Gentoo Linux Security Advisory 202405-10 - A vulnerability has been discovered in Setuptools, which can lead to denial of service. Versions greater than or equal to 65.5.1 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202405-10  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: Setuptools: Denial of Service  
     Date: May 05, 2024  
     Bugs: #879813  
       ID: 202405-10

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
A vulnerability has been discovered in Setuptools, which can lead to  
denial of service.

Background  
=========  
Setuptools is a manager for Python packages.

Affected packages  
================  
Package                Vulnerable    Unaffected  
---------------------  ------------  ------------  
dev-python/setuptools  < 65.5.1      >= 65.5.1

Description  
==========  
A vulnerability has been discovered in Setuptools. See the impact field.

Impact  
=====  
An inefficiency in a regular expression may end in a denial of service  
if an user is fetching malicious HTML from a package in PyPI or a custom  
PackageIndex page.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All Setuptools users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">Þv-python/setuptools-65.5.1"

References  
=========  
[ 1 ] CVE-2022-40897  
      https://nvd.nist.gov/vuln/detail/CVE-2022-40897

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202405-10

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202405-10

Gentoo Linux Security Advisory 202405-9 - Multiple vulnerabilities have been found in MediaInfo and MediaInfoLib, the worst of which could allow user-assisted remote code execution. Versions greater than or equal to 23.10 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202405-09  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: MediaInfo, MediaInfoLib: Multiple Vulnerabilities  
     Date: May 04, 2024  
     Bugs: #778992, #836564, #875374, #917612  
       ID: 202405-09

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
Multiple vulnerabilities have been found in MediaInfo and MediaInfoLib,  
the worst of which could allow user-assisted remote code execution.

Background  
=========  
MediaInfo supplies technical and tag information about media files.  
MediaInfoLib contains MediaInfo libraries.

Affected packages  
================  
Package                  Vulnerable    Unaffected  
-----------------------  ------------  ------------  
media-libs/libmediainfo  < 23.10       >= 23.10  
media-video/mediainfo    < 23.10       >= 23.10

Description  
==========  
Multiple vulnerabilities have been discovered in MediaInfo and  
MediaInfoLib. Please review the CVE identifiers referenced below for  
details.

Impact  
=====  
Please review the referenced CVE identifiers for details.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All MediaInfo users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=media-video/mediainfo-23.10"

All MediaInfolib users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=media-libs/libmediainfo-23.10"

References  
=========

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202405-09

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202405-09

Gentoo Linux Security Advisory 202405-8 - Multiple vulnerabilities have been discovered in strongSwan, the worst of which could possibly lead to remote code execution. Versions greater than or equal to 5.9.10 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202405-08  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: strongSwan: Multiple Vulnerabilities  
     Date: May 04, 2024  
     Bugs: #818841, #832460, #878887, #899964  
       ID: 202405-08

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
Multiple vulnerabilities have been discovered in strongSwan, the worst  
of which could possibly lead to remote code execution.

Background  
=========  
strongSwan is an IPSec implementation for Linux.

Affected packages  
================  
Package             Vulnerable    Unaffected  
------------------  ------------  ------------  
net-vpn/strongswan  < 5.9.10      >= 5.9.10

Description  
==========  
Multiple vulnerabilities have been discovered in strongSwan. Please  
review the CVE identifiers referenced below for details.

Impact  
=====  
Please review the referenced CVE identifiers for details.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All strongSwan users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=net-vpn/strongswan-5.9.10"

References  
=========  
[ 1 ] CVE-2021-41991  
      https://nvd.nist.gov/vuln/detail/CVE-2021-41991  
[ 2 ] CVE-2021-45079  
      https://nvd.nist.gov/vuln/detail/CVE-2021-45079  
[ 3 ] CVE-2022-40617  
      https://nvd.nist.gov/vuln/detail/CVE-2022-40617  
[ 4 ] CVE-2023-26463  
      https://nvd.nist.gov/vuln/detail/CVE-2023-26463

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202405-08

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202405-08

Gentoo Linux Security Advisory 202405-7 - Multiple vulnerabilities have been discovered in HTMLDOC, the worst of which can lead to arbitrary code execution. Versions greater than or equal to 1.9.16 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202405-07  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: HTMLDOC: Multiple Vulnerabilities  
     Date: May 04, 2024  
     Bugs: #780489  
       ID: 202405-07

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
Multiple vulnerabilities have been discovered in HTMLDOC, the worst of  
which can lead to arbitrary code execution.

