---

Log

ASA-202101-42 created at 29 Jan 2021 16:26:22

ASA-202101-42 deleted at 29 Jan 2021 16:26:14
Workaround
Impact

ASA-202101-42 created at 29 Jan 2021 16:13:41

AVG-1505 edited at 29 Jan 2021 16:12:10
Severity	- High + Critical

CVE-2021-3345 edited at 29 Jan 2021 16:12:10
Severity	- High + Critical

AVG-1425 edited at 29 Jan 2021 16:04:44
Advisory qualified	- Yes + No

AVG-1505 edited at 29 Jan 2021 15:53:41
Severity	- Unknown + High

CVE-2021-3345 edited at 29 Jan 2021 15:53:41
Severity	- Unknown + High
Remote	- Unknown + Local
Type	- Unknown + Arbitrary code execution
Description	+ _gcry_md_block_write in cipher/hash-common.c in libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count value. Just decrypting some data can overflow a heap buffer with attacker controlled data, no verification or signature is validated before the vulnerability occurs. The issue is fixed in version 1.9.1.
References	+ https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000456.html + https://dev.gnupg.org/T5275 + https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=512c0c75276949f13b6373b5c04f7065af750b08
Notes

AVG-1505 created at 29 Jan 2021 15:49:59
Packages	+ libgcrypt
Issues	+ CVE-2021-3345
Status	+ Fixed
Severity	+ Unknown
Affected	+ 1.9.0-2
Fixed	+ 1.9.1-1
Ticket
Advisory qualified	+ Yes
References
Notes

CVE-2021-3345 created at 29 Jan 2021 15:49:59

CVE-2019-25016 edited at 29 Jan 2021 08:35:59

Description

- A security issue has been found in OpenDoas before 6.8.1, where rules that allowed the user to execute any command would inherit the executing users PATH instead of resetting it to a default PATH. Rules that limit the user to execute only a specific command are not affected by this and are only executed from the default PATH and with the PATH environment variable set to the safe default. + A security issue has been found in OpenDoas before 6.8.1, where rules that allowed the user to execute any command would inherit the executing user's PATH instead of resetting it to a default PATH. Rules that limit the user to execute only a specific command are not affected by this and are only executed from the default PATH and with the PATH environment variable set to the safe default.

AVG-1504 edited at 29 Jan 2021 08:23:29
Severity	- Unknown + High

CVE-2019-25016 edited at 29 Jan 2021 08:23:29
Severity	- Unknown + High
Remote	- Unknown + Local
Type	- Unknown + Privilege escalation
Description	+ A security issue has been found in OpenDoas before 6.8.1, where rules that allowed the user to execute any command would inherit the executing users PATH instead of resetting it to a default PATH. Rules that limit the user to execute only a specific command are not affected by this and are only executed from the default PATH and with the PATH environment variable set to the safe default.
References	+ https://github.com/Duncaen/OpenDoas/releases/tag/v6.8.1 + https://github.com/Duncaen/OpenDoas/issues/45 + https://github.com/Duncaen/OpenDoas/commit/d5acd52e2a15c36a8e06f9103d35622933aa422d.patch + https://gitlab.alpinelinux.org/alpine/aports/-/blob/9e259950190c924b4a17825aad2d7cee87fbd75b/main/doas/reset-path.patch
Notes

AVG-1504 created at 29 Jan 2021 08:20:14
Packages	+ opendoas
Issues	+ CVE-2019-25016
Status	+ Vulnerable
Severity	+ Unknown
Affected	+ 6.6.1-2
Fixed
Ticket
Advisory qualified	+ Yes
References	+ https://github.com/Duncaen/OpenDoas/releases/tag/v6.8.1
Notes

CVE-2019-25016 created at 29 Jan 2021 08:20:14