Debian Linux Security Advisory 5530-1 - Several vulnerabilities were discovered in ruby-rack, a modular Ruby webserver interface, which may result in denial of service and shell escape sequence injection.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5530-1                   security@debian.orghttps://www.debian.org/security/                     Salvatore BonaccorsoOctober 22, 2023                      https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : ruby-rackCVE ID         : CVE-2022-30122 CVE-2022-30123 CVE-2022-44570 CVE-2022-44571                 CVE-2022-44572 CVE-2023-27530 CVE-2023-27539Debian Bug     : 1029832 1032803 1033264Several vulnerabilities were discovered in ruby-rack, a modular Rubywebserver interface, which may result in denial of service and shellescape sequence injection.For the oldstable distribution (bullseye), these problems have been fixedin version 2.1.4-3+deb11u1.We recommend that you upgrade your ruby-rack packages.For the detailed security status of ruby-rack please refer to itssecurity tracker page at:https://security-tracker.debian.org/tracker/ruby-rackFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmU1FpxfFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xNDz0SAig/+MS3miFMErKy2l1DjwlzjchJC0cyfMHdVn1mpWZMd3iRVuKqqhRt/GlLSXYFRaU6loJ69WqZGLdnDJtKiOUkJPip5BIL2EZccYdg7nDkvvXs6ATffnC11B/SnJ0N7YAYubtyE/924H+mLh+rpx5sMkmGWHKGssQzP1e2erpBl3FRIQcWm/E1PkvZY3VmRbSluAxb3nQ6+bm+5RDNZOzPtkFQkEuGFV4BNFYqh0JWO2lKLkdG6r8+SaeBGKq5i+WtuHxYEVLB1Go6mvyymh8vDq6Mfimfas9B9SYDKjdiU3VOLoiaXEkjepdQFzSm1QVyk9aYJ6Qb5yy8hrr8XPfVuqlumF+ACpsAK1wH+WtKdiQkdZsvFpcYKn5g4q3zMa8RSoDAEnnc9AmGGdDOT/5sdosby1XAlrO7EoVGuhzKR7i1CtAdmnvABwf1dVqv3Jrn6pg+1c278vFc/n/fyXaHiPolRhr4xSxaNiT0OQ/f+ZUJg5NAT8WIS355kefSzAWVpOYB4kMM3OcWWwohkYWf6WuUoZZsIKvdE8dnAhV6NYaChrS6wA3fiLoQu0U9m+4jdB0IDLy+uffIzYCfeFepyq/Gg8e6TIx/T8Rf1uX8VFAvqiBXc3oIlGQMfaulmQel8mGBXceLIMU+Ze0kRmMf3j5JLWotnKRFNDHAW11U2OWU==tPF2-----END PGP SIGNATURE-----

Debian Security Advisory 5530-1

The threat actor known as DoNot Team has been linked to the use of a novel .NET-based backdoor called Firebird targeting a handful of victims in Pakistan and Afghanistan.
Cybersecurity company Kaspersky, which disclosed the findings in its APT trends report Q3 2023, said the attack chains are also configured to deliver a downloader named CSVtyrei, so named for its resemblance to Vtyrei.
"Some

Cyber Espionage / Malware

The threat actor known as DoNot Team has been linked to the use of a novel .NET-based backdoor called **Firebird** targeting a handful of victims in Pakistan and Afghanistan.

Cybersecurity company Kaspersky, which disclosed the findings in its APT trends report Q3 2023, said the attack chains are also configured to deliver a downloader named CSVtyrei, so named for its resemblance to Vtyrei.

"Some code within the examples appeared non-functional, hinting at ongoing development efforts," the Russian firm said.

Vtyrei (aka BREEZESUGAR) refers to a first-stage payload and downloader strain previously harnessed by the adversary to deliver a malware framework known as **RTY**.

DoNot Team, also known by the names APT-C-35, Origami Elephant, and SECTOR02, is suspected to be of Indian origin, with its attacks employing spear-phishing emails and rogue Android apps to propagate malware.

The latest assessment from Kaspersky builds on an analysis of the threat actor's twin attack sequences in April 2023 to deploy the Agent K11 and RTY frameworks.

The disclosure also follows Zscaler ThreatLabz's uncovering of new malicious activity carried out by the Pakistan-based Transparent Tribe (aka APT36) actor targeting Indian government sectors using an updated malware arsenal that comprises a previously undocumented Windows trojan dubbed ElizaRAT.

"ElizaRAT is delivered as a .NET binary and establishes a C2 communication channel via Telegram, enabling threat actors to exert complete control over the targeted endpoint," security researcher Sudeep Singh noted last month.

