Ubuntu Security Podcast

Episode 60

Listen Later
Overview

Security updates for python-apt, GnuTLS, tcpdump, the Linux kernel and

more, plus we look at plans to integrate Ubuntu Security Notices within the
main ubuntu.com website.

This week in Ubuntu Security Updates

91 unique CVEs addressed

[USN-4247-1, USN-4247-2, USN-4247-3] python-apt vulnerabilities [00:42]
  • 2 CVEs addressed in Precise ESM, Trusty ESM, Xenial, Bionic, Disco, Eoan
    • CVE-2019-15796
    • CVE-2019-15795
    • Could still use md5 to validate downloads - md5 has been broken for a
      • while now so if md5 hashes were available for a repo then these would be
      trusted - instead, verify all hashes
    • Ensure repository is trusted before downloading from it - in some cases,
      • could configure repositories that were not trusted and python-apt based
      clients would not check trust - so would use it - now always check and
      verify unless the repository is specifically configured as trusted
      [USN-4248-1] GraphicsMagick vulnerabilities [02:31]
      • 10 CVEs addressed in Xenial
        • CVE-2017-17783
        • CVE-2017-17782
        • CVE-2017-17503
        • CVE-2017-17502
        • CVE-2017-17501
        • CVE-2017-17500
        • CVE-2017-17498
        • CVE-2017-16669
        • CVE-2017-16547
        • CVE-2017-16545
        • Episode 59, Episode 57, Episode 55 etc
          • [USN-4246-1] zlib vulnerabilities [02:55]
          • 4 CVEs addressed in Xenial
            • CVE-2016-9843
            • CVE-2016-9842
            • CVE-2016-9841
            • CVE-2016-9840
            • Trail of Bits security audit of zlib found various instances of undefined
              • behaviour in the implementation - pointer increment operations on
              undefined memory ranges, shifts by negative indices etc. Unlikely to have
              any real world impact.
              [USN-4249-1] e2fsprogs vulnerability [03:55]
              • 1 CVEs addressed in Precise ESM, Trusty ESM, Xenial, Bionic, Disco, Eoan
                • CVE-2019-5188
                • Stack buffer overflow when e2fsck’ing a specially crafted ext4
                  • file-system image
                  [USN-4233-2] GnuTLS update [04:34]
                  • Affecting Xenial, Bionic
                  • Episode 59 - disabled SHA1 for digital signatures in GnuTLS - this update
                    • adds VERIFY_ALLOW_BROKEN and VERIFY_ALLOW_SIGN_WITH_SHA1 priority strings
                    so can still use sha1 if really needed
                    [USN-4230-2] ClamAV vulnerability [05:16]
                    • 1 CVEs addressed in Precise ESM, Trusty ESM
                      • CVE-2019-15961
                      • Episode 59
                        • [USN-4250-1] MySQL vulnerabilities [05:34]
                        • 14 CVEs addressed in Xenial, Bionic, Eoan
                          • CVE-2020-2694
                          • CVE-2020-2686
                          • CVE-2020-2679
                          • CVE-2020-2660
                          • CVE-2020-2627
                          • CVE-2020-2589
                          • CVE-2020-2588
                          • CVE-2020-2584
                          • CVE-2020-2579
                          • CVE-2020-2577
                          • CVE-2020-2574
                          • CVE-2020-2573
                          • CVE-2020-2572
                          • CVE-2020-2570
                          • New upstream release (5.7.29 - xenial, bionic) (8.0.19 - eoan)
                            • [USN-4251-1] Tomcat vulnerabilities [06:02]
                            • 2 CVEs addressed in Xenial
                              • CVE-2019-17563
                              • CVE-2019-12418
                                • [USN-4252-1, USN-4252-2] tcpdump vulnerabilities [06:05]
                                • 28 CVEs addressed in Precise ESM, Trusty ESM, Xenial, Bionic
                                  • CVE-2019-15167
                                  • CVE-2019-15166
                                  • CVE-2019-1010220
                                  • CVE-2018-19519
                                  • CVE-2018-16452
                                  • CVE-2018-16451
                                  • CVE-2018-16300
                                  • CVE-2018-16230
                                  • CVE-2018-16229
                                  • CVE-2018-16228
                                  • CVE-2018-16227
                                  • CVE-2018-14882
                                  • CVE-2018-14881
                                  • CVE-2018-14880
                                  • CVE-2018-14879
                                  • CVE-2018-14470
                                  • CVE-2018-14469
                                  • CVE-2018-14468
                                  • CVE-2018-14467
                                  • CVE-2018-14466
                                  • CVE-2018-14465
                                  • CVE-2018-14464
                                  • CVE-2018-14463
                                  • CVE-2018-14462
                                  • CVE-2018-14461
                                  • CVE-2018-10105
                                  • CVE-2018-10103
                                  • CVE-2017-16808
                                  • Usual mix of buffer overflows and the like in various tcpdump
                                    • dissectors - in general you should not run tcpdump on untrusted data -
                                    when run as root, by default tcpdump will drop permissions to the tcpdump
                                    user after opening the capture device so this makes it somewhat safer
                                    [USN-4253-1, USN-4253-2] Linux kernel vulnerability [07:30]
                                    • 1 CVEs addressed in Bionic (HWE), Eoan (5.3 kernel)
                                      • CVE-2019-14615
                                      • Intel GPU would fail to clear state during context switch - could allow
                                        • an info leak between local users - so update driver to forcibly clear
                                        state
                                        [USN-4255-1, USN-4255-2] Linux kernel vulnerabilities [08:07]
                                        • 2 CVEs addressed in Xenial (HWE), Bionic (4.15 kernel)
                                          • CVE-2020-7053
                                          • CVE-2019-14615
                                          • Intel GPU state info leak
                                          • Intel GPU driver (i915) UAF - crash / code execution
                                            • [USN-4258-1] Linux kernel vulnerabilities [08:40]
                                            • 15 CVEs addressed in Bionic (AWS, GCP, GKE) (5.0 kernel)
                                              • CVE-2019-15291
