Skip to content

Commit 2a8db14

Browse files
dongsuparkdongsupark
authored
Merge pull request #1453 from flatcar/buildbot/monthly-glsa-metadata-updates-2023-12-01
Monthly GLSA metadata 2023-12-01
2 parents e8a2985 + 1a3b2b8 commit 2a8db14

22 files changed

+981
-17
lines changed

‎sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
-----BEGIN PGP SIGNED MESSAGE-----
22
Hash: SHA512
33

4-
MANIFEST Manifest.files.gz 552633 BLAKE2B f04d03cfce30402b87d7525767633e29394130432fcdd26de705b95ca93788a70abca8abbeee435b946253f2ad9b75f01bf24da1998a529bb89a6bbf1fcfc16e SHA512 6b0fd8a9a899a613a7dbab3dc51f5953cd3a0d18a12e17a4fceca64f11be5c7f83763d742dfada845bf1aec1c1467db31c6df823b9bc683d59fbec9a516d285a
5-
TIMESTAMP 2023-11-01T06:40:04Z
4+
MANIFEST Manifest.files.gz 555493 BLAKE2B 9b9c68f6fcd5aa241244f03965d32d2bee2397eebacb0b4742f3b5eff9058f33cdb8d4c1f96505cd2a1acaed4347077a204862e5674effe944e54b05e7466726 SHA512 bf81aa35acfc8893b8a8ffc0d57915c1a8e6b54e9400f0d03f26dd199de30e2601f7a7c1060d2185e26c3276979665ae687fb8e8a1e2b4d537df4a3270e38d43
5+
TIMESTAMP 2023-12-01T06:40:02Z
66
-----BEGIN PGP SIGNATURE-----
77

8-
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmVB8sRfFIAAAAAALgAo
8+
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmVpf8JfFIAAAAAALgAo
99
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
1010
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
11-
klDycxAArpKet3g/jSJskcceOF38byx5QitCsuFUiXggVy/3UtTs2F9QY0awzRyN
12-
daT6+MHgL/oMPDQKOF+Gdnxeks9iWhEENMsUGyi/C4gKb9BHe9KzMCKpz/5YuKLj
13-
mOZUsJjChrTMf97N9zuYFLPt+YhHlidKG2Nfa7oqEzUZed3nJK96QCWfHOKDBS8q
14-
Pa/JAQ1Gca5Lt4vrlVGYreMCWzb0/9QEFex3WpN8K1TVQi4ttwysOI0zNWaUPilr
15-
o4x1yu2z+Iel3khyazx6FpRFlHrqNBOklmz3vkFleok5r+21qfxy05pwUw5a9rJN
16-
FxwyFtflborCepZCEN4k9YrYILk3yxhfrTvCl9GPD2mhqLA8KW3Lek4RZPXur1HK
17-
laMy/d8Ziw/Z9/ksGim+LfVOJ7F0fgUFJxIJJ+eBLGZzz0RzLl64IKEugVxBnoCU
18-
h2S0XiUUQpGGHlMTkQ5LgcWfbtorgZyQbUX4m/iCo0DGg66+7MADow8yRKRXGNQl
19-
SN24MstUnhU7O/6plg35TRel9fhozl2vau5dWIpm/A3znHmyC3IT53Ffjo3dSwYW
20-
tHURmCy7Sz5K1gxB20PsQnt63L+WCya1vhTpF2kCzLivrYjypUXlIbuQXA7AGE7k
21-
ycBJqVGSz36DuCiEX0ckQbiIHreYqUQLjteVE85Y4XQyX4CSjZs=
22-
=bBmm
11+
klAidhAApvskqQHXNDKb23KYww5txqWvEIG7F3zNXzL2khrVh1PxoPhey6mf/bO5
12+
75lyy0i5D6MZuEUMJW2MEIrcqALpz7mmfPD8v2D/OT053XqP7UuLPBKeeTlQ2w+m
13+
KpCvgMohqFVQjMVlKbYtCAq1Fx3tvafo03JCTseKlZ2sF8xdxIo0sMJGBs2tSc5J
14+
vaxjkT2Wo4CSn0XT8G1g1d6iLIs4eIhKsDWy759WyCU/43g1TzGXqDGhIQSXEX0C
15+
oeJsKK/V1fLPLcP9CnoqRGQ46/L8LdjTDYfb9caKgQ8lCh/hqZce3Lqfyh4KRd2k
16+
uw51if5KABbRAQ4Qc12l1S8JQH4T0yR/BB70ywb50dIfxmQJQrzpr5ybhv5P66jz
17+
EJkpNShtvrZvuYxF71KpTYsuJWNnNuJLRUIrywtyj4f1rmxgqdBRDec+ycrjNGOl
18+
MzCrk3PgEb6lV6qvMicyVYakq6Yl861hVE9kquoh0djsm9velGXnV1l1+jcTLubH
19+
0pPS4luIVhkGuGzoej7UOwhdpUdeZjqPcPPF63+VeIJVZscAizlGnYP/IE7DNyYQ
20+
PBSphTSR5s50IRItmnuDdnzitwmGQM5ngWDFO7Y8T4icxN34GlxpV/LmODnweutd
21+
KNt68X7UTuhNoKV7+ifeunQ3fu7q/VdI5an9REaGKVg/eFoFvtk=
22+
=S+ig
2323
-----END PGP SIGNATURE-----

