Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
-
Note:
-
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
-
Remediation
-
Upgrade google.golang.org/protobuf/internal/encoding/json to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
-
Note:
-
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression in scpSyntax. Exploiting this vulnerability is possible when a long input is provided inside the directory path of the git URL.
+
Note:
+ This vulnerability has existed since commit 4a18977c6eecbf4ce0ca1e486e9ba77072ba4395.
+
PoC
+
+ var payload = strings.Repeat("////", 19000000) //payload used, the number can be tweaked to cause 7 second delay
+ malicious_url := "6en6ar@-:0////" + payload + "\"
+ begin := time.Now()
+ //u, err := giturls.ParseScp("remote_username@10.10.0.2:/remote/directory")// normal git url
+ _, err := giturls.ParseScp(malicious_url)
+ if err != nil {
+ fmt.Errorf("[ - ] Error ->" + err.Error())
+ }
+ //fmt.Println("[ + ] Url --> " + u.Host)
+ elapse := time.Since(begin)
+ fmt.Printf("Function took %s", elapse)
+
+
Details
+
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.
+
The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.
+
Let’s take the following regular expression as an example:
+
regex = /A(B|C+)+D/
+
+
This regular expression accomplishes the following:
+
+
A The string must start with the letter 'A'
+
(B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
+
D Finally, we ensure this section of the string ends with a 'D'
+
+
The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD
+
It most cases, it doesn't take very long for a regex engine to find a match:
+
$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
+ 0.04s user 0.01s system 95% cpu 0.052 total
+
+ $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
+ 1.79s user 0.02s system 99% cpu 1.812 total
+
+
The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.
+
Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.
+
Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:
+
+
CCC
+
CC+C
+
C+CC
+
C+C+C.
+
+
The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.
+
From there, the number of steps the engine must use to validate a string just continues to grow.
+
+
+
+
String
+
Number of C's
+
Number of steps
+
+
+
+
ACCCX
+
3
+
38
+
+
+
ACCCCX
+
4
+
71
+
+
+
ACCCCCX
+
5
+
136
+
+
+
ACCCCCCCCCCCCCCX
+
14
+
65,553
+
+
+
By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.
Remediation
-
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.33.0 or higher.
+
There is no fixed version for github.com/whilp/git-urls.
dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.
+
Affected versions of this package are vulnerable to Template Injection in purify.js, due to inconsistencies in the parsing of XML and HTML tags. Executable code can be injected in HTML inside XML CDATA blocks.
+
PoC
+
<![CDATA[ ><img src onerror=alert(1)> ]]>
+
+
Remediation
+
Upgrade dompurify to version 2.4.9, 3.0.11 or higher.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.19 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.19openssl to version 3.1.4-r6 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r6 or higher.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
-
Note:
-
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
-
Remediation
-
Upgrade google.golang.org/protobuf/internal/encoding/json to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
-
Note:
-
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
-
Remediation
-
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.33.0 or higher.
Introduced through:
- docker-image|quay.io/argoproj/argocd@latest and coreutils@8.32-4.1ubuntu1.1
+ docker-image|quay.io/argoproj/argocd@latest and coreutils@8.32-4.1ubuntu1.2
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.19 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.19openssl to version 3.1.4-r6 or higher.
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
+
Note:
+
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
+
Remediation
+
Upgrade google.golang.org/protobuf/internal/encoding/json to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
+
Note:
+
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
+
Remediation
+
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Authentication Bypass by Capture-replay during the establishment of the secure channel. An attacker can manipulate handshake sequence numbers to delete messages sent immediately after the channel is established.
+
Note:
+
+
Sequence numbers are only validated once the channel is established and arbitrary messages are allowed during the handshake, allowing them to manipulate the sequence numbers.
+
+
The potential consequences of the general Terrapin attack are dependent on the messages exchanged after the handshake concludes. If you are using a custom SSH service and do not resort to the authentication protocol, you should check that dropping the first few messages of a connection does not yield security risks.
+
+
+
Impact:
+
While cryptographically novel, there is no discernable impact on the integrity of SSH traffic beyond giving the attacker the ability to delete the message that enables some features related to keystroke timing obfuscation. To successfully carry out the exploitation, the connection needs to be protected using either the ChaCha20-Poly1305 or CBC with Encrypt-then-MAC encryption methods. The attacker must also be able to intercept and modify the connection's traffic.
+
Workaround
+
Temporarily disable the affected chacha20-poly1305@openssh.com encryption and *-etm@openssh.com MAC algorithms in the affected configuration, and use unaffected algorithms like AES-GCM instead.
+
Remediation
+
Upgrade golang.org/x/crypto/ssh to version 0.17.0 or higher.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression in scpSyntax. Exploiting this vulnerability is possible when a long input is provided inside the directory path of the git URL.
+
Note:
+ This vulnerability has existed since commit 4a18977c6eecbf4ce0ca1e486e9ba77072ba4395.
+
PoC
+
+ var payload = strings.Repeat("////", 19000000) //payload used, the number can be tweaked to cause 7 second delay
+ malicious_url := "6en6ar@-:0////" + payload + "\"
+ begin := time.Now()
+ //u, err := giturls.ParseScp("remote_username@10.10.0.2:/remote/directory")// normal git url
+ _, err := giturls.ParseScp(malicious_url)
+ if err != nil {
+ fmt.Errorf("[ - ] Error ->" + err.Error())
+ }
+ //fmt.Println("[ + ] Url --> " + u.Host)
+ elapse := time.Since(begin)
+ fmt.Printf("Function took %s", elapse)
+
+
Details
+
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.
+
The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.
+
Let’s take the following regular expression as an example:
+
regex = /A(B|C+)+D/
+
+
This regular expression accomplishes the following:
+
+
A The string must start with the letter 'A'
+
(B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
+
D Finally, we ensure this section of the string ends with a 'D'
+
+
The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD
+
It most cases, it doesn't take very long for a regex engine to find a match:
+
$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
+ 0.04s user 0.01s system 95% cpu 0.052 total
+
+ $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
+ 1.79s user 0.02s system 99% cpu 1.812 total
+
+
The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.
+
Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.
+
Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:
+
+
CCC
+
CC+C
+
C+CC
+
C+C+C.
+
+
The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.
+
From there, the number of steps the engine must use to validate a string just continues to grow.
+
+
+
+
String
+
Number of C's
+
Number of steps
+
+
+
+
ACCCX
+
3
+
38
+
+
+
ACCCCX
+
4
+
71
+
+
+
ACCCCCX
+
5
+
136
+
+
+
ACCCCCCCCCCCCCCX
+
14
+
65,553
+
+
+
By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.
+
Remediation
+
There is no fixed version for github.com/whilp/git-urls.
Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification). An attacker could send a JWE containing compressed data that, when decompressed by Decrypt or DecryptMulti, would use large amounts of memory and CPU.
+
Remediation
+
Upgrade github.com/go-jose/go-jose/v3 to version 3.0.3 or higher.
dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.
+
Affected versions of this package are vulnerable to Template Injection in purify.js, due to inconsistencies in the parsing of XML and HTML tags. Executable code can be injected in HTML inside XML CDATA blocks.
+
PoC
+
<![CDATA[ ><img src onerror=alert(1)> ]]>
+
+
Remediation
+
Upgrade dompurify to version 2.4.9, 3.0.11 or higher.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r6 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r6 or higher.
Affected versions of this package are vulnerable to Denial of Service (DoS) such that a maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder.
-
Details
-
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.
-
Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.
-
One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.
-
When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.
-
Two common types of DoS vulnerabilities:
-
-
High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.
-
-
Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package
-
-
-
Remediation
-
Upgrade golang.org/x/net/http2/hpack to version 0.7.0 or higher.
Affected versions of this package are vulnerable to Denial of Service (DoS) such that a maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder.
-
Details
-
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.
-
Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.
-
One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.
-
When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.
-
Two common types of DoS vulnerabilities:
-
-
High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.
-
-
Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package
-
-
-
Remediation
-
Upgrade golang.org/x/net/http2 to version 0.7.0 or higher.
Affected versions of this package are vulnerable to Denial of Service (DoS) in the implementation of the HTTP/2 protocol. An attacker can cause a denial of service (including via DDoS) by rapidly resetting many streams through request cancellation.
-
Remediation
-
Upgrade golang.org/x/net/http2 to version 0.17.0 or higher.
Affected versions of this package are vulnerable to Directory Traversal via the filepath.FromSlash() function, allwoing attackers to generate paths that were outside of the provided rootfs.
-
Note:
- This vulnerability is only exploitable on Windows OS.
-
Details
-
A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.
-
Directory Traversal vulnerabilities can be generally divided into two types:
-
-
Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.
-
-
st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.
-
If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.
Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.
-
-
One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.
-
The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
Remediation
-
Upgrade github.com/cyphar/filepath-securejoin to version 0.2.4 or higher.
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and xz-utils/liblzma5@5.2.5-2ubuntu1
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and xz-utils/liblzma5@5.2.5-2ubuntu1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and openssh/openssh-client@1:8.9p1-3ubuntu0.6
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and openssh/openssh-client@1:8.9p1-3ubuntu0.6
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and libgcrypt20@1.9.4-3ubuntu3
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and libgcrypt20@1.9.4-3ubuntu3
Note:Versions mentioned in the description apply only to the upstream less package and not the less package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.
-
Remediation
-
Upgrade Ubuntu:22.04less to version 590-1ubuntu0.22.04.2 or higher.
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
Introduced through:
- github.com/argoproj/argo-cd/v2@* and google.golang.org/protobuf/internal/encoding/json@v1.31.0
+ github.com/argoproj/argo-cd/v2@* and gopkg.in/retry.v1@v1.0.3
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
-
Note:
-
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
-
Remediation
-
Upgrade google.golang.org/protobuf/internal/encoding/json to version 1.33.0 or higher.
Introduced through:
- github.com/argoproj/argo-cd/v2@* and google.golang.org/protobuf/encoding/protojson@v1.31.0
+ github.com/argoproj/argo-cd/v2@* and google.golang.org/protobuf/internal/encoding/json@v1.31.0
Affected versions of this package are vulnerable to Stack-based Buffer Overflow when processing input that uses pathologically deep nesting.
+
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
+
Note:
+
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
Remediation
-
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.32.0 or higher.
+
Upgrade google.golang.org/protobuf/internal/encoding/json to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
-
Note:
-
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
+
Affected versions of this package are vulnerable to Stack-based Buffer Overflow when processing input that uses pathologically deep nesting.
Remediation
-
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.33.0 or higher.
+
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.32.0 or higher.
Introduced through:
- helm.sh/helm/v3@* and golang.org/x/net/http2@v0.5.0
+ github.com/argoproj/argo-cd/v2@* and google.golang.org/protobuf/encoding/protojson@v1.31.0
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when MaxConcurrentStreams handler goroutines running. A a handler is started until one of the existing handlers exits.
+
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
Remediation
-
Upgrade golang.org/x/net/http2 to version 0.17.0 or higher.
+
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.33.0 or higher.
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and gnutls28/libgnutls30@3.7.3-4ubuntu1.4
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and gnutls28/libgnutls30@3.7.3-4ubuntu1.4
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and gnutls28/libgnutls30@3.7.3-4ubuntu1.4
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and gnutls28/libgnutls30@3.7.3-4ubuntu1.4
Introduced through:
- github.com/argoproj/argo-cd/v2@* and github.com/hashicorp/go-retryablehttp@v0.7.0
+ github.com/argoproj/argo-cd/v2@* and github.com/hashicorp/go-retryablehttp@v0.7.4
Introduced through:
- github.com/argoproj/argo-cd/v2@* and github.com/hashicorp/go-cleanhttp@v0.5.2
+ helm.sh/helm/v3@* and github.com/hashicorp/go-multierror@v1.1.1
Introduced through:
- github.com/argoproj/argo-cd/v2@* and github.com/gosimple/slug@v1.13.1
+ github.com/argoproj/argo-cd/v2@* and github.com/hashicorp/go-cleanhttp@v0.5.2
Affected versions of this package are vulnerable to Denial of Service (DoS) due to improper validation of the value passed to the n parameter in the /v2/_catalog endpoint.
- Exploiting this vulnerability is possible by sending a crafted malicious request to the /v2/_catalog API endpoint, which results in an allocation of a massive string array and excessive use of memory.
-
Remediation
-
Upgrade github.com/docker/distribution/registry/api/v2 to version 2.8.2-beta.1 or higher.
Note:Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
-
Remediation
-
Upgrade Ubuntu:22.04expat to version 2.4.7-1ubuntu0.3 or higher.
Note:Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
-
Remediation
-
Upgrade Ubuntu:22.04expat to version 2.4.7-1ubuntu0.3 or higher.
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and bash@5.1-6ubuntu1
+ github.com/argoproj/argo-cd/v2@* and github.com/go-jose/go-jose/v3@v3.0.1
Note:Versions mentioned in the description apply only to the upstream bash package and not the bash package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.
+
Overview
+
Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification). An attacker could send a JWE containing compressed data that, when decompressed by Decrypt or DecryptMulti, would use large amounts of memory and CPU.
Remediation
-
Upgrade Ubuntu:22.04bash to version 5.1-6ubuntu1.1 or higher.