                                              • CVE-2019-19767
                                              • CVE-2019-19332
                                              • CVE-2019-19252
                                              • CVE-2019-19227
                                              • CVE-2019-19082
                                              • CVE-2019-19079
                                              • CVE-2019-19078
                                              • CVE-2019-19077
                                              • CVE-2019-19071
                                              • CVE-2019-19062
                                              • CVE-2019-19050
                                              • CVE-2019-18885
                                              • CVE-2019-18683
                                              • CVE-2019-15099
                                              • OOB write in KVM hypervisor via /dev/kvm
                                              • Virtual console could allow writes via unimplemented unicode devices -
                                                • out of bounds memory access - crash etc
                                              • 2 separate memory leaks in crypto subsystem on certain failure paths -
                                                • local user accessible - DoS via memory exhaustion
                                              • NULL ptr deref in Atheros wireless USB driver
                                                • [USN-4254-1, USN-4254-2] Linux kernel vulnerabilities [09:54]
                                                • 9 CVEs addressed in Trusty ESM (HWE), Xenial (4.4 kernel)
                                                  • CVE-2019-15291
                                                  • CVE-2019-19332
                                                  • CVE-2019-19227
                                                  • CVE-2019-19063
                                                  • CVE-2019-19062
                                                  • CVE-2019-19057
                                                  • CVE-2019-18885
                                                  • CVE-2019-18683
                                                  • CVE-2019-14615
                                                  • OOB write in KVM hypervisor via /dev/kvm
                                                  • Crypto memory leak
                                                  • Intel GPU info leak
                                                    • [USN-4256-1] Cyrus SASL vulnerability [10:24]
                                                    • 1 CVEs addressed in Precise ESM, Trusty ESM, Xenial, Bionic, Eoan
                                                      • CVE-2019-19906
                                                      • OOB write due to off-by-one error - originally reported against OpenLDAP
                                                        • which uses cyrus-sasl and was able to be crashed by an unauthenticated
                                                        remote user due to this
                                                        [USN-4236-3] Libgcrypt vulnerability [10:57]
                                                        • 1 CVEs addressed in Precise ESM, Trusty ESM
                                                          • CVE-2019-13627
                                                          • Episode 59 - ECDSA side-channel timing attack
                                                            • [USN-4257-1] OpenJDK vulnerabilities [11:15]
                                                            • 8 CVEs addressed in Xenial, Bionic, Eoan
                                                              • CVE-2020-2659
                                                              • CVE-2020-2655
                                                              • CVE-2020-2654
                                                              • CVE-2020-2604
                                                              • CVE-2020-2601
                                                              • CVE-2020-2593
                                                              • CVE-2020-2590
                                                              • CVE-2020-2583
                                                              • Latest upstream release (11.0.6)
                                                                • Goings on in Ubuntu Security Community
                                                                Moving Ubuntu Security Notices to ubuntu.com/security [11:34]
                                                                • mpt put out a call for feedback on plans to move USNs from usn.ubuntu.com
                                                                  • to ubuntu.com/security/
                                                                • originally announced as a plan back in October
                                                                  • on the ubuntu-hardened mailing list
                                                                • posted a mock-up of the resulting page and called for feedback
                                                                • this is expected to land in the next few weeks
                                                                • https://discourse.ubuntu.com/t/security-notices-on-ubuntu-com/14159
                                                                  • Get in contact
                                                                  • [email protected]
                                                                  • #ubuntu-security on the Libera.Chat IRC network
                                                                  • ubuntu-hardened mailing list
                                                                  • Security section on discourse.ubuntu.com
                                                                  • @ubuntu_sec on twitter
                                                                    • ...more
                                                                    View all episodesView all episodes
                                                                    Download on the App Store
                                                                    Ubuntu Security PodcastBy Ubuntu Security Team
                                                                    • 4.8
                                                                    • 4.8
                                                                    • 4.8
                                                                    • 4.8
                                                                    • 4.8

                                                                    4.8

                                                                    10 ratings