OverviewThe venerable Ubuntu 18.04 LTS release has transitioned into ESM, plus we lookat Till Kamppeter’s excellent guide on how to set up your GitHub projects toreceive private vulnerability reports, and we cover the week in security updatesincluding PostgreSQL, Jhead, the Linux kernel, Linux PTP, snapd and a whole lotmore.

This week in Ubuntu Security Updates56 unique CVEs addressed

[USN-6104-1] PostgreSQL vulnerabilities (00:55)* 2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04) + CVE-2023-2455 + CVE-2023-2454 * Two issues, both requiring to be an authenticated user. One in mishandling ofCREATE privileges - could then allow an auth user to execute arbitrary code asa the bootstrap supervisor - the other in row security properties which couldallow to bypass policies and get read/write contrary to security policy.

[USN-6105-1] ca-certificates update (01:32)* Affecting Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04) * Updates to the latest upstream 2.60 release from Mozilla, adds a bunch of newCAs plus removes some that had either expired or that were now not usedanymore

[USN-6106-1] calamares-settings-ubuntu vulnerability (02:08)* Affecting Jammy (22.04 LTS) * When installing Lubuntu, it would allow to create the first user with an emptypassword. Lubuntu uses it’s own installer called Calamares - so this issueonly affects Lubuntu, not regular Ubuntu or other Ubuntu flavors.

[USN-6100-1] HTML::StripScripts vulnerability (02:58)* 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2023-24038 * REDoS when parsing HTML with “certain style attributes”

[USN-6108-1] Jhead vulnerabilities (03:18)* 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2022-41751 + CVE-2021-34055 * [USN-6098-1] Jhead vulnerabilities in last week’s episode * Code-exec - place OS commands into a JPEG filename and then usingjhead to rotate the file * Buffer overflow when writing Exif data

[USN-6110-1] Jhead vulnerabilities* 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04) + CVE-2021-28277 + CVE-2021-28275 + CVE-2021-3496 * Stack buffer overflow, heap buffer overflow and OOB read - DoS / code exec

[USN-6113-1] Jhead vulnerability* 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM) + CVE-2018-6612 * Heap buffer OOB read -> DoS

[USN-6054-2] Django vulnerability (04:17)* 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM) + CVE-2023-31047 * [USN-6054-1] Django vulnerability in Episode 194

[USN-6109-1, USN-6118-1] Linux kernel (Raspberry Pi + Oracle) vulnerabilities (04:29)* 8 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) + CVE-2023-1118 + CVE-2023-32269 + CVE-2023-2162 + CVE-2023-1513 + CVE-2023-1078 + CVE-2023-1075 + CVE-2023-0459 + CVE-2022-3707 * 5.4 raspi + oracle on both 20.04 + 18.04 * Most issues covered on previous episodes

[USN-6122-1] Linux kernel (OEM) vulnerabilities (04:49)* 2 CVEs addressed in Jammy (22.04 LTS) + CVE-2023-2612 + CVE-2023-32233 * 6.1 OEM 22.04 LTS * Race condition in netfilter able to be triggered by a local user -> UAF + requires CAP_NET_ADMIN but can get this in an unprivileged user namespace ∴can be triggered OOTB by an unpriv user on Ubuntu + PoC was published for this last week - caused a bunch of folks to getanxious but since can be mitigated by disabling unprivileged user namespacesperhaps it was not worth all the hype? Also kernel updates take a while toprepare and test etc so it is not easy to just drop everything and crank anew kernel - so in general this would only occur for remotely exploitableissues

[USN-6123-1] Linux kernel (OEM) vulnerabilities (06:48)* 5 CVEs addressed in Jammy (22.04 LTS) + CVE-2023-26606 + CVE-2023-2612 + CVE-2023-1670 + CVE-2023-30456 + CVE-2023-32233 * 6.0 OEM * Netfilter issue above, plus mishandling of control registers in nested KVMVMs - could allow an guest VM to crash the VM host

[USN-6124-1] Linux kernel (OEM) vulnerabilities (07:10)* 6 CVEs addressed in Jammy (22.04 LTS) + CVE-2023-2612 + CVE-2023-1670 + CVE-2022-4139 + CVE-2022-3586 + CVE-2023-30456 + CVE-2023-32233 * 5.17 OEM * Mostly same issues as above

[USN-6097-1] Linux PTP vulnerability (07:20)* 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS) + CVE-2021-3570 * Precision time protocol implementation - allows to synchronise time betweenservers to sub-microsecond accuracy - more accurate than NTP - uses aleader/follower architecture - leader would be synchronised with high accuracyvia say a GPS then distributes this to other machines via PTP * Failed to check length of received packet properly (but only for forwardedpackets) - results in a OOB R/W - so could either be an info leak or possibleRCE

[USN-6005-2] Sudo vulnerabilities (08:49)* 2 CVEs addressed in Xenial ESM (16.04 ESM) + CVE-2023-28487 + CVE-2023-28486 * [USN-6005-1] Sudo vulnerabilities in Episode 193

[USN-6111-1] Flask vulnerability (09:02)* 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04) + CVE-2023-30861 * Possibly sends a response intended for one client to a different client due tomishandling of the Vary:Cookie header - requires the use of a caching proxyand other conditions though so may not be a widespread issue

