Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #263784

Re: CVE (Critical + High) in bookworm image

Show all headers | View raw

On Wed, Nov 22, 2023 at 10:39:56PM +0530, thomas wrote:
> is there any way we could get
> a fix in bookworm release or is there any other suggestion.

Whenever the security team releases a fix.

> CVE-2023-45853

https://security-tracker.debian.org/tracker/CVE-2023-45853

  "MiniZip in zlib through 1.3 has an integer overflow and resultant
  heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long
  filename, comment, or extra field. NOTE: MiniZip is not a supported
  part of the zlib product."

>  JFrog Severity -High

I don't know how that severity level was determined.  A buffer overflow
in an unsupported part of the library doesn't sound "High" severity to
me, but hey, what do I know.

>  Summary
> 
> A heap buffer overflow in zlib may lead to remote code execution when
> parsing a malicious archive.

Here's what I don't immediately understand: what actually triggers
the bug?  Does it require some explicit request to access the MiniZip
functionality, or does it just automatically get called if the input
archive is compressed with it?

In other words, if you've got a malicious input file, will something
like "zcat mailicious.minizip" trigger it, or do you have to pass
a "--minizip" flag or something?

If it's the former, then maybe the "High" severity is justified.

>  CVE-2023-31484
> Missing TLS check in CPAN.pm allows man-in-the-middle attacks when
> downloading packages and may lead to code execution.

That sounds pretty avoidable.  Just don't do that.  Do you actually use
CPAN to download and compile perl modules on this system?  If not, then
this bug can't possibly affect you.

In order to trigger this, not only would you have to be using CPAN in
that way on your system, but the attacker would *also* have to compromise
either the CPAN file servers, or some part of your TCP/IP connection to
them.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

CVE (Critical + High) in bookworm image thomas <thomas.roshin@gmail.com> - 2023-11-22 18:30 +0100
  Re: CVE (Critical + High) in bookworm image Greg Wooledge <greg@wooledge.org> - 2023-11-22 19:00 +0100
    Re: CVE (Critical + High) in bookworm image David Wright <deblis@lionunicorn.co.uk> - 2023-11-22 20:40 +0100
      Re: CVE (Critical + High) in bookworm image Greg Wooledge <greg@wooledge.org> - 2023-11-22 21:30 +0100
        Re: CVE (Critical + High) in bookworm image David Wright <deblis@lionunicorn.co.uk> - 2023-11-23 04:30 +0100

csiph-web