‎sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz

2.79 KB
Binary file not shown.

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202311-01.xml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202311-01">
4+
<title>GitPython: Code Execution via Crafted Input</title>
5+
<synopsis>A vulnerability has been discovered in GitPython where crafted input to Repo.clone_from can lead to code execution</synopsis>
6+
<product type="ebuild">GitPython</product>
7+
<announced>2023-11-01</announced>
8+
<revised count="1">2023-11-01</revised>
9+
<bug>884623</bug>
10+
<access>local</access>
11+
<affected>
12+
<package name="dev-python/GitPython" auto="yes" arch="*">
13+
<unaffected range="ge">3.1.30</unaffected>
14+
<vulnerable range="lt">3.1.30</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>GitPython is a Python library used to interact with Git repositories.</p>
19+
</background>
20+
<description>
21+
<p>Please review the CVE identifier referenced below for details.</p>
22+
</description>
23+
<impact type="high">
24+
<p>An attacker may be able to trigger Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.</p>
25+
</impact>
26+
<workaround>
27+
<p>There is no known workaround at this time.</p>
28+
</workaround>
29+
<resolution>
30+
<p>All GitPython users should upgrade to the latest version:</p>
31+
32+
<code>
33+
# emerge --sync
34+
# emerge --ask --oneshot --verbose ">=dev-python/GitPython-3.1.30"
35+
</code>
36+
</resolution>
37+
<references>
38+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-24439">CVE-2022-24439</uri>
39+
</references>
40+
<metadata tag="requester" timestamp="2023-11-01T12:20:26.255981Z">graaff</metadata>
41+
<metadata tag="submitter" timestamp="2023-11-01T12:20:26.259121Z">graaff</metadata>
42+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202311-02.xml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202311-02">
4+
<title>Netatalk: Multiple Vulnerabilities including root remote code execution</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in Netatalk, which could lead to remote code execution</synopsis>
6+
<product type="ebuild">netatalk</product>
7+
<announced>2023-11-01</announced>
8+
<revised count="1">2023-11-01</revised>
9+
<bug>837623</bug>
10+
<bug>881259</bug>
11+
<bug>915354</bug>
12+
<access>remote</access>
13+
<affected>
14+
<package name="net-fs/netatalk" auto="yes" arch="*">
15+
<unaffected range="ge">3.1.18</unaffected>
16+
<vulnerable range="lt">3.1.18</vulnerable>
17+
</package>
18+
</affected>
19+
<background>
20+
<p>Netatalk is a kernel level implementation of the AppleTalk Protocol Suite, which allows Unix hosts to act as file, print, and time servers for Apple computers. It includes several script utilities, including etc2ps.sh.</p>
21+
</background>
22+
<description>
23+
<p>Multiple vulnerabilities have been discovered in Netatalk. Please review the CVE identifiers referenced below for details.</p>
24+
</description>
25+
<impact type="high">
26+
<p>Please review the referenced CVE identifiers for details.</p>
27+
</impact>
28+
<workaround>
29+
<p>There is no known workaround at this time.</p>
30+
</workaround>
31+
<resolution>
32+
<p>All Netatalk users should upgrade to the latest version:</p>
33+
34+
<code>
35+
# emerge --sync
36+
# emerge --ask --oneshot --verbose ">=net-fs/netatalk-3.1.18"
37+
</code>
38+
</resolution>
39+
<references>
40+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-31439">CVE-2021-31439</uri>
41+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-0194">CVE-2022-0194</uri>
42+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-22995">CVE-2022-22995</uri>
43+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-23121">CVE-2022-23121</uri>
44+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-23122">CVE-2022-23122</uri>
45+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-23123">CVE-2022-23123</uri>
46+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-23124">CVE-2022-23124</uri>
47+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-23125">CVE-2022-23125</uri>
48+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-45188">CVE-2022-45188</uri>
49+
</references>
50+
<metadata tag="requester" timestamp="2023-11-01T14:46:24.671379Z">graaff</metadata>
51+
<metadata tag="submitter" timestamp="2023-11-01T14:46:24.673441Z">graaff</metadata>
52+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202311-03.xml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202311-03">
4+
<title>SQLite: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in SQLite, the worst of which may lead to code execution.</synopsis>
6+