Background  
=========  
HTMLDOC is a HTML indexer and HTML to PS and PDF converter.

Affected packages  
================  
Package           Vulnerable    Unaffected  
----------------  ------------  ------------  
app-text/htmldoc  < 1.9.16      >= 1.9.16

Description  
==========  
Multiple vulnerabilities have been discovered in HTMLDOC. Please review  
the CVE identifiers referenced below for details.

Impact  
=====  
Please review the referenced CVE identifiers for details.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All HTMLDOC users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=app-text/htmldoc-1.9.16"

References  
=========  
[ 1 ] CVE-2021-20308  
      https://nvd.nist.gov/vuln/detail/CVE-2021-20308  
[ 2 ] CVE-2021-23158  
      https://nvd.nist.gov/vuln/detail/CVE-2021-23158  
[ 3 ] CVE-2021-23165  
      https://nvd.nist.gov/vuln/detail/CVE-2021-23165  
[ 4 ] CVE-2021-23180  
      https://nvd.nist.gov/vuln/detail/CVE-2021-23180  
[ 5 ] CVE-2021-23191  
      https://nvd.nist.gov/vuln/detail/CVE-2021-23191  
[ 6 ] CVE-2021-23206  
      https://nvd.nist.gov/vuln/detail/CVE-2021-23206  
[ 7 ] CVE-2021-26252  
      https://nvd.nist.gov/vuln/detail/CVE-2021-26252  
[ 8 ] CVE-2021-26259  
      https://nvd.nist.gov/vuln/detail/CVE-2021-26259  
[ 9 ] CVE-2021-26948  
      https://nvd.nist.gov/vuln/detail/CVE-2021-26948  
[ 10 ] CVE-2021-33235  
      https://nvd.nist.gov/vuln/detail/CVE-2021-33235  
[ 11 ] CVE-2021-33236  
      https://nvd.nist.gov/vuln/detail/CVE-2021-33236  
[ 12 ] CVE-2021-40985  
      https://nvd.nist.gov/vuln/detail/CVE-2021-40985  
[ 13 ] CVE-2021-43579  
      https://nvd.nist.gov/vuln/detail/CVE-2021-43579  
[ 14 ] CVE-2022-0137  
      https://nvd.nist.gov/vuln/detail/CVE-2022-0137  
[ 15 ] CVE-2022-0534  
      https://nvd.nist.gov/vuln/detail/CVE-2022-0534  
[ 16 ] CVE-2022-24191  
      https://nvd.nist.gov/vuln/detail/CVE-2022-24191  
[ 17 ] CVE-2022-27114  
      https://nvd.nist.gov/vuln/detail/CVE-2022-27114  
[ 18 ] CVE-2022-28085  
      https://nvd.nist.gov/vuln/detail/CVE-2022-28085  
[ 19 ] CVE-2022-34033  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34033  
[ 20 ] CVE-2022-34035  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34035

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202405-07

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202405-07

Gentoo Linux Security Advisory 202405-6 - Multiple vulnerabilities have been discovered in mujs, the worst of which could lead to remote code execution. Versions greater than or equal to 1.3.2 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202405-06  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: mujs: Multiple Vulnerabilities  
     Date: May 04, 2024  
     Bugs: #833453, #845399, #882775  
       ID: 202405-06

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
Multiple vulnerabilities have been discovered in mujs, the worst of  
which could lead to remote code execution.

Background  
=========  
mujs is an embeddable Javascript interpreter in C.