[USN-6112-1] Perl vulnerability (09:35)* 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS) + CVE-2023-31484 * Failed to properly validate TLS certs when using CPAN with <:Tiny> todownload modules over HTTPS - failed to set ssl_Verify - parameter to<:Tiny> * Seems the upstream HTTP::Tiny dev’s thinks it would be discriminatory toenable SSL verification by default as that would make applications etc thatuse self-signed certs or community-driven CAs like CAcert.org fail - but thisseems pretty outdated since with Let’s Encrypt etc nowadays there is easyaccess to trusted certs for anyone - and so this just does a disservice to allapplications that use <:Tiny> making them potentially insecureout-of-the-box * Won’t be surprised to see other similar vulns in the future as a result ofthis foot-gun

[USN-6114-1] nth-check vulnerability (11:32)* 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) + CVE-2021-3803 * Node.js module for parsing and compiling CSS nth-checks (used in CSS 3nth-child() and nth-last-of-type() functions) - can pass it a string and itwill compile that to an optimised function for calling by other code * REDoS

[USN-6116-1] hawk vulnerability (12:11)* 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2022-29167 * Node.js HTTP Holder-of-key authentication scheme - a HTTP authenticationscheme that is similar to the regular HTTP Digest scheme - developed by Mozilla * REDoS

[USN-6115-1] TeX Live vulnerability (12:47)* 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04) + CVE-2023-32700 * Shell command execution in luatex if run against an untrusted document sincecould access the io stream used by the underlying lua engine and injectcontents into it which would then be executed

[USN-6119-1] OpenSSL vulnerabilities (13:20)* 2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04) + CVE-2023-1255 + CVE-2023-2650 * CPU-based DoS when processing crafted ASN.1 object identifiers - requires tohave an object ID which itself is tens to hundreds of KBs - OpenSSL 3 has alimit of 100KB on the peer cert chain which limits the ability to craft suchlong IDs and have them be processed by OpenSSL * An aarch64 specific issue - AES-XTS decryption algorithm would possibly readpast the end of the input buffer -> OOB read -> possible DoS but only if theciphertext is a certain size relative to the block size

[USN-6120-1] SpiderMonkey vulnerabilities (14:25)* 9 CVEs addressed in Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04) + CVE-2023-32215 + CVE-2023-32211 + CVE-2023-29550 + CVE-2023-29548 + CVE-2023-29536 + CVE-2023-29535 + CVE-2023-25751 + CVE-2023-25739 + CVE-2023-25735 * mozjs 102.11 release - JS engine shipped in Firefox so has a lot of overlapwith CVEs in firefox etc. * thanks to the Jeremy Bicha on the Ubuntu Desktop team for preparing theseupdates

[USN-6121-1] Nanopb vulnerabilities (14:45)* 2 CVEs addressed in Focal (20.04 LTS) + CVE-2021-21401 + CVE-2020-26243 * Implementation of Protocol Buffers but with small code size - designed for embedded systems etc * Memory leak on parsing of crafted messages plus an invalid free() or realloc()on crafted messages - both only really an issue if parsing untrusted content

[USN-6117-1] Apache Batik vulnerabilities (15:16)* 7 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2022-42890 + CVE-2022-41704 + CVE-2022-40146 + CVE-2022-38648 + CVE-2022-38398 + CVE-2020-11987 + CVE-2019-17566 * Java SVG library * 4 different XSRF issues * 1 SSRF issue on handling of URLs in Jar’s - could allow to access local fileson the server * 2 different issues that could allow untrusted Java code embedded in an SVG tobe executed

[USN-6125-1] snapd vulnerability (15:48)* 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04) + CVE-2023-1523 * Very similar to a recent issue (CVE-2023-28100) in flatpak - seccomp sandbox failed to blockthe TIOCLINUX ioctl() request - could allow a snap to inject contents into thecontrolling terminal when run on a virtual console - this would then beexecuted when the snap finished running -> code exec outside the snap sandbox * Now simply blocks TIOCLINUX as it already did for TIOCSTI in the past * Very similar to historic TIOCSTI CVEs such as CVE-2016-9016 in firejail,CVE-2016-10124 in lxc, CVE-2017-5226 in bubblewrap, CVE-2019-10063 in flatpak

[USN-6126-1] libvirt vulnerabilities (17:44)* 2 CVEs addressed in Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04) + CVE-2023-2700 + CVE-2022-0897 * race condition within the nwfilter driver - allows a local unprivileged userto race against the driver and corrupt the list of network filters and triggera crash in the libvirt daemon * memory leak when reading SR-IOV PCI device capabilities

Goings on in Ubuntu Security CommunityUbuntu 18.04 has now entered ESM (18:21)* https://www.omgubuntu.co.uk/2023/05/ubuntu-18-04-general-support-ends-enable-esm-to-stay-protected

OpenPrinting tutorial on handling security bugs via GitHub (19:40)* https://openprinting.github.io/OpenPrinting-News-May-2023/#handling-reported-security-bugs-with-github * Last week we talked about a vulnerability in the cups-filter package * Discusses the difficulty in handling security issues in open source projects,where all the development is usually done in the open, how do you privatelyreport and collaborate on a security issue? * GitHub offers the ability to report security vulnerabilities privately * Not enabled by default since it requires some configuration on the part of themaintainer to configure the templates etc that get sent out - also needs theorganisation that owns the repo to enable this as well + GitHub offer some great guidance on the best ways to do this * Usual workflow is to submit a report privately and then can create a temporaryprivate fork in which to develop the fix * Read Till’s blog post as that contains a great walk-through on how to enablethis

Get in contact* security@ubuntu.com * #ubuntu-security on the Libera.Chat IRC network * ubuntu-hardened mailing list * Security section on discourse.ubuntu.com * @ubuntusecurity@fosstodon.org, @ubuntu_sec on twitter