<product type="ebuild">sqlite</product>
7+
<announced>2023-11-24</announced>
8+
<revised count="1">2023-11-24</revised>
9+
<bug>886029</bug>
10+
<bug>906114</bug>
11+
<access>local and remote</access>
12+
<affected>
13+
<package name="dev-db/sqlite" auto="yes" arch="*">
14+
<unaffected range="ge">3.42.0</unaffected>
15+
<vulnerable range="lt">3.42.0</vulnerable>
16+
</package>
17+
</affected>
18+
<background>
19+
<p>SQLite is a C library that implements an SQL database engine.</p>
20+
</background>
21+
<description>
22+
<p>Multiple vulnerabilities have been discovered in SQLite. Please review the CVE identifiers referenced below for details.</p>
23+
</description>
24+
<impact type="high">
25+
<p>Please review the referenced CVE identifiers for details.</p>
26+
</impact>
27+
<workaround>
28+
<p>There is no known workaround at this time.</p>
29+
</workaround>
30+
<resolution>
31+
<p>All SQLite users should upgrade to the latest version:</p>
32+
33+
<code>
34+
# emerge --sync
35+
# emerge --ask --oneshot --verbose ">=dev-db/sqlite-3.42.0"
36+
</code>
37+
</resolution>
38+
<references>
39+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-31239">CVE-2021-31239</uri>
40+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-46908">CVE-2022-46908</uri>
41+
</references>
42+
<metadata tag="requester" timestamp="2023-11-24T12:29:15.707023Z">graaff</metadata>
43+
<metadata tag="submitter" timestamp="2023-11-24T12:29:15.709025Z">graaff</metadata>
44+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202311-04.xml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202311-04">
4+
<title>Zeppelin: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in Zeppelin, the worst of which could lead to remote code execution.</synopsis>
6+
<product type="ebuild">zeppelin-bin</product>
7+
<announced>2023-11-24</announced>
8+
<revised count="1">2023-11-24</revised>
9+
<bug>811447</bug>
10+
<access>remote</access>
11+
<affected>
12+
<package name="www-apps/zeppelin-bin" auto="yes" arch="*">
13+
<unaffected range="ge">0.10.1</unaffected>
14+
<vulnerable range="lt">0.10.1</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>Apache Zeppelin is a web-based notebook that enables data-driven, interactive data analytics and collaborative documents with SQL, Scala, Python, R and more.</p>
19+
</background>
20+
<description>
21+
<p>Multiple vulnerabilities have been discovered in Zeppelin. Please review the CVE identifiers referenced below for details.</p>
22+
</description>
23+
<impact type="high">
24+
<p>Please review the referenced CVE identifiers for details.</p>
25+
</impact>
26+
<workaround>
27+
<p>There is no known workaround at this time.</p>
28+
</workaround>
29+
<resolution>
30+
<p>All Zeppelin users should upgrade to the latest version:</p>
31+
32+
<code>
33+
# emerge --sync
34+
# emerge --ask --oneshot --verbose ">=www-apps/zeppelin-bin-0.10.1"
35+
</code>
36+
</resolution>
37+
<references>
38+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-10095">CVE-2019-10095</uri>
39+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-13929">CVE-2020-13929</uri>
40+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-27578">CVE-2021-27578</uri>
41+
</references>
42+
<metadata tag="requester" timestamp="2023-11-24T13:19:41.936818Z">graaff</metadata>
43+
<metadata tag="submitter" timestamp="2023-11-24T13:19:41.939030Z">graaff</metadata>
44+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202311-05.xml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202311-05">
4+
<title>LinuxCIFS utils: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in LinuxCIFS utils, the worst of which can lead to local root privilege escalation.</synopsis>
6+
<product type="ebuild">cifs-utils</product>
7+
<announced>2023-11-24</announced>
8+
<revised count="1">2023-11-24</revised>
9+
<bug>842234</bug>
10+
<access>local</access>
11+
<affected>
12+
<package name="net-fs/cifs-utils" auto="yes" arch="*">
13+
<unaffected range="ge">6.15</unaffected>
14+
<vulnerable range="lt">6.15</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>The LinuxCIFS utils are a collection of tools for managing Linux CIFS Client Filesystems.</p>
19+
</background>
20+
<description>
21+
<p>Multiple vulnerabilities have been discovered in LinuxCIFS utils. Please review the CVE identifiers referenced below for details.</p>
22+
</description>
23+
<impact type="high">
24+
<p>A stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.
25+
26+
When verbose logging is enabled, invalid credentials file lines may be dumped to stderr. This may lead to information disclosure in particular conditions when the credentials file given is sensitive and contains &#39;=&#39; signs.</p>
