Sign up to save your podcasts
Or
Share Episode 169
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 169
Overview
It’s the 22.10 mid-cycle roadmap sprint at Canonical this week plus we look
at security updates for Git, the Linux kernel, Vim, Python, PyJWT and more.
This week in Ubuntu Security Updates
58 unique CVEs addressed
[USN-5511-1] Git vulnerabilities [00:45]
a vuln in Git for Windows which could allow a local user who could write
to C:\ to create a gitconfig that would contain commands that may then
get executed by other users when running git themselves
Ubuntu on Windows which then would be vulnerable (or at least it was
until we fixed it 😁)
[USN-5473-2] ca-certificates update [01:41]
[USN-5513-1] Linux kernel (AWS) vulnerabilities [01:53]
networking protocol which then results in multiple possible UAFs - the
use of unprivileged user namespaces allows a local unprivileged user to
exploit this and then gain root priviliges in the root namespace - PoC on
github along with a very detailed write-up, hence the high priority
rating given to this vulnerability
allow a local user to possibly escalate privileges to root) - but the
others don’t have public exploits, hence the medium priority rating
[USN-5514-1] Linux kernel vulnerabilities [03:11]
different public clouds
attacker could possibly crash kernel or privesc - would likely need a
custom H/W device to do this though
[USN-5515-1] Linux kernel vulnerabilities [03:41]
HWE + clouds etc
[USN-5517-1] Linux kernel (OEM) vulnerabilities [04:04]
different OEM platforms which Ubuntu comes pre-installed on, these
eventually find they way back to the GA/HWE kernels
[USN-5518-1] Linux kernel vulnerabilities
[USN-5516-1] Vim vulnerabilities [04:18]
particularly in 16.04 ESM
shine a light on possible vulnerabilities (or does it just attract
shallow bug hunters…) - it’s hard to say for certain how much of a
security impact these different vulnerabilities have
the bounty platform ($95 reward apparently for each)
[USN-5520-1, USN-5520-2] HTTP-Daemon vulnerability [05:18]
production (since would then use nginx or apache)
then allow requests that would otherwise be rejected
[USN-5519-1] Python vulnerability [05:54]
this year but the bug was first reported back in 2015 - at that time
there was disagreement between the reporter and the upstream developers
as to whether this was a real vuln or not - this is a bug in handling of
mailcap entries - and mailcap is designed to execute arbitrary commands -
but those defined by the user - whereas in this case, if it was used to
launch a command on a crafted filename, the filename itself could specify
the command to be executed, not what the user had thought that they had
configured via their mailcap entry
[USN-5522-1] WebKitGTK vulnerabilities [07:19]
and we publish these as they are released
[USN-5523-1] LibTIFF vulnerabilities [08:02]
[USN-5524-1] HarfBuzz vulnerability [08:37]
with running HB with UBSan to detect memory corruption
[USN-5526-1] PyJWT vulnerability [08:58]
key pair as the key for one of the HMAC algorithms - as far as an API
user of PyJWT would see, the token would then validate the same as if it
had been actually signed by the private key of the same SSH public key
pair
[USN-5527-1] Checkmk vulnerabilities [09:43]
crash report
[USN-5525-1] Apache XML Security for Java vulnerability [09:56]
arbitrary local XML files
Goings on in Ubuntu Security Community
22.10 mid-cycle product roadmap sprint [10:13]
in-line with the Ubuntu release cycle - even though not all teams work on
Ubuntu
roadmap sprints, and 1 engineering sprint
review the progress / achievements etc of the previous 6 month
development cycle and set the goals for the coming development cycle.
later, there is the mid-cycle product roadmap sprint to review progress
etc along the way
each team presenting on their progress etc and reviews it with the other
teams, plus there many cross-team meetings etc
moved to being virtual - this year has seen the resumption of in-person
sprints for the start-of-roadmap sprints but the mid-cycle ones are still
virtual
like progress on FIPS certification for 22.04 LTS, as well as various
AppArmor enhancements, as well as customer specific work-items and
general progress on maintenence tasks like CVE patching, MIR security
reviews and more.
cycle went and to set the goals for 23.04 cycle - this will also be
followed by an engineering sprint, where all members of the engineering
sprint get together for a week in-person to collaborate and hack on
whatever their team needs
somewhat like the old Ubuntu Developer Summits) - a chance for folks from
the community to gather in person alongside folks from Canonical to
discuss and drive forwards various features for Ubuntu and the like.