Affected packages  
================  
Package        Vulnerable    Unaffected  
-------------  ------------  ------------  
dev-lang/mujs  < 1.3.2       >= 1.3.2

Description  
==========  
Multiple vulnerabilities have been discovered in mujs. Please review the  
CVE identifiers referenced below for details.

Impact  
=====  
Please review the referenced CVE identifiers for details.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All mujs users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">Þv-lang/mujs-1.3.2"

References  
=========  
[ 1 ] CVE-2021-45005  
      https://nvd.nist.gov/vuln/detail/CVE-2021-45005  
[ 2 ] CVE-2022-30974  
      https://nvd.nist.gov/vuln/detail/CVE-2022-30974  
[ 3 ] CVE-2022-30975  
      https://nvd.nist.gov/vuln/detail/CVE-2022-30975  
[ 4 ] CVE-2022-44789  
      https://nvd.nist.gov/vuln/detail/CVE-2022-44789

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202405-06

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202405-06

Gentoo Linux Security Advisory 202405-5 - Multiple vulnerabilities have been discovered in MPlayer, the worst of which can lead to arbitrary code execution. Versions greater than or equal to 1.5 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202405-05  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: MPlayer: Multiple Vulnerabilities  
     Date: May 04, 2024  
     Bugs: #870406  
       ID: 202405-05

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
Multiple vulnerabilities have been discovered in MPlayer, the worst of  
which can lead to arbitrary code execution.

Background  
=========  
MPlayer is a media player capable of handling multiple multimedia file  
formats.

Affected packages  
================  
Package              Vulnerable    Unaffected  
-------------------  ------------  ------------  
media-video/mplayer  < 1.5         >= 1.5

Description  
==========  
Multiple vulnerabilities have been discovered in MPlayer. Please review  
the CVE identifiers referenced below for details.

Impact  
=====  
Please review the referenced CVE identifiers for details.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All MPlayer users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=media-video/mplayer-1.5"

References  
=========  
[ 1 ] CVE-2022-38600  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38600  
[ 2 ] CVE-2022-38850  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38850  
[ 3 ] CVE-2022-38851  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38851  
[ 4 ] CVE-2022-38853  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38853  
[ 5 ] CVE-2022-38855  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38855  
[ 6 ] CVE-2022-38856  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38856  
[ 7 ] CVE-2022-38858  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38858  
[ 8 ] CVE-2022-38860  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38860  
[ 9 ] CVE-2022-38861  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38861  
[ 10 ] CVE-2022-38862  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38862  
[ 11 ] CVE-2022-38863  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38863  
[ 12 ] CVE-2022-38864  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38864  
[ 13 ] CVE-2022-38865  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38865  
[ 14 ] CVE-2022-38866  
      https://nvd.nist.gov/vuln/detail/CVE-2022-38866

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202405-05

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202405-05

Live2D Cubism suffers from a heap corruption vulnerability.

    Live2D Cubism is the dominant "vtuber" software suite for 2D avatars for use in livestreaming and integrating them in other software.They publish various SDKs and a frameworks for integrating their libraries with your own program. You're supposed to use those to deserialize and render/animate the models created with their main software - often untrusted files from random people on the internet.While their main java-based programs and their web toolkit seem to have at least minimal sanity checks for input, the same is not true for their "native" (C/C++) framework.This is trivially, unintentionally and repeatedly triggered by people just testing it with janky rips available broadly on the internet, such as this model of a Discord moderator: https://github.com/Eikanya/Live2d-model/tree/master/%E4%B8%BA%E7%BE%8E%E5%A5%BD%E7%9A%84%E4%B8%96%E7%95%8C%E7%8C%AE%E4%B8%8A%E7%A5%9D%E7%A6%8F%EF%BC%81Fantastic%20Days/1399100Those models have nonsense numbers of total segments and points for the animation curves because the Unity live2d asset ripper which was used to generate them calculates the totals wrong. The framework happily trusts the totals and lets you squirt as many bytes (or, more accurately, floating point numbers) as there is contiguous memory allocated. If you hit the upper bound you will segfault, otherwise your allocator will probably panic only on the next free() or allocation.e.g. https://github.com/MizunagiKB/gd_cubism/issues/52TLDR: They don't validate that the total numbers of points and segments in animations actually match the total numbers in the corresponding arrays in serialized models. I sent them a patch to recalculate those numbers and ignore the totals, as it's really annoying to have to validate every model manually with an external python script, but they refuse to apply it because the data wasn't generated by their official program and they think this is a customer support issue ?This leaves gaping wide open a heap corruption issue that I don't have the skill or time to actually exploit in any interesting way, but I'm just going to leave this here because fuck those guys. They also like to send their deranged fanboys after anyone reporting on their incompetence and negligence, because if you're not willing to spend thankless weeks/months trying to get RCE then your bug isn't really el8 enough: https://github.com/UlyssesWu/D2Evil/issues/6#issuecomment-1685596304PT