+
Upgrade github.com/go-jose/go-jose/v3 to version 3.0.3 or higher.
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and systemd/libsystemd0@249.11-0ubuntu3.12
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and systemd/libsystemd0@249.11-0ubuntu3.12
Note:Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
-
Remediation
-
There is no fixed version for Ubuntu:22.04systemd.
Note:Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
Note:Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.
-
Remediation
-
Upgrade Ubuntu:22.04shadow to version 1:4.8.1-2ubuntu2.2 or higher.
Note:Versions mentioned in the description apply only to the upstream pcre3 package and not the pcre3 package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.
Note:Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.
Note:Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
Issue summary: Generating excessively long X9.42 DH keys or checking
- excessively long X9.42 DH keys or parameters may be very slow.
-
Impact summary: Applications that use the functions DH_generate_key() to
- generate an X9.42 DH key may experience long delays. Likewise, applications
- that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()
- to check an X9.42 DH key or X9.42 DH parameters may experience long delays.
- Where the key or parameters that are being checked have been obtained from
- an untrusted source this may lead to a Denial of Service.
-
While DH_check() performs all the necessary checks (as of CVE-2023-3817),
- DH_check_pub_key() doesn't make any of these checks, and is therefore
- vulnerable for excessively large P and Q parameters.
-
Likewise, while DH_generate_key() performs a check for an excessively large
- P, it doesn't check for an excessively large Q.
-
An application that calls DH_generate_key() or DH_check_pub_key() and
- supplies a key or parameters obtained from an untrusted source could be
- vulnerable to a Denial of Service attack.
-
DH_generate_key() and DH_check_pub_key() are also called by a number of
- other OpenSSL functions. An application calling any of those other
- functions may similarly be affected. The other functions affected by this
- are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().
-
Also vulnerable are the OpenSSL pkey command line application when using the
- "-pubcheck" option, as well as the OpenSSL genpkey command line application.
-
The OpenSSL SSL/TLS implementation is not affected by this issue.
-
The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
-
Remediation
-
Upgrade Ubuntu:22.04openssl to version 3.0.2-0ubuntu1.14 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu.
+
Note:Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu.See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
Issue summary: The POLY1305 MAC (message authentication code) implementation
- contains a bug that might corrupt the internal state of applications running
- on PowerPC CPU based platforms if the CPU provides vector instructions.
-
Impact summary: If an attacker can influence whether the POLY1305 MAC
- algorithm is used, the application state might be corrupted with various
- application dependent consequences.
-
The POLY1305 MAC (message authentication code) implementation in OpenSSL for
- PowerPC CPUs restores the contents of vector registers in a different order
- than they are saved. Thus the contents of some of these vector registers
- are corrupted when returning to the caller. The vulnerable code is used only
- on newer PowerPC processors supporting the PowerISA 2.07 instructions.
-
The consequences of this kind of internal application state corruption can
- be various - from no consequences, if the calling application does not
- depend on the contents of non-volatile XMM registers at all, to the worst
- consequences, where the attacker could get complete control of the application
- process. However unless the compiler uses the vector registers for storing
- pointers, the most likely consequence, if any, would be an incorrect result
- of some application dependent calculations or a crash leading to a denial of
- service.
-
The POLY1305 MAC algorithm is most frequently used as part of the
- CHACHA20-POLY1305 AEAD (authenticated encryption with associated data)
- algorithm. The most common usage of this AEAD cipher is with TLS protocol
- versions 1.2 and 1.3. If this cipher is enabled on the server a malicious
- client can influence whether this AEAD cipher is used. This implies that
- TLS server applications using OpenSSL can be potentially impacted. However
- we are currently not aware of any concrete application that would be affected
- by this issue therefore we consider this a Low severity security issue.
+
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
Remediation
-
Upgrade Ubuntu:22.04openssl to version 3.0.2-0ubuntu1.14 or higher.
+
There is no fixed version for Ubuntu:22.04systemd.
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and openssl/libssl3@3.0.2-0ubuntu1.13
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and shadow/passwd@1:4.8.1-2ubuntu2.2
Note:Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
This vulnerability has not been analyzed by NVD yet.
+
Note:Versions mentioned in the description apply only to the upstream pcre3 package and not the pcre3 package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.
Remediation
-
Upgrade Ubuntu:22.04openssl to version 3.0.2-0ubuntu1.14 or higher.
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and openssl/libssl3@3.0.2-0ubuntu1.13
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and patch@2.7.6-7build2
Note:Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu.
+
Note:Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu.See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL
- to crash leading to a potential Denial of Service attack
-
Impact summary: Applications loading files in the PKCS12 format from untrusted
- sources might terminate abruptly.
-
A file in PKCS12 format can contain certificates and keys and may come from an
- untrusted source. The PKCS12 specification allows certain fields to be NULL, but
- OpenSSL does not correctly check for this case. This can lead to a NULL pointer
- dereference that results in OpenSSL crashing. If an application processes PKCS12
- files from an untrusted source using the OpenSSL APIs then that application will
- be vulnerable to this issue.
-
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(),
- PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
- and PKCS12_newpass().
-
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
- function is related to writing data we do not consider it security significant.
-
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
+
A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.
Remediation
-
Upgrade Ubuntu:22.04openssl to version 3.0.2-0ubuntu1.14 or higher.
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and ncurses/libtinfo6@6.3-2ubuntu0.1
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and ncurses/libtinfo6@6.3-2ubuntu0.1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and ncurses/libtinfo6@6.3-2ubuntu0.1
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and ncurses/libtinfo6@6.3-2ubuntu0.1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and libzstd/libzstd1@1.4.8+dfsg-3build1
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and libzstd/libzstd1@1.4.8+dfsg-3build1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and gnupg2/gpgv@2.2.27-3ubuntu2.1
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and gnupg2/gpgv@2.2.27-3ubuntu2.1
Allocation of Resources Without Limits or Throttling
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and glibc/libc-bin@2.35-0ubuntu3.6
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and glibc/libc-bin@2.35-0ubuntu3.6
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and gcc-12/libstdc++6@12.3.0-1ubuntu1~22.04
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and gcc-12/libstdc++6@12.3.0-1ubuntu1~22.04
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.7.17 and coreutils@8.32-4.1ubuntu1
+ docker-image|quay.io/argoproj/argocd@v2.10.6 and coreutils@8.32-4.1ubuntu1.2
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.19 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.19openssl to version 3.1.4-r6 or higher.
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
CPU limits can prevent containers from consuming valuable compute time for no benefit (e.g. inefficient code) that might lead to unnecessary costs. It is advisable to also configure CPU requests to ensure application stability.
