Sign up to save your podcasts
Or
Share Episode 99
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 99
Overview
This week we look at security updates for Mutt, Thunderbird, Poppler, QEMU,
containerd, Linux kernel & more, plus we discuss the 2020 State of the
Octoverse Security Report from Github, Launchpad GPG keyserver migration, a
new AppArmor release & some open positions on the team.
This week in Ubuntu Security Updates
68 unique CVEs addressed
[USN-4645-1] Mutt vulnerability [00:59]
was invalid, would fail to properly terminate the connection and could
continue trying to authenticate and hence send credentials in the clear.
[USN-4646-1] poppler vulnerabilities [01:44]
[USN-4646-2] poppler regression
fix for future
[USN-4647-1] Thunderbird vulnerabilities [02:25]
information across origins, bypass security restrictions, conduct
phishing attacks, conduct cross-site scripting (XSS) attacks, bypass
Content Security Policy (CSP) restrictions, conduct DNS rebinding
attacks, or execute arbitrary code.
[USN-4648-1] WebKitGTK vulnerabilities [03:21]
vulns - including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.
[USN-4649-1] xdg-utils vulnerability [03:54]
particularly relevant to TB - so if a user is not paying attention, could
attach say a sensitive local file to the outgoing email
[USN-4382-2] FreeRDP vulnerabilities [05:09]
[USN-4650-1] QEMU vulnerabilities [05:29]
emulation but mitigated when using libvirt by AppArmor profile
[USN-4651-1] MySQL vulnerabilities [06:14]
20.04 had the new MySQLX plugin enabled and listenting on all network
interfaces by default -> violates no open ports principle - this update
insteads changes the configuration to bind it to localhost only - if you
were using it you may now need to change your local configuration to
purposefully change this so it is remotely accessible
[USN-4653-1] containerd vulnerability [07:27]
containers (in same network namespace) - would validate the effective UID
of a connecting process as 0 but did not apply other access controls - so
a malicious container in same network namespace with effective UID 0 but
otherwise reduced privileges could spawn new processes via
containerd-shim with full root privileges
[USN-4652-1] SniffIt vulnerability
[USN-4654-1] PEAR vulnerabilities
[USN-4655-1] Werkzeug vulnerabilities
[USN-4656-1] X.Org X Server vulnerabilities
[USN-4657-1] Linux kernel vulnerabilities [09:11]
via L1 cache -> spectre-like attack could allow this to be read - fix is
similar to spectre etc - flush L1 cache when transitioning between
privilege boundaries
working with the kernel team to provide backports etc
[USN-4658-1] Linux kernel vulnerabilities
[USN-4659-1] Linux kernel vulnerabilities
Goings on in Ubuntu Security Community
GitHub state of open source security report 2020 [10:43]
PyPI and RubyGems
packages have a median of nearly 700 transitive dependencies - cf Python
with 19
(almost all in npm packages) - but most are just mistakes
fixes though then come quick in ~4.4 weeks and then 10 weeks to alert
users of the fix
today as 4 years ago - so we are not getting more secure over time
Migrating Launchpad PGP keyservers from SKS to Hockeypuck [15:03]
AppArmor 3.0.1 Released [16:27]
Hiring [16:52]
AppArmor Security Engineer
Engineering Director - Ubuntu Security
Engineering Manager - Ubuntu Security
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
This week we look at security updates for Mutt, Thunderbird, Poppler, QEMU,
containerd, Linux kernel & more, plus we discuss the 2020 State of the
Octoverse Security Report from Github, Launchpad GPG keyserver migration, a
new AppArmor release & some open positions on the team.
This week in Ubuntu Security Updates
68 unique CVEs addressed
[USN-4645-1] Mutt vulnerability [00:59]
was invalid, would fail to properly terminate the connection and could
continue trying to authenticate and hence send credentials in the clear.
[USN-4646-1] poppler vulnerabilities [01:44]
[USN-4646-2] poppler regression
fix for future
[USN-4647-1] Thunderbird vulnerabilities [02:25]
information across origins, bypass security restrictions, conduct
phishing attacks, conduct cross-site scripting (XSS) attacks, bypass
Content Security Policy (CSP) restrictions, conduct DNS rebinding
attacks, or execute arbitrary code.
[USN-4648-1] WebKitGTK vulnerabilities [03:21]
vulns - including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.
[USN-4649-1] xdg-utils vulnerability [03:54]
particularly relevant to TB - so if a user is not paying attention, could
attach say a sensitive local file to the outgoing email
[USN-4382-2] FreeRDP vulnerabilities [05:09]
[USN-4650-1] QEMU vulnerabilities [05:29]
emulation but mitigated when using libvirt by AppArmor profile
[USN-4651-1] MySQL vulnerabilities [06:14]
20.04 had the new MySQLX plugin enabled and listenting on all network
interfaces by default -> violates no open ports principle - this update
insteads changes the configuration to bind it to localhost only - if you
were using it you may now need to change your local configuration to
purposefully change this so it is remotely accessible
[USN-4653-1] containerd vulnerability [07:27]
containers (in same network namespace) - would validate the effective UID
of a connecting process as 0 but did not apply other access controls - so
a malicious container in same network namespace with effective UID 0 but
otherwise reduced privileges could spawn new processes via
containerd-shim with full root privileges
[USN-4652-1] SniffIt vulnerability
[USN-4654-1] PEAR vulnerabilities
[USN-4655-1] Werkzeug vulnerabilities
[USN-4656-1] X.Org X Server vulnerabilities
[USN-4657-1] Linux kernel vulnerabilities [09:11]
via L1 cache -> spectre-like attack could allow this to be read - fix is
similar to spectre etc - flush L1 cache when transitioning between
privilege boundaries
working with the kernel team to provide backports etc
[USN-4658-1] Linux kernel vulnerabilities
[USN-4659-1] Linux kernel vulnerabilities
Goings on in Ubuntu Security Community
GitHub state of open source security report 2020 [10:43]
PyPI and RubyGems
packages have a median of nearly 700 transitive dependencies - cf Python
with 19
(almost all in npm packages) - but most are just mistakes
fixes though then come quick in ~4.4 weeks and then 10 weeks to alert
users of the fix
today as 4 years ago - so we are not getting more secure over time
Migrating Launchpad PGP keyservers from SKS to Hockeypuck [15:03]
AppArmor 3.0.1 Released [16:27]
Hiring [16:52]
AppArmor Security Engineer
Engineering Director - Ubuntu Security
Engineering Manager - Ubuntu Security
Get in contact