Active since 2013, Transparent Tribe has utilized credential harvesting and malware distribution attacks, often distributing trojanized installers of Indian government applications like Kavach multi-factor authentication and weaponizing open-source command-and-control (C2) frameworks such as Mythic.

In a sign that the hacking crew has also set its eyes on Linux systems, Zscaler said it identified a small set of desktop entry files that pave the way for the execution of Python-based ELF binaries, including GLOBSHELL for file exfiltration and PYSHELLFOX for stealing session data from the Mozilla Firefox browser.

"Linux-based operating systems are widely used in the Indian government sector," Singh said, adding the targeting of the Linux environment is also likely motivated by India's decision to replace Microsoft Windows OS with Maya OS, a Debian Linux-based operating system, across government and defense sectors.

Joining DoNot Team and Transparent Tribe is another nation-state actor from the Asia-Pacific region with a focus on Pakistan.

Codenamed Mysterious Elephant (aka APT-K-47), the hacking group has been attributed to a spear-phishing campaign that drops a novel backdoor called ORPCBackdoor that's capable of executing files and commands on the victim's computer, and receive files or commands from a malicious server.

According to the Knownsec 404 Team, APT-K-47 shares tooling and targeting overlaps with that of other actors such as SideWinder, Patchwork, Confucius, and Bitter, most of which are assessed to be aligned with India.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

DoNot Team's New Firebird Backdoor Hits Pakistan and Afghanistan

Debian Linux Security Advisory 5527-2 - The webkit2gtk update released as 5527-1 introduced a regression that is causing programs such as yelp, liferea or gnucash to stop working in certain cases.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA256- -------------------------------------------------------------------------Debian Security Advisory DSA-5527-2                   security@debian.orghttps://www.debian.org/security/                           Alberto GarciaOctober 20, 2023                      https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : webkit2gtkDebian Bug     : 1054101The webkit2gtk update released as 5527-1 introduced a regression thatis causing programs such as yelp, liferea or gnucash to stop workingin certain cases.For the oldstable distribution (bullseye), this problem has been fixedin version 2.42.1-1~deb11u2.We recommend that you upgrade your webkit2gtk packages.For the detailed security status of webkit2gtk please refer toits security tracker page at:https://security-tracker.debian.org/tracker/webkit2gtkFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCAAdFiEEYrwugQBKzlHMYFizAAyEYu0C2AIFAmUyH/UACgkQAAyEYu0C2AIhCg/7BId/Qgv5kasQ8yZE0iPYI7cBsXq6dYAkwCzdLcE3JI7zKej9QtPrXOAp8dPdu5hMGrC/jOS0P+iVcFNCUeIr6VMAFXjHtmF4ZsjdyWBfhtNsU+IoSgGpFpGys3qlBiAjGnLAzfYs1qeMxwmf6+NLyh0x3Z3T2sRijchsJ8+mxIWH24XV4qmy86TyJ3Ce4KuDSV/W9+ATgEjar0HQXxTRVGAsFbReMzo4LPjVKC9Ml6cBXIXJ63N/5WLXSwgqtyeQoFytrS387rQngktg+5mjT9Ergi5O4BCNpSeZ4oXEmvrhS37R+urCx3Kb0ZrqLrQjp9dE1H1s308UQTtgxEqzZaq0Q6w8mHdJnkm7kW1Q9DBIGYs+sNTj/jsyBt3yw4KJsmoKLH7lToKCMlVxaPbLv6k/da1UnQDn/D+hyVeUs7WxCxQDWZcu+isaZABNt/GJ3i9AWtYDqCIRoXKSNOemX6gywhCFN83FERmZpzGekyCFM6t9GNU13QXzsz95xcCwncKAJvHVmu1t82MXjtojkPK148OWdueH5upsLl746JHI+K+oKjJ1XuhmaxGwiP4e65k5TBfcqdz8MVoE4oDlPi8tzr5FCo8TZ40WuN1vF11UqTBE6mRz43Kgc/DTAGBnl2u13WesvYW2WYBilcgUE11V7XFbU7pGw67Htruoi3E=/OcM-----END PGP SIGNATURE-----

Debian Security Advisory 5527-2

Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal.

CVE-2022-47583: "[31m"?! ANSI Terminal security in 2023 and finding 10 CVEs

Debian Linux Security Advisory 5522-3 - A regression was discovered in the Http2UpgradeHandler class of Tomcat 9 introduced by the patch to fix CVE-2023-44487 (Rapid Reset Attack). A wrong value for the overheadcount variable forced HTTP2 connections to close early.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5522-3                   security@debian.org  
https://www.debian.org/security/                          Markus Koschany  
October 16, 2023                      https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : tomcat9  
CVE ID         : CVE-2023-44487

A regression was discovered in the Http2UpgradeHandler class of Tomcat 9  
introduced by the patch to fix CVE-2023-44487 (Rapid Reset Attack). A wrong  
value for the overheadcount variable forced HTTP2 connections to close early.