+
+
Remediation
+
Add `resources.limits.cpu` field with required CPU limit value
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
UID of the container processes could clash with host's UIDs and lead to unintentional authorization bypass
+
+
Remediation
+
Set `securityContext.runAsUser` value to greater or equal than 10'000. SecurityContext can be set on both `pod` and `container` level. If both are set, then the container level takes precedence
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
+
Note:
+
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
+
Remediation
+
Upgrade google.golang.org/protobuf/internal/encoding/json to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
+
Note:
+
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
+
Remediation
+
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression in scpSyntax. Exploiting this vulnerability is possible when a long input is provided inside the directory path of the git URL.
+
Note:
+ This vulnerability has existed since commit 4a18977c6eecbf4ce0ca1e486e9ba77072ba4395.
+
PoC
+
+ var payload = strings.Repeat("////", 19000000) //payload used, the number can be tweaked to cause 7 second delay
+ malicious_url := "6en6ar@-:0////" + payload + "\"
+ begin := time.Now()
+ //u, err := giturls.ParseScp("remote_username@10.10.0.2:/remote/directory")// normal git url
+ _, err := giturls.ParseScp(malicious_url)
+ if err != nil {
+ fmt.Errorf("[ - ] Error ->" + err.Error())
+ }
+ //fmt.Println("[ + ] Url --> " + u.Host)
+ elapse := time.Since(begin)
+ fmt.Printf("Function took %s", elapse)
+
+
Details
+
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.
+
The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.
+
Let’s take the following regular expression as an example:
+
regex = /A(B|C+)+D/
+
+
This regular expression accomplishes the following:
+
+
A The string must start with the letter 'A'
+
(B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
+
D Finally, we ensure this section of the string ends with a 'D'
+
+
The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD
+
It most cases, it doesn't take very long for a regex engine to find a match:
+
$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
+ 0.04s user 0.01s system 95% cpu 0.052 total
+
+ $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
+ 1.79s user 0.02s system 99% cpu 1.812 total
+
+
The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.
+
Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.
+
Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:
+
+
CCC
+
CC+C
+
C+CC
+
C+C+C.
+
+
The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.
+
From there, the number of steps the engine must use to validate a string just continues to grow.
+
+
+
+
String
+
Number of C's
+
Number of steps
+
+
+
+
ACCCX
+
3
+
38
+
+
+
ACCCCX
+
4
+
71
+
+
+
ACCCCCX
+
5
+
136
+
+
+
ACCCCCCCCCCCCCCX
+
14
+
65,553
+
+
+
By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.
+
Remediation
+
There is no fixed version for github.com/whilp/git-urls.
dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.
+
Affected versions of this package are vulnerable to Template Injection in purify.js, due to inconsistencies in the parsing of XML and HTML tags. Executable code can be injected in HTML inside XML CDATA blocks.
+
PoC
+
<![CDATA[ ><img src onerror=alert(1)> ]]>
+
+
Remediation
+
Upgrade dompurify to version 2.4.9, 3.0.11 or higher.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.19 relevant fixed versions and status.
+
Issue summary: The POLY1305 MAC (message authentication code) implementation
+ contains a bug that might corrupt the internal state of applications running
+ on PowerPC CPU based platforms if the CPU provides vector instructions.
+
Impact summary: If an attacker can influence whether the POLY1305 MAC
+ algorithm is used, the application state might be corrupted with various
+ application dependent consequences.
+
The POLY1305 MAC (message authentication code) implementation in OpenSSL for
+ PowerPC CPUs restores the contents of vector registers in a different order
+ than they are saved. Thus the contents of some of these vector registers
+ are corrupted when returning to the caller. The vulnerable code is used only
+ on newer PowerPC processors supporting the PowerISA 2.07 instructions.
+
The consequences of this kind of internal application state corruption can
+ be various - from no consequences, if the calling application does not
+ depend on the contents of non-volatile XMM registers at all, to the worst
+ consequences, where the attacker could get complete control of the application
+ process. However unless the compiler uses the vector registers for storing
+ pointers, the most likely consequence, if any, would be an incorrect result
+ of some application dependent calculations or a crash leading to a denial of
+ service.
+
The POLY1305 MAC algorithm is most frequently used as part of the
+ CHACHA20-POLY1305 AEAD (authenticated encryption with associated data)
+ algorithm. The most common usage of this AEAD cipher is with TLS protocol
+ versions 1.2 and 1.3. If this cipher is enabled on the server a malicious
+ client can influence whether this AEAD cipher is used. This implies that
+ TLS server applications using OpenSSL can be potentially impacted. However
+ we are currently not aware of any concrete application that would be affected
+ by this issue therefore we consider this a Low severity security issue.
+
Remediation
+
Upgrade Alpine:3.19openssl to version 3.1.4-r3 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.19 relevant fixed versions and status.
+
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL
+ to crash leading to a potential Denial of Service attack
+
Impact summary: Applications loading files in the PKCS12 format from untrusted
+ sources might terminate abruptly.
+
A file in PKCS12 format can contain certificates and keys and may come from an
+ untrusted source. The PKCS12 specification allows certain fields to be NULL, but
+ OpenSSL does not correctly check for this case. This can lead to a NULL pointer
+ dereference that results in OpenSSL crashing. If an application processes PKCS12
+ files from an untrusted source using the OpenSSL APIs then that application will
+ be vulnerable to this issue.
+
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(),
+ PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
+ and PKCS12_newpass().
+
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
+ function is related to writing data we do not consider it security significant.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.19openssl to version 3.1.4-r5 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
+
Note:
+
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
+
Remediation
+
Upgrade google.golang.org/protobuf/internal/encoding/json to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
+
Note:
+
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
+
Remediation
+
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification). An attacker could send a JWE containing compressed data that, when decompressed by Decrypt or DecryptMulti, would use large amounts of memory and CPU.
+
Remediation
+
Upgrade github.com/go-jose/go-jose/v3 to version 3.0.3 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.19 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.19openssl to version 3.1.4-r6 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r6 or higher.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Note:Versions mentioned in the description apply only to the upstream xz-utils package and not the xz-utils package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.
+
Remediation
+
There is no fixed version for Ubuntu:22.04xz-utils.
Note:Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.
+
Remediation
+
There is no fixed version for Ubuntu:22.04openssh.
Note:Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.
+
Remediation
+
There is no fixed version for Ubuntu:22.04libgcrypt20.
Note:Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
Note:Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.
Note:Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
+
Note:
+
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
+
Remediation
+
Upgrade google.golang.org/protobuf/internal/encoding/json to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
+
Note:
+
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
+
Remediation
+
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.33.0 or higher.
Note:Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.
+
Remediation
+
There is no fixed version for Ubuntu:22.04gnutls28.
