-0002/
• https://support.apple.com/kb/HT212529
• https://support.apple.com/kb/HT212530
• https://support.apple.com/kb/HT212531
• https://www.debian.org/security/2021/dsa-4845
• http://seclists.org/fulldisclosure/2021/May/64
• http://seclists.org/fulldisclosure/2021/May/65
• http://seclists.org/fulldisclosure/2021/May/70
• https://bugs.openldap.org/show_bug.cgi?id=9425
• https://git.openldap.org/openldap/openldap/-/commit/4bdfffd2889c0c5cdf58bebafbdc8fce4bb2bff0
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-36226
• https://security.netapp.com/advisory/ntap-20210226-0002/
• https://support.apple.com/kb/HT212529
• https://support.apple.com/kb/HT212530
• https://support.apple.com/kb/HT212531
• https://www.debian.org/security/2021/dsa-4845
• http://seclists.org/fulldisclosure/2021/May/64
• http://seclists.org/fulldisclosure/2021/May/65
• http://seclists.org/fulldisclosure/2021/May/70
• https://bugs.openldap.org/show_bug.cgi?id=9413
• https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65
• https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26
• https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439
• https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-36225
• https://security.netapp.com/advisory/ntap-20210226-0002/
• https://support.apple.com/kb/HT212529
• https://support.apple.com/kb/HT212530
• https://support.apple.com/kb/HT212531
• https://www.debian.org/security/2021/dsa-4845
• http://seclists.org/fulldisclosure/2021/May/64
• http://seclists.org/fulldisclosure/2021/May/65
• http://seclists.org/fulldisclosure/2021/May/70
• https://bugs.openldap.org/show_bug.cgi?id=9412
• https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65
• https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26
• https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439
• https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-36221
• https://security.netapp.com/advisory/ntap-20210226-0002/
• https://support.apple.com/kb/HT212529
• https://support.apple.com/kb/HT212530
• https://support.apple.com/kb/HT212531
• https://www.debian.org/security/2021/dsa-4845
• http://seclists.org/fulldisclosure/2021/May/64
• http://seclists.org/fulldisclosure/2021/May/65
• http://seclists.org/fulldisclosure/2021/May/70
• https://bugs.openldap.org/show_bug.cgi?id=9404
• https://bugs.openldap.org/show_bug.cgi?id=9424
• https://git.openldap.org/openldap/openldap/-/commit/38ac838e4150c626bbfa0082b7e2cf3a2bb4df31
• https://git.openldap.org/openldap/openldap/-/commit/58c1748e81c843c5b6e61648d2a4d1d82b47e842
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-36228
• https://security.netapp.com/advisory/ntap-20210226-0002/
• https://support.apple.com/kb/HT212529
• https://support.apple.com/kb/HT212530
• https://support.apple.com/kb/HT212531
• https://www.debian.org/security/2021/dsa-4845
• http://seclists.org/fulldisclosure/2021/May/64
• http://seclists.org/fulldisclosure/2021/May/65
• http://seclists.org/fulldisclosure/2021/May/70
• https://bugs.openldap.org/show_bug.cgi?id=9427
• https://git.openldap.org/openldap/openldap/-/commit/91dccd25c347733b365adc74cb07d074512ed5ad
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-36227
• https://security.netapp.com/advisory/ntap-20210226-0002/
• https://support.apple.com/kb/HT212529
• https://support.apple.com/kb/HT212530
• https://support.apple.com/kb/HT212531
• https://www.debian.org/security/2021/dsa-4845
• http://seclists.org/fulldisclosure/2021/May/64
• http://seclists.org/fulldisclosure/2021/May/65
• http://seclists.org/fulldisclosure/2021/May/70
• https://bugs.openldap.org/show_bug.cgi?id=9428
• https://git.openldap.org/openldap/openldap/-/commit/9d0e8485f3113505743baabf1167e01e4558ccf5
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-25692
• https://bugzilla.redhat.com/show_bug.cgi?id=1894567
• https://security.netapp.com/advisory/ntap-20210108-0006/

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read).

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-36223
• https://security.netapp.com/advisory/ntap-20210226-0002/
• https://support.apple.com/kb/HT212529
• https://support.apple.com/kb/HT212530
• https://support.apple.com/kb/HT212531
• https://www.debian.org/security/2021/dsa-4845
• http://seclists.org/fulldisclosure/2021/May/64
• http://seclists.org/fulldisclosure/2021/May/65
• http://seclists.org/fulldisclosure/2021/May/70
• https://bugs.openldap.org/show_bug.cgi?id=9408
• https://git.openldap.org/openldap/openldap/-/commit/21981053a1195ae1555e23df4d9ac68d34ede9dd
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u6 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-25709
• https://security.netapp.com/advisory/ntap-20210716-0003/
• https://support.apple.com/kb/HT212147
• https://www.debian.org/security/2020/dsa-4792
• http://seclists.org/fulldisclosure/2021/Feb/14
• https://bugzilla.redhat.com/show_bug.cgi?id=1899675
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2020/12/msg00008.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u6 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-25710
• https://security.netapp.com/advisory/ntap-20210716-0003/
• https://www.debian.org/security/2020/dsa-4792
• https://bugzilla.redhat.com/show_bug.cgi?id=1899678
• https://git.openldap.org/openldap/openldap/-/commit/ab3915154e69920d480205b4bf5ccb2b391a0a1f#a2feb6ed0257c21c6672793ee2f94eaadc10c72c
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2020/12/msg00008.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-36222
• https://security.netapp.com/advisory/ntap-20210226-0002/
• https://support.apple.com/kb/HT212529
• https://support.apple.com/kb/HT212530
• https://support.apple.com/kb/HT212531
• https://www.debian.org/security/2021/dsa-4845
• http://seclists.org/fulldisclosure/2021/May/64
• http://seclists.org/fulldisclosure/2021/May/65
• http://seclists.org/fulldisclosure/2021/May/70
• https://bugs.openldap.org/show_bug.cgi?id=9406
• https://bugs.openldap.org/show_bug.cgi?id=9407
• https://git.openldap.org/openldap/openldap/-/commit/02dfc32d658fadc25e4040f78e36592f6e1e1ca0
• https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed
• https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed.aa
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service.

