[Bug 2008958] New: CVE-2021-38562 rt: User enumeration through a
timing side-channel attack [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2008958
Bug ID: 2008958
Summary: CVE-2021-38562 rt: User enumeration through a timing
side-channel attack [fedora-all]
Product: Fedora
Version: 34
Status: NEW
Component: rt
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: rc040203(a)freenet.de
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: j(a)tib.bs, perl-devel(a)lists.fedoraproject.org,
rc040203(a)freenet.de
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2008958
2 years, 7 months
[Bug 1482813] perl-Alien-ROOT not available on s390x because root is
not there
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1482813
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version|perl-Alien-ROOT-5.34.36.1-2 |perl-Alien-ROOT-5.34.36.1-2
|5.fc36 |5.fc36
|perl-Alien-ROOT-5.34.36.1-2 |perl-Alien-ROOT-5.34.36.1-2
|3.fc34 |3.fc34
|perl-Alien-ROOT-5.34.36.1-2 |perl-Alien-ROOT-5.34.36.1-2
|2.fc33 |2.fc33
| |perl-Alien-ROOT-5.34.36.1-2
| |5.fc35
--- Comment #14 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2021-b6bebeea3c has been pushed to the Fedora 35 stable repository.
If problem still persists, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1482813
2 years, 7 months
[Bug 1961865] New: perl-Net-CIDR-Lite: Incorrect handling of IP
address with leading zeros in IP octets
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1961865
Bug ID: 1961865
Summary: perl-Net-CIDR-Lite: Incorrect handling of IP address
with leading zeros in IP octets
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: thoger(a)redhat.com
CC: paul(a)city-fan.org, perl-devel(a)lists.fedoraproject.org,
pzhukov(a)redhat.com, steve(a)silug.org
Target Milestone: ---
Classification: Other
It was discovered that the perl Net-CIDR-Lite module did not correctly handle
IP addresses with IP octets containing leading zeros. Leading zeros were
ignored, while the underlying system can treat such octets as octal numbers and
interpret them differently. For example, IP address of 010.0.0.1 was
considered by Net-CIDR-Lite to be the same address as 10.0.0.1, while system
may consider it to be IP address 8.0.0.1.
Reference:
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distr...
This issue was fixed in Net-CIDR-Lite version 0.22 via this change:
https://metacpan.org/diff/file?target=STIGTSP/Net-CIDR-Lite-0.22/Lite.pm&...
An example of a potentially vulnerable use case can be found in the
SpamAssassin's URILocalBL plugin:
https://svn.apache.org/viewvc/spamassassin/tags/spamassassin_release_3_4_...
It allows checking URLs extracted from emails against locally defined blacklist
of IP ranges. IP addresses to check are typically obtained by resolving host
names used in URLs. However, URLs with IP addresses can be used directly.
Hence, this issue could potentially lead to a bypass of the defined blacklist.
Note that this plugin does not seem to be affected due to the use of a strict
regular expression used to determine if URL contains host name or IP address.
That regular expression does not consider addresses with leading zeros as valid
IP addresses and performs their resolution, translating the IP string to how
system interprets it.
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 7 months