Note:Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.
+
Remediation
+
There is no fixed version for Ubuntu:22.04gnutls28.
Note:Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
+
Remediation
+
There is no fixed version for Ubuntu:22.04systemd.
Note:Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
Note:Versions mentioned in the description apply only to the upstream pcre3 package and not the pcre3 package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.
Note:Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.
Note:Versions mentioned in the description apply only to the upstream patch package and not the patch package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.
Note:Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().
+
Remediation
+
There is no fixed version for Ubuntu:22.04ncurses.
Note:Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c.
+
Remediation
+
There is no fixed version for Ubuntu:22.04ncurses.
Note:Versions mentioned in the description apply only to the upstream libzstd package and not the libzstd package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.
+
Remediation
+
There is no fixed version for Ubuntu:22.04libzstd.
Note:Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.
Note:Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.
Note:Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.
Note:Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack).
Note:Versions mentioned in the description apply only to the upstream gcc-12 package and not the gcc-12 package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
Note:Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Ubuntu.
+ See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
+
chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
+
Remediation
+
There is no fixed version for Ubuntu:22.04coreutils.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.19 relevant fixed versions and status.
+
Issue summary: The POLY1305 MAC (message authentication code) implementation
+ contains a bug that might corrupt the internal state of applications running
+ on PowerPC CPU based platforms if the CPU provides vector instructions.
+
Impact summary: If an attacker can influence whether the POLY1305 MAC
+ algorithm is used, the application state might be corrupted with various
+ application dependent consequences.
+
The POLY1305 MAC (message authentication code) implementation in OpenSSL for
+ PowerPC CPUs restores the contents of vector registers in a different order
+ than they are saved. Thus the contents of some of these vector registers
+ are corrupted when returning to the caller. The vulnerable code is used only
+ on newer PowerPC processors supporting the PowerISA 2.07 instructions.
+
The consequences of this kind of internal application state corruption can
+ be various - from no consequences, if the calling application does not
+ depend on the contents of non-volatile XMM registers at all, to the worst
+ consequences, where the attacker could get complete control of the application
+ process. However unless the compiler uses the vector registers for storing
+ pointers, the most likely consequence, if any, would be an incorrect result
+ of some application dependent calculations or a crash leading to a denial of
+ service.
+
The POLY1305 MAC algorithm is most frequently used as part of the
+ CHACHA20-POLY1305 AEAD (authenticated encryption with associated data)
+ algorithm. The most common usage of this AEAD cipher is with TLS protocol
+ versions 1.2 and 1.3. If this cipher is enabled on the server a malicious
+ client can influence whether this AEAD cipher is used. This implies that
+ TLS server applications using OpenSSL can be potentially impacted. However
+ we are currently not aware of any concrete application that would be affected
+ by this issue therefore we consider this a Low severity security issue.
+
Remediation
+
Upgrade Alpine:3.19openssl to version 3.1.4-r3 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.19 relevant fixed versions and status.
+
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL
+ to crash leading to a potential Denial of Service attack
+
Impact summary: Applications loading files in the PKCS12 format from untrusted
+ sources might terminate abruptly.
+
A file in PKCS12 format can contain certificates and keys and may come from an
+ untrusted source. The PKCS12 specification allows certain fields to be NULL, but
+ OpenSSL does not correctly check for this case. This can lead to a NULL pointer
+ dereference that results in OpenSSL crashing. If an application processes PKCS12
+ files from an untrusted source using the OpenSSL APIs then that application will
+ be vulnerable to this issue.
+
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(),
+ PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
+ and PKCS12_newpass().
+
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
+ function is related to writing data we do not consider it security significant.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.19openssl to version 3.1.4-r5 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.19 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.19openssl to version 3.1.4-r6 or higher.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
-
PoC
-
- const semver = require('semver')
- const lengths_2 = [2000, 4000, 8000, 16000, 32000, 64000, 128000]
-
- console.log("n[+] Valid range - Test payloads")
- for (let i = 0; i =1.2.3' + ' '.repeat(lengths_2[i]) + '<1.3.0';
- const start = Date.now()
- semver.validRange(value)
- // semver.minVersion(value)
- // semver.maxSatisfying(["1.2.3"], value)
- // semver.minSatisfying(["1.2.3"], value)
- // new semver.Range(value, {})
-
- const end = Date.now();
- console.log('length=%d, time=%d ms', value.length, end - start);
- }
-
-
Details
-
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.
-
The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.
-
Let’s take the following regular expression as an example:
-
regex = /A(B|C+)+D/
-
-
This regular expression accomplishes the following:
-
-
A The string must start with the letter 'A'
-
(B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
-
D Finally, we ensure this section of the string ends with a 'D'
-
-
The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD
-
It most cases, it doesn't take very long for a regex engine to find a match:
-
$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
- 0.04s user 0.01s system 95% cpu 0.052 total
-
- $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
- 1.79s user 0.02s system 99% cpu 1.812 total
-
-
The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.
-
Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.
-
Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:
-
-
CCC
-
CC+C
-
C+CC
-
C+C+C.
-
-
The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.
-
From there, the number of steps the engine must use to validate a string just continues to grow.
-
-
-
-
String
-
Number of C's
-
Number of steps
-
-
-
-
ACCCX
-
3
-
38
-
-
-
ACCCCX
-
4
-
71
-
-
-
ACCCCCX
-
5
-
136
-
-
-
ACCCCCCCCCCCCCCX
-
14
-
65,553
-
-
-
By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.
-
Remediation
-
Upgrade semver to version 5.7.2, 6.3.1, 7.5.2 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
-
Note:
-
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
-
Remediation
-
Upgrade google.golang.org/protobuf/internal/encoding/json to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
-
Note:
-
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
-
Remediation
-
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Authentication Bypass by Capture-replay during the establishment of the secure channel. An attacker can manipulate handshake sequence numbers to delete messages sent immediately after the channel is established.
-
Note:
-
-
Sequence numbers are only validated once the channel is established and arbitrary messages are allowed during the handshake, allowing them to manipulate the sequence numbers.
-
-
The potential consequences of the general Terrapin attack are dependent on the messages exchanged after the handshake concludes. If you are using a custom SSH service and do not resort to the authentication protocol, you should check that dropping the first few messages of a connection does not yield security risks.
-
-
-
Impact:
-
While cryptographically novel, there is no discernable impact on the integrity of SSH traffic beyond giving the attacker the ability to delete the message that enables some features related to keystroke timing obfuscation. To successfully carry out the exploitation, the connection needs to be protected using either the ChaCha20-Poly1305 or CBC with Encrypt-then-MAC encryption methods. The attacker must also be able to intercept and modify the connection's traffic.