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
It’s the 22.10 mid-cycle roadmap sprint at Canonical this week plus we look
at security updates for Git, the Linux kernel, Vim, Python, PyJWT and more.
This week in Ubuntu Security Updates
58 unique CVEs addressed
[USN-5511-1] Git vulnerabilities [00:45]
a vuln in Git for Windows which could allow a local user who could write
to C:\ to create a gitconfig that would contain commands that may then
get executed by other users when running git themselves
Ubuntu on Windows which then would be vulnerable (or at least it was
until we fixed it 😁)
[USN-5473-2] ca-certificates update [01:41]
[USN-5513-1] Linux kernel (AWS) vulnerabilities [01:53]
networking protocol which then results in multiple possible UAFs - the
use of unprivileged user namespaces allows a local unprivileged user to
exploit this and then gain root priviliges in the root namespace - PoC on
github along with a very detailed write-up, hence the high priority
rating given to this vulnerability
allow a local user to possibly escalate privileges to root) - but the
others don’t have public exploits, hence the medium priority rating
[USN-5514-1] Linux kernel vulnerabilities [03:11]
different public clouds
attacker could possibly crash kernel or privesc - would likely need a
custom H/W device to do this though
[USN-5515-1] Linux kernel vulnerabilities [03:41]
HWE + clouds etc
[USN-5517-1] Linux kernel (OEM) vulnerabilities [04:04]
different OEM platforms which Ubuntu comes pre-installed on, these
eventually find they way back to the GA/HWE kernels
[USN-5518-1] Linux kernel vulnerabilities
[USN-5516-1] Vim vulnerabilities [04:18]
particularly in 16.04 ESM
shine a light on possible vulnerabilities (or does it just attract
shallow bug hunters…) - it’s hard to say for certain how much of a
security impact these different vulnerabilities have
the bounty platform ($95 reward apparently for each)
[USN-5520-1, USN-5520-2] HTTP-Daemon vulnerability [05:18]
production (since would then use nginx or apache)
then allow requests that would otherwise be rejected
[USN-5519-1] Python vulnerability [05:54]
this year but the bug was first reported back in 2015 - at that time
there was disagreement between the reporter and the upstream developers
as to whether this was a real vuln or not - this is a bug in handling of
mailcap entries - and mailcap is designed to execute arbitrary commands -
but those defined by the user - whereas in this case, if it was used to
launch a command on a crafted filename, the filename itself could specify
the command to be executed, not what the user had thought that they had
configured via their mailcap entry
[USN-5522-1] WebKitGTK vulnerabilities [07:19]
and we publish these as they are released
[USN-5523-1] LibTIFF vulnerabilities [08:02]
[USN-5524-1] HarfBuzz vulnerability [08:37]
with running HB with UBSan to detect memory corruption
[USN-5526-1] PyJWT vulnerability [08:58]
key pair as the key for one of the HMAC algorithms - as far as an API
user of PyJWT would see, the token would then validate the same as if it
had been actually signed by the private key of the same SSH public key
pair
[USN-5527-1] Checkmk vulnerabilities [09:43]
crash report
[USN-5525-1] Apache XML Security for Java vulnerability [09:56]
arbitrary local XML files
Goings on in Ubuntu Security Community
22.10 mid-cycle product roadmap sprint [10:13]
in-line with the Ubuntu release cycle - even though not all teams work on
Ubuntu
roadmap sprints, and 1 engineering sprint
review the progress / achievements etc of the previous 6 month
development cycle and set the goals for the coming development cycle.
later, there is the mid-cycle product roadmap sprint to review progress
etc along the way
each team presenting on their progress etc and reviews it with the other
teams, plus there many cross-team meetings etc
moved to being virtual - this year has seen the resumption of in-person
sprints for the start-of-roadmap sprints but the mid-cycle ones are still
virtual
like progress on FIPS certification for 22.04 LTS, as well as various
AppArmor enhancements, as well as customer specific work-items and
general progress on maintenence tasks like CVE patching, MIR security
reviews and more.
cycle went and to set the goals for 23.04 cycle - this will also be
followed by an engineering sprint, where all members of the engineering
sprint get together for a week in-person to collaborate and hack on
whatever their team needs
somewhat like the old Ubuntu Developer Summits) - a chance for folks from
the community to gather in person alongside folks from Canonical to
discuss and drive forwards various features for Ubuntu and the like.
Get in contact