For the oldstable distribution (bullseye), this problem has been fixed  
in version 9.0.43-2~deb11u9.

We recommend that you upgrade your tomcat9 packages.

For the detailed security status of tomcat9 please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/tomcat9

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmUtrGRfFIAAAAAALgAo  
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD  
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7  
UeRklBAAg7AmsDgaOQ6E4PR41JewkEIlV/n/jfqEkhHXRxG9zG4yijcszgTcF3Ii  
rf3lBgytAMlSD7dRyy9HG6tRpgMTaajEgeAZdeL01mQf0JnJMg3WPZbkDV9kgyzy  
TMhKjMwaSi65nuBETud5OTZIVsnpaonWsQsTxjaIrbdGnQFJrr13cRVKrY8aT5Ur  
AxtxTFL8FGQxU+RgTehV5KMbtCY9kZhemwyQ6LRk1UstWhype8/ydK7UCaQEJ777  
zyl7ioGvv15GmZMMJCZ1zH0Z6FXlhbVDLCcVshJN3/ddlVTC9Xx10lCEx/hZY29x  
b6Stq/YMayZMoKQY2V3JeQbM3OMCPalpcPU+/WbhuX9eZuWHapnlyTwgsjQOVLNc  
prPfuUAAGCmNFuPMqN//EtmSQV5SP+dqJrwcGMxWDmuagB4qD9nbwtr1zNb5QJpK  
rK24yHlY3Pmu1yegPIeZIJxuFMc5N5cIDj7BfKY51nnV5kbHRshSacBmbm4Sxvfv  
lqEPeqZKogGIAXvmPSeC1gCoL0l98rKVOq3bc8+9z2TgB7W/vB60/IyM1pR8svPu  
+ShPWFh+tkWvt4PjgZ+qThM+xGkcMX12lhRDmFhs4rE8IQIDChiZWBMReggtw6Ii  
ETuYDmr5EAd5u5ymMyQmououeNKwRDi4AbGRPV7JddIVkcbUxgk=  
=ENCN  
-----END PGP SIGNATURE-----

Debian Security Advisory 5522-3

Debian Linux Security Advisory 5528-1 - William Khem-Marquez discovered that using malicious plugins for the the Babel JavaScript compiler could result in arbitrary code execution during compilation.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5528-1                   security@debian.org  
https://www.debian.org/security/                       Moritz Muehlenhoff  
October 16, 2023                      https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : node-babel7  
CVE ID         : CVE-2023-45133  
Debian Bug     : 1053880

William Khem-Marquez discovered that using malicious plugins for the  
the Babel JavaScript compiler could result in arbitrary code execution  
during compilation

For the oldstable distribution (bullseye), this problem has been fixed  
in version 7.12.12+~cs150.141.84-6+deb11u1.

For the stable distribution (bookworm), this problem has been fixed in  
version 7.20.15+ds1+~cs214.269.168-3+deb12u1.

We recommend that you upgrade your node-babel7 packages.

For the detailed security status of node-babel7 please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/node-babel7

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmUtbwUACgkQEMKTtsN8  
TjYapA//Vuqb5K/bR0A/QrHahZ4kkNNHN/5ooZA+AWdb0wh2yMhEnRsBRn4dCR6y  
ZloOzHKq2GUFSFyQzOs3IdNKAiT4wfXsAHe1pOO/pH+cbJvKREHYKU3gq7oKlvih  
MZnAtXi4CsF2W+qnIUyOsF4q2JbcE5KYdK6zej7R+nu2IlSfddMoSbz/ogkmw64S  
doMM9KeAWNl53UM0pmOH38n7k3n3W4WI3xJq87tzB0l2QJEghNWB2UuqdnsSCxiU  
UBhrSAzIPGsvrq317e3sVmDtJcJKmTbKg38qwsojDF2fUyIWtn4VCJwsYG+yuGA4  
xousmIcKBheDoDmPBSU0uTxm4YxCtlVjAX664wKuCVrMWtCkII5xG4QQ+klpDjP+  
12zMiJY5+CrE+29Jfk4zYnIuu4wdp8pa0QVR4DStaxj9AHAZtlFBkz2BIbK6917G  
127QpuG+NaVHMWBkDDr5+DZOpzN4jIuRW+fM6oOtFzAWkzy5Hd7KdMVsUJGA4GFs  
ywfkRTnJC7DSsH+gVCzso/5hXn7q4LM5628A05X4+KAzQoc+wJT6p9o/VBGs7OcB  
/9nQF/AYSd2ISxF03ruZ+arHA/A8RWq0mxKY8jTGdJON2omKw5lmoZdQ2RYplVfH  
TZilImDfbdzCRRJwCnS9qqYb8p1ydM0WB4Jz21ZEI3jmEe/OyIE=  
=c0aQ  
-----END PGP SIGNATURE-----