-
Workaround
-
Temporarily disable the affected chacha20-poly1305@openssh.com encryption and *-etm@openssh.com MAC algorithms in the affected configuration, and use unaffected algorithms like AES-GCM instead.
-
Remediation
-
Upgrade golang.org/x/crypto/ssh to version 0.17.0 or higher.
Affected versions of this package are vulnerable to Denial of Service (DoS) when decrypting JWE inputs. An attacker can cause a denial-of-service by providing a PBES2 encrypted JWE blob with a very large p2c value.
-
Details
-
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.
-
Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.
-
One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.
-
When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.
-
Two common types of DoS vulnerabilities:
-
-
High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.
-
-
Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package
-
-
-
Remediation
-
Upgrade github.com/go-jose/go-jose/v3 to version 3.0.1 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
-
Note:
-
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
-
Remediation
-
Upgrade google.golang.org/protobuf/internal/encoding/json to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
-
Note:
-
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
-
Remediation
-
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Authentication Bypass by Capture-replay during the establishment of the secure channel. An attacker can manipulate handshake sequence numbers to delete messages sent immediately after the channel is established.
-
Note:
-
-
Sequence numbers are only validated once the channel is established and arbitrary messages are allowed during the handshake, allowing them to manipulate the sequence numbers.
-
-
The potential consequences of the general Terrapin attack are dependent on the messages exchanged after the handshake concludes. If you are using a custom SSH service and do not resort to the authentication protocol, you should check that dropping the first few messages of a connection does not yield security risks.
-
-
-
Impact:
-
While cryptographically novel, there is no discernable impact on the integrity of SSH traffic beyond giving the attacker the ability to delete the message that enables some features related to keystroke timing obfuscation. To successfully carry out the exploitation, the connection needs to be protected using either the ChaCha20-Poly1305 or CBC with Encrypt-then-MAC encryption methods. The attacker must also be able to intercept and modify the connection's traffic.
-
Workaround
-
Temporarily disable the affected chacha20-poly1305@openssh.com encryption and *-etm@openssh.com MAC algorithms in the affected configuration, and use unaffected algorithms like AES-GCM instead.
-
Remediation
-
Upgrade golang.org/x/crypto/ssh to version 0.17.0 or higher.
Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification). An attacker could send a JWE containing compressed data that, when decompressed by Decrypt or DecryptMulti, would use large amounts of memory and CPU.
-
Remediation
-
Upgrade github.com/go-jose/go-jose/v3 to version 3.0.3 or higher.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Affected versions of this package are vulnerable to Denial of Service (DoS) in the implementation of the HTTP/2 protocol. An attacker can cause a denial of service (including via DDoS) by rapidly resetting many streams through request cancellation.
+
Affected versions of this package are vulnerable to Denial of Service (DoS) when decrypting JWE inputs. An attacker can cause a denial-of-service by providing a PBES2 encrypted JWE blob with a very large p2c value.
+
Details
+
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.
+
Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.
+
One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.
+
When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.
+
Two common types of DoS vulnerabilities:
+
+
High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.
+
+
Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package
+
+
Remediation
-
Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.
+
Upgrade github.com/go-jose/go-jose/v3 to version 3.0.1 or higher.
dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.
+
Affected versions of this package are vulnerable to Template Injection in purify.js, due to inconsistencies in the parsing of XML and HTML tags. Executable code can be injected in HTML inside XML CDATA blocks.
+
PoC
+
<![CDATA[ ><img src onerror=alert(1)> ]]>
+
+
Remediation
+
Upgrade dompurify to version 2.4.9, 3.0.11 or higher.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r6 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r6 or higher.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and xz-utils/liblzma5@5.2.5-2ubuntu1
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and xz-utils/liblzma5@5.2.5-2ubuntu1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and openssh/openssh-client@1:8.9p1-3ubuntu0.6
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and openssh/openssh-client@1:8.9p1-3ubuntu0.6
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and libgcrypt20@1.9.4-3ubuntu3
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and libgcrypt20@1.9.4-3ubuntu3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and gnutls28/libgnutls30@3.7.3-4ubuntu1.4
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and gnutls28/libgnutls30@3.7.3-4ubuntu1.4
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and gnutls28/libgnutls30@3.7.3-4ubuntu1.4
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and gnutls28/libgnutls30@3.7.3-4ubuntu1.4
Note:Versions mentioned in the description apply only to the upstream bash package and not the bash package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.
-
Remediation
-
Upgrade Ubuntu:22.04bash to version 5.1-6ubuntu1.1 or higher.
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and systemd/libsystemd0@249.11-0ubuntu3.12
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and systemd/libsystemd0@249.11-0ubuntu3.12
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and shadow/passwd@1:4.8.1-2ubuntu2.2
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and shadow/passwd@1:4.8.1-2ubuntu2.2
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and patch@2.7.6-7build2
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and patch@2.7.6-7build2
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and patch@2.7.6-7build2
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and patch@2.7.6-7build2
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and ncurses/libtinfo6@6.3-2ubuntu0.1
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and ncurses/libtinfo6@6.3-2ubuntu0.1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and ncurses/libtinfo6@6.3-2ubuntu0.1
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and ncurses/libtinfo6@6.3-2ubuntu0.1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and libzstd/libzstd1@1.4.8+dfsg-3build1
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and libzstd/libzstd1@1.4.8+dfsg-3build1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and gnupg2/gpgv@2.2.27-3ubuntu2.1
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and gnupg2/gpgv@2.2.27-3ubuntu2.1
Allocation of Resources Without Limits or Throttling
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and glibc/libc-bin@2.35-0ubuntu3.6
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and glibc/libc-bin@2.35-0ubuntu3.6
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and gcc-12/libstdc++6@12.3.0-1ubuntu1~22.04
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and gcc-12/libstdc++6@12.3.0-1ubuntu1~22.04
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.8.13 and coreutils@8.32-4.1ubuntu1.1
+ docker-image|quay.io/argoproj/argocd@v2.8.15 and coreutils@8.32-4.1ubuntu1.2
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r6 or higher.