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-36230
• https://security.netapp.com/advisory/ntap-20210226-0002/
• https://support.apple.com/kb/HT212529
• https://support.apple.com/kb/HT212530
• https://support.apple.com/kb/HT212531
• https://www.debian.org/security/2021/dsa-4845
• http://seclists.org/fulldisclosure/2021/May/64
• http://seclists.org/fulldisclosure/2021/May/65
• http://seclists.org/fulldisclosure/2021/May/70
• https://bugs.openldap.org/show_bug.cgi?id=9423
• https://git.openldap.org/openldap/openldap/-/commit/8c1d96ee36ed98b32cd0e28b7069c7b8ea09d793
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime.

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u8 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-27212
• https://security.netapp.com/advisory/ntap-20210319-0005/
• https://www.debian.org/security/2021/dsa-4860
• https://bugs.openldap.org/show_bug.cgi?id=9454
• https://git.openldap.org/openldap/openldap/-/commit/3539fc33212b528c56b716584f2c2994af7c30b0
• https://git.openldap.org/openldap/openldap/-/commit/9badb73425a67768c09bcaed1a9c26c684af6c30
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/02/msg00035.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-36224
• https://security.netapp.com/advisory/ntap-20210226-0002/
• https://support.apple.com/kb/HT212529
• https://support.apple.com/kb/HT212530
• https://support.apple.com/kb/HT212531
• https://www.debian.org/security/2021/dsa-4845
• http://seclists.org/fulldisclosure/2021/May/64
• http://seclists.org/fulldisclosure/2021/May/65
• http://seclists.org/fulldisclosure/2021/May/70
• https://bugs.openldap.org/show_bug.cgi?id=9409
• https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65
• https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26
• https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439
• https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

Remediation

Upgrade Debian:9 openldap to version 2.4.44+dfsg-5+deb9u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-12243
• https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES
• https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440
• https://support.apple.com/kb/HT211289
• https://www.debian.org/security/2020/dsa-4666
• https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html
• https://bugs.openldap.org/show_bug.cgi?id=9202
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://security.netapp.com/advisory/ntap-20200511-0003/
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-12243
• https://usn.ubuntu.com/4352-1/
• https://usn.ubuntu.com/4352-2/
• https://www.oracle.com/security-alerts/cpuapr2022.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade Debian:9 openssl to version 1.1.0l-1~deb9u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-23840
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846
• https://security.netapp.com/advisory/ntap-20210219-0009/
• https://www.openssl.org/news/secadv/20210216.txt
• https://www.tenable.com/security/tns-2021-03
• https://www.tenable.com/security/tns-2021-09
• https://www.tenable.com/security/tns-2021-10
• https://www.debian.org/security/2021/dsa-4855
• https://security.gentoo.org/glsa/202103-03
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2
• https://kc.mcafee.com/corporate/index?page=content&id=SB10366
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://security.netapp.com/advisory/ntap-20240621-0006/
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).

Remediation

Upgrade Debian:9 openssl to version 1.1.0l-1~deb9u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-0778
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=380085481c64de749a6dd25cdf0bcf4360b30f83
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=3118eb64934499d93db3230748a452351d1d9a65
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a466912611aa6cbdf550cd10601390e587451246
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/
• http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html
• http://seclists.org/fulldisclosure/2022/May/33
• http://seclists.org/fulldisclosure/2022/May/35
• http://seclists.org/fulldisclosure/2022/May/38
• https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3118eb64934499d93db3230748a452351d1d9a65
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=380085481c64de749a6dd25cdf0bcf4360b30f83
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a466912611aa6cbdf550cd10601390e587451246
• https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html
• https://lists.debian.org/debian-lts-announce/2022/03/msg00024.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002
• https://security.gentoo.org/glsa/202210-02
• https://security.netapp.com/advisory/ntap-20220321-0002/
• https://security.netapp.com/advisory/ntap-20220429-0005/
• https://security.netapp.com/advisory/ntap-20240621-0006/
• https://support.apple.com/kb/HT213255
• https://support.apple.com/kb/HT213256
• https://support.apple.com/kb/HT213257
• https://www.debian.org/security/2022/dsa-5103
• https://www.openssl.org/news/secadv/20220315.txt
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.tenable.com/security/tns-2022-06
• https://www.tenable.com/security/tns-2022-07
• https://www.tenable.com/security/tns-2022-08
• https://www.tenable.com/security/tns-2022-09
• https://github.com/jkakavas/CVE-2022-0778-POC

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl1.0 package and not the openssl1.0 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade Debian:9 openssl1.0 to version 1.0.2u-1~deb9u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-23840
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846
• https://security.netapp.com/advisory/ntap-20210219-0009/
• https://www.openssl.org/news/secadv/20210216.txt
• https://www.tenable.com/security/tns-2021-03
• https://www.tenable.com/security/tns-2021-09
• https://www.tenable.com/security/tns-2021-10
• https://www.debian.org/security/2021/dsa-4855
• https://security.gentoo.org/glsa/202103-03
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2
• https://kc.mcafee.com/corporate/index?page=content&id=SB10366
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://security.netapp.com/advisory/ntap-20240621-0006/
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html