27+
</impact>
28+
<workaround>
29+
<p>There is no known workaround at this time.</p>
30+
</workaround>
31+
<resolution>
32+
<p>All LinuxCIFS utils users should upgrade to the latest version:</p>
33+
34+
<code>
35+
# emerge --sync
36+
# emerge --ask --oneshot --verbose ">=net-fs/cifs-utils-6.15"
37+
</code>
38+
</resolution>
39+
<references>
40+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-27239">CVE-2022-27239</uri>
41+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-29869">CVE-2022-29869</uri>
42+
</references>
43+
<metadata tag="requester" timestamp="2023-11-24T14:19:44.552258Z">graaff</metadata>
44+
<metadata tag="submitter" timestamp="2023-11-24T14:19:44.554584Z">graaff</metadata>
45+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202311-06.xml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202311-06">
4+
<title>multipath-tools: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been discovered in multipath-tools, the worst of which can lead to root privilege escalation.</synopsis>
6+
<product type="ebuild">multipath-tools</product>
7+
<announced>2023-11-25</announced>
8+
<revised count="1">2023-11-25</revised>
9+
<bug>878763</bug>
10+
<access>local</access>
11+
<affected>
12+
<package name="sys-fs/multipath-tools" auto="yes" arch="*">
13+
<unaffected range="ge">0.9.3</unaffected>
14+
<vulnerable range="lt">0.9.3</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>multipath-tools are used to drive the Device Mapper multipathing driver.</p>
19+
</background>
20+
<description>
21+
<p>Multiple vulnerabilities have been discovered in multipath-tools. Please review the CVE identifiers referenced below for details.</p>
22+
</description>
23+
<impact type="high">
24+
<p>Please review the referenced CVE identifiers for details.</p>
25+
</impact>
26+
<workaround>
27+
<p>There is no known workaround at this time.</p>
28+
</workaround>
29+
<resolution>
30+
<p>All multipath-tools users should upgrade to the latest version:</p>
31+
32+
<code>
33+
# emerge --sync
34+
# emerge --ask --oneshot --verbose ">=sys-fs/multipath-tools-0.9.3"
35+
</code>
36+
</resolution>
37+
<references>
38+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-41973">CVE-2022-41973</uri>
39+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-41974">CVE-2022-41974</uri>
40+
</references>
41+
<metadata tag="requester" timestamp="2023-11-25T08:13:29.146678Z">graaff</metadata>
42+
<metadata tag="submitter" timestamp="2023-11-25T08:13:29.148791Z">graaff</metadata>
43+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202311-07.xml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202311-07">
4+
<title>AIDE: Root Privilege Escalation</title>
5+
<synopsis>A vulnerability has been found in AIDE which can lead to root privilege escalation.</synopsis>
6+
<product type="ebuild">aide</product>
7+
<announced>2023-11-25</announced>
8+
<revised count="1">2023-11-25</revised>
9+
<bug>831658</bug>
10+
<access>remote</access>
11+
<affected>
12+
<package name="app-forensics/aide" auto="yes" arch="*">
13+
<unaffected range="ge">0.17.4</unaffected>
14+
<vulnerable range="lt">0.17.4</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>AIDE (Advanced Intrusion Detection Environment) is a file and directory integrity checker.
19+
20+
It creates a database from the regular expression rules that it finds from the config file(s). Once this database is initialized it can be used to verify the integrity of the files. It has several message digest algorithms (see below) that are used to check the integrity of the file. All of the usual file attributes can also be checked for inconsistencies.</p>
21+
</background>
22+
<description>
23+
<p>A vulnerability has been discovered in AIDE. Please review the CVE identifier referenced below for details.</p>
24+
</description>
25+
<impact type="high">
26+
<p>AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow.</p>
27+
</impact>
28+
<workaround>
29+
<p>There is no known workaround at this time.</p>
30+
</workaround>
31+
<resolution>
32+
<p>All AIDE users should upgrade to the latest version:</p>
33+
34+
<code>
35+
# emerge --sync
36+
# emerge --ask --oneshot --verbose ">=app-forensics/aide-0.17.4"
37+
</code>
38+
</resolution>
39+
<references>
40+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-45417">CVE-2021-45417</uri>
41+
</references>
42+
<metadata tag="requester" timestamp="2023-11-25T08:24:47.076936Z">graaff</metadata>
43+
<metadata tag="submitter" timestamp="2023-11-25T08:24:47.079410Z">graaff</metadata>
44+
</glsa>

0 commit comments

Comments
 (0)