diff --git a/docs/snyk/v2.9.9/argocd-iac-install.html b/docs/snyk/v2.9.11/argocd-iac-install.html
similarity index 99%
rename from docs/snyk/v2.9.9/argocd-iac-install.html
rename to docs/snyk/v2.9.11/argocd-iac-install.html
index e25fc886459cb..479842a386f7d 100644
--- a/docs/snyk/v2.9.9/argocd-iac-install.html
+++ b/docs/snyk/v2.9.11/argocd-iac-install.html
@@ -456,7 +456,7 @@
Snyk test report
-
March 24th 2024, 12:19:27 am (UTC+00:00)
+
April 14th 2024, 12:26:16 am (UTC+00:00)
Scanned the following path:
diff --git a/docs/snyk/v2.9.9/argocd-iac-namespace-install.html b/docs/snyk/v2.9.11/argocd-iac-namespace-install.html
similarity index 99%
rename from docs/snyk/v2.9.9/argocd-iac-namespace-install.html
rename to docs/snyk/v2.9.11/argocd-iac-namespace-install.html
index 5fd494538c87c..21cbecccdb659 100644
--- a/docs/snyk/v2.9.9/argocd-iac-namespace-install.html
+++ b/docs/snyk/v2.9.11/argocd-iac-namespace-install.html
@@ -456,7 +456,7 @@
Snyk test report
-
March 24th 2024, 12:19:35 am (UTC+00:00)
+
April 14th 2024, 12:26:24 am (UTC+00:00)
Scanned the following path:
diff --git a/docs/snyk/v2.9.11/argocd-test.html b/docs/snyk/v2.9.11/argocd-test.html
new file mode 100644
index 0000000000000..5bf9514eb455b
--- /dev/null
+++ b/docs/snyk/v2.9.11/argocd-test.html
@@ -0,0 +1,5830 @@
+
+
+
+
+
+
+
+
+ Snyk test report
+
+
+
+
+
+
+
+
+
+
+
Affected versions of this package are vulnerable to Denial of Service (DoS) in the implementation of the HTTP/2 protocol. An attacker can cause a denial of service (including via DDoS) by rapidly resetting many streams through request cancellation.
+
Remediation
+
Upgrade google.golang.org/grpc to version 1.56.3, 1.57.1, 1.58.3 or higher.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
+
Note:
+
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
+
Remediation
+
Upgrade google.golang.org/protobuf/internal/encoding/json to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Infinite loop via the protojson.Unmarshal function. An attacker can cause a denial of service condition by unmarshaling certain forms of invalid JSON.
+
Note:
+
This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
+
Remediation
+
Upgrade google.golang.org/protobuf/encoding/protojson to version 1.33.0 or higher.
Affected versions of this package are vulnerable to Authentication Bypass by Capture-replay during the establishment of the secure channel. An attacker can manipulate handshake sequence numbers to delete messages sent immediately after the channel is established.
+
Note:
+
+
Sequence numbers are only validated once the channel is established and arbitrary messages are allowed during the handshake, allowing them to manipulate the sequence numbers.
+
+
The potential consequences of the general Terrapin attack are dependent on the messages exchanged after the handshake concludes. If you are using a custom SSH service and do not resort to the authentication protocol, you should check that dropping the first few messages of a connection does not yield security risks.
+
+
+
Impact:
+
While cryptographically novel, there is no discernable impact on the integrity of SSH traffic beyond giving the attacker the ability to delete the message that enables some features related to keystroke timing obfuscation. To successfully carry out the exploitation, the connection needs to be protected using either the ChaCha20-Poly1305 or CBC with Encrypt-then-MAC encryption methods. The attacker must also be able to intercept and modify the connection's traffic.
+
Workaround
+
Temporarily disable the affected chacha20-poly1305@openssh.com encryption and *-etm@openssh.com MAC algorithms in the affected configuration, and use unaffected algorithms like AES-GCM instead.
+
Remediation
+
Upgrade golang.org/x/crypto/ssh to version 0.17.0 or higher.
Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification). An attacker could send a JWE containing compressed data that, when decompressed by Decrypt or DecryptMulti, would use large amounts of memory and CPU.
+
Remediation
+
Upgrade github.com/go-jose/go-jose/v3 to version 3.0.3 or higher.
dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.
+
Affected versions of this package are vulnerable to Template Injection in purify.js, due to inconsistencies in the parsing of XML and HTML tags. Executable code can be injected in HTML inside XML CDATA blocks.
+
PoC
+
<![CDATA[ ><img src onerror=alert(1)> ]]>
+
+
Remediation
+
Upgrade dompurify to version 2.4.9, 3.0.11 or higher.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r6 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: A bug has been identified in the processing of key and
+ initialisation vector (IV) lengths. This can lead to potential truncation
+ or overruns during the initialisation of some symmetric ciphers.
+
Impact summary: A truncation in the IV can result in non-uniqueness,
+ which could result in loss of confidentiality for some cipher modes.
+
When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or
+ EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after
+ the key and IV have been established. Any alterations to the key length,
+ via the "keylen" parameter or the IV length, via the "ivlen" parameter,
+ within the OSSL_PARAM array will not take effect as intended, potentially
+ causing truncation or overreading of these values. The following ciphers
+ and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.
+
For the CCM, GCM and OCB cipher modes, truncation of the IV can result in
+ loss of confidentiality. For example, when following NIST's SP 800-38D
+ section 8.2.1 guidance for constructing a deterministic IV for AES in
+ GCM mode, truncation of the counter portion could lead to IV reuse.
+
Both truncations and overruns of the key and overruns of the IV will
+ produce incorrect results and could, in some cases, trigger a memory
+ exception. However, these issues are not currently assessed as security
+ critical.
+
Changing the key and/or IV lengths is not considered to be a common operation
+ and the vulnerable API was recently introduced. Furthermore it is likely that
+ application developers will have spotted this problem during testing since
+ decryption would fail unless both peers in the communication were similarly
+ vulnerable. For these reasons we expect the probability of an application being
+ vulnerable to this to be quite low. However if an application is vulnerable then
+ this issue is considered very serious. For these reasons we have assessed this
+ issue as Moderate severity overall.
+
The OpenSSL SSL/TLS implementation is not affected by this issue.
+
The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because
+ the issue lies outside of the FIPS provider boundary.
+
OpenSSL 3.1 and 3.0 are vulnerable to this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r0 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: Generating excessively long X9.42 DH keys or checking
+ excessively long X9.42 DH keys or parameters may be very slow.
+
Impact summary: Applications that use the functions DH_generate_key() to
+ generate an X9.42 DH key may experience long delays. Likewise, applications
+ that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()
+ to check an X9.42 DH key or X9.42 DH parameters may experience long delays.
+ Where the key or parameters that are being checked have been obtained from
+ an untrusted source this may lead to a Denial of Service.
+
While DH_check() performs all the necessary checks (as of CVE-2023-3817),
+ DH_check_pub_key() doesn't make any of these checks, and is therefore
+ vulnerable for excessively large P and Q parameters.
+
Likewise, while DH_generate_key() performs a check for an excessively large
+ P, it doesn't check for an excessively large Q.
+
An application that calls DH_generate_key() or DH_check_pub_key() and
+ supplies a key or parameters obtained from an untrusted source could be
+ vulnerable to a Denial of Service attack.