Live2D Cubism Heap Corruption

Gentoo Linux Security Advisory 202405-4 - Multiple vulnerabilities have been discovered in systemd, the worst of which can lead to a denial of service. Versions greater than or equal to 252.4 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202405-04  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: systemd: Multiple Vulnerabilities  
     Date: May 04, 2024  
     Bugs: #882769, #887581  
       ID: 202405-04

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
========

Multiple vulnerabilities have been discovered in systemd, the worst of  
which can lead to a denial of service.

Background  
==========

A system and service manager.

Affected packages  
=================

Package           Vulnerable    Unaffected  
----------------  ------------  ------------  
sys-apps/systemd  < 252.4       >= 252.4

Description  
===========

Multiple vulnerabilities have been discovered in systemd. Please review  
the CVE identifiers referenced below for details.

Impact  
======

Please review the referenced CVE identifiers for details.

Workaround  
==========

There is no known workaround at this time.

Resolution  
==========

All systemd users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=sys-apps/systemd-252.4"

References  
==========

[ 1 ] CVE-2022-4415  
      https://nvd.nist.gov/vuln/detail/CVE-2022-4415  
[ 2 ] CVE-2022-45873  
      https://nvd.nist.gov/vuln/detail/CVE-2022-45873

Availability  
============

This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202405-04

Concerns?  
=========

Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202405-04

Gentoo Linux Security Advisory 202405-3 - A vulnerability has been discovered in Dalli, which can lead to code injection. Versions greater than or equal to 3.2.3 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202405-03  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: Dalli: Code Injection  
     Date: May 04, 2024  
     Bugs: #882077  
       ID: 202405-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
========

A vulnerability has been discovered in Dalli, which can lead to code  
injection.

Background  
==========

Dalli is a high performance pure Ruby client for accessing memcached  
servers.

Affected packages  
=================

Package         Vulnerable    Unaffected  
--------------  ------------  ------------  
dev-ruby/dalli  < 3.2.3       >= 3.2.3

Description  
===========

A vulnerability was found in Dalli. Affected is the function  
self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb  
of the component Meta Protocol Handler. The manipulation leads to  
injection.

Impact  
======

Please review the referenced CVE identifiers for details.

Workaround  
==========

There is no known workaround at this time.

Resolution  
==========

All Dalli users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=dev-ruby/dalli-3.2.3"

References  
==========

[ 1 ] CVE-2022-4064  
      https://nvd.nist.gov/vuln/detail/CVE-2022-4064

Availability  
============

This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202405-03

Concerns?  
=========

Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202405-03

Red Hat Security Advisory 2024-2700-03 - An update for varnish is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Issues addressed include a denial of service vulnerability.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_2700.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: varnish security updateAdvisory ID:        RHSA-2024:2700-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:2700Issue date:         2024-05-06Revision:           03CVE Names:          CVE-2024-30156====================================================================Summary: An update for varnish is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.Security Fix(es):* varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-30156References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2271486

Tag

#web