+
DH_generate_key() and DH_check_pub_key() are also called by a number of
+ other OpenSSL functions. An application calling any of those other
+ functions may similarly be affected. The other functions affected by this
+ are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().
+
Also vulnerable are the OpenSSL pkey command line application when using the
+ "-pubcheck" option, as well as the OpenSSL genpkey command line application.
+
The OpenSSL SSL/TLS implementation is not affected by this issue.
+
The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r1 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: The POLY1305 MAC (message authentication code) implementation
+ contains a bug that might corrupt the internal state of applications running
+ on PowerPC CPU based platforms if the CPU provides vector instructions.
+
Impact summary: If an attacker can influence whether the POLY1305 MAC
+ algorithm is used, the application state might be corrupted with various
+ application dependent consequences.
+
The POLY1305 MAC (message authentication code) implementation in OpenSSL for
+ PowerPC CPUs restores the contents of vector registers in a different order
+ than they are saved. Thus the contents of some of these vector registers
+ are corrupted when returning to the caller. The vulnerable code is used only
+ on newer PowerPC processors supporting the PowerISA 2.07 instructions.
+
The consequences of this kind of internal application state corruption can
+ be various - from no consequences, if the calling application does not
+ depend on the contents of non-volatile XMM registers at all, to the worst
+ consequences, where the attacker could get complete control of the application
+ process. However unless the compiler uses the vector registers for storing
+ pointers, the most likely consequence, if any, would be an incorrect result
+ of some application dependent calculations or a crash leading to a denial of
+ service.
+
The POLY1305 MAC algorithm is most frequently used as part of the
+ CHACHA20-POLY1305 AEAD (authenticated encryption with associated data)
+ algorithm. The most common usage of this AEAD cipher is with TLS protocol
+ versions 1.2 and 1.3. If this cipher is enabled on the server a malicious
+ client can influence whether this AEAD cipher is used. This implies that
+ TLS server applications using OpenSSL can be potentially impacted. However
+ we are currently not aware of any concrete application that would be affected
+ by this issue therefore we consider this a Low severity security issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r3 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL
+ to crash leading to a potential Denial of Service attack
+
Impact summary: Applications loading files in the PKCS12 format from untrusted
+ sources might terminate abruptly.
+
A file in PKCS12 format can contain certificates and keys and may come from an
+ untrusted source. The PKCS12 specification allows certain fields to be NULL, but
+ OpenSSL does not correctly check for this case. This can lead to a NULL pointer
+ dereference that results in OpenSSL crashing. If an application processes PKCS12
+ files from an untrusted source using the OpenSSL APIs then that application will
+ be vulnerable to this issue.
+
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(),
+ PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
+ and PKCS12_newpass().
+
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
+ function is related to writing data we do not consider it security significant.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r5 or higher.
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r6 or higher.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when reading header data from CONTINUATION frames. As part of the HPACK flow, all incoming HEADERS and CONTINUATION frames are read even if their payloads exceed MaxHeaderBytes and will be discarded. An attacker can send excessive data over a connection to render it unresponsive.
+
Remediation
+
Upgrade golang.org/x/net/http2 to version 0.23.0 or higher.
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and xz-utils/liblzma5@5.2.5-2ubuntu1
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and xz-utils/liblzma5@5.2.5-2ubuntu1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and openssh/openssh-client@1:8.9p1-3ubuntu0.6
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and openssh/openssh-client@1:8.9p1-3ubuntu0.6
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and libgcrypt20@1.9.4-3ubuntu3
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and libgcrypt20@1.9.4-3ubuntu3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and gnutls28/libgnutls30@3.7.3-4ubuntu1.4
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and gnutls28/libgnutls30@3.7.3-4ubuntu1.4
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and gnutls28/libgnutls30@3.7.3-4ubuntu1.4
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and gnutls28/libgnutls30@3.7.3-4ubuntu1.4
Note:Versions mentioned in the description apply only to the upstream bash package and not the bash package as distributed by Ubuntu.
- See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
-
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.
-
Remediation
-
Upgrade Ubuntu:22.04bash to version 5.1-6ubuntu1.1 or higher.
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and systemd/libsystemd0@249.11-0ubuntu3.12
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and systemd/libsystemd0@249.11-0ubuntu3.12
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and shadow/passwd@1:4.8.1-2ubuntu2.2
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and shadow/passwd@1:4.8.1-2ubuntu2.2
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and patch@2.7.6-7build2
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and patch@2.7.6-7build2
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and patch@2.7.6-7build2
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and patch@2.7.6-7build2
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and ncurses/libtinfo6@6.3-2ubuntu0.1
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and ncurses/libtinfo6@6.3-2ubuntu0.1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and ncurses/libtinfo6@6.3-2ubuntu0.1
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and ncurses/libtinfo6@6.3-2ubuntu0.1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and libzstd/libzstd1@1.4.8+dfsg-3build1
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and libzstd/libzstd1@1.4.8+dfsg-3build1
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and krb5/libk5crypto3@1.19.2-2ubuntu0.3
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and gnupg2/gpgv@2.2.27-3ubuntu2.1
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and gnupg2/gpgv@2.2.27-3ubuntu2.1
Allocation of Resources Without Limits or Throttling
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and glibc/libc-bin@2.35-0ubuntu3.6
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and glibc/libc-bin@2.35-0ubuntu3.6
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and gcc-12/libstdc++6@12.3.0-1ubuntu1~22.04
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and gcc-12/libstdc++6@12.3.0-1ubuntu1~22.04
Introduced through:
- docker-image|quay.io/argoproj/argocd@v2.9.9 and coreutils@8.32-4.1ubuntu1.1
+ docker-image|quay.io/argoproj/argocd@v2.9.11 and coreutils@8.32-4.1ubuntu1.2
Note:Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine.
+ See How to fix? for Alpine:3.18 relevant fixed versions and status.
+
Issue summary: Some non-default TLS server configurations can cause unbounded
+ memory growth when processing TLSv1.3 sessions
+
Impact summary: An attacker may exploit certain server configurations to trigger
+ unbounded memory growth that would lead to a Denial of Service
+
This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is
+ being used (but not if early_data support is also configured and the default
+ anti-replay protection is in use). In this case, under certain conditions, the
+ session cache can get into an incorrect state and it will fail to flush properly
+ as it fills. The session cache will continue to grow in an unbounded manner. A
+ malicious client could deliberately create the scenario for this failure to
+ force a Denial of Service. It may also happen by accident in normal operation.
+
This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS
+ clients.
+
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL
+ 1.0.2 is also not affected by this issue.
+
Remediation
+
Upgrade Alpine:3.18openssl to version 3.1.4-r6 or higher.