Debian Security Advisory 5528-1

Debian Linux Security Advisory 5522-2 - The patch to address CVE-2023-44487 (Rapid Reset Attack) was incomplete and caused a regression when using asynchronous I/O (the default for NIO and NIO2). DATA frames must be included when calculating the HTTP/2 overhead count to ensure that connections are not prematurely terminated.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5522-2                   security@debian.org  
https://www.debian.org/security/                          Markus Koschany  
October 12, 2023                      https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : tomcat9  
CVE ID         : CVE-2023-44487  
Debian Bug     : 1053820

The patch to address CVE-2023-44487 (Rapid Reset Attack) was incomplete and  
caused a regression when using asynchronous I/O (the default for NIO and NIO2).  
DATA frames must be included when calculating the HTTP/2 overhead count to  
ensure that connections are not prematurely terminated.

For the oldstable distribution (bullseye), this problem has been fixed  
in version 9.0.43-2~deb11u8.

We recommend that you upgrade your tomcat9 packages.

For the detailed security status of tomcat9 please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/tomcat9

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmUoVnpfFIAAAAAALgAo  
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD  
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7  
UeTdbw/+O6hd6miJKAJtK7QqgsstFL9TdqVLv8cLsOli5tobVkH+G00iXk6umG7E  
dzE7xekBXhR3rT/3rFw9AdJAl4wdiy7JySZGVfWWP+vLpBfnXX4tmIy8hCaoFc2d  
/IarTTfW9TZ+R166cB16m9UGPNP9beYqvx+kuuQlF4CRV/WWLGcpnZ/hiWb656BW  
BBsCh5Ig0BkBOundI44ofcWR2S/+4VQw0tNMEChqOJBkgNSVSD/IO/ia0n4Zy2so  
NvWVi7FMAE8xNz1afsjwY9opJXCAHZSKJjzVU9qRPNmwsdJMExP26E73cmSObSZo  
cUV95wFA6SFKoo5fWn5WSeC4BVGlXr0jrgE0kQy7NzPBM2KLmsB0l917ejdquHIy  
CFoNSmdX+mFJgmvBgtnvR1tFa2VgLZFMROYFSCf39XzBF0XmfiqVc5ejEy6yZRtg  
T9a8tA6yux8kzwC7aw+ZFfBfhmRcDt9m3hDlJO39ex7NP8Df9Wk++Jh2bIjj96LQ  
FH12q5zr4Dnyk2pG29MJbAgyCtYJrYubJR3XY97UhSva6uBOa92GYLjXjJVfcBQA  
UZ7vL2vIlwXF+7b/Xihb9mRAepPCKkHwROUGiFvVXnXNiNYUg84BZ1GhBTFo4M/G  
hoyYeUc8HrreGPsGY5dLoTwOqH6hUVnYbcLjwNV885FnH6Ccz78=tl0s  
-----END PGP SIGNATURE-----

Debian Security Advisory 5522-2

Debian Linux Security Advisory 5527-1 - Marcin Noga discovered that a specially crafted web page can abuse a vulnerability in the MediaRecorder API to cause memory corruption and potentially arbitrary code execution. Junsung Lee and Me Li discovered that processing web content may lead to arbitrary code execution. Bill Marczak and Maddie Stone discovered that processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5527-1                   security@debian.org  
https://www.debian.org/security/                           Alberto Garcia  
October 12, 2023                      https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : webkit2gtk  
CVE ID         : CVE-2023-39928 CVE-2023-41074 CVE-2023-41993

The following vulnerabilities have been discovered in the WebKitGTK  
web engine:

CVE-2023-39928

    Marcin Noga discovered that a specially crafted web page can abuse  
    a vulnerability in the MediaRecorder API to cause memory  
    corruption and potentially arbitrary code execution.

CVE-2023-41074

    Junsung Lee and Me Li discovered that processing web content may  
    lead to arbitrary code execution.

CVE-2023-41993

    Bill Marczak and Maddie Stone discovered that processing web  
    content may lead to arbitrary code execution. Apple is aware of a  
    report that this issue may have been actively exploited.

For the oldstable distribution (bullseye), these problems have been fixed  
in version 2.42.1-1~deb11u1.

For the stable distribution (bookworm), these problems have been fixed in  
version 2.42.1-1~deb12u1.

We recommend that you upgrade your webkit2gtk packages.

For the detailed security status of webkit2gtk please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/webkit2gtk

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEYrwugQBKzlHMYFizAAyEYu0C2AIFAmUoSJAACgkQAAyEYu0C  
2AI3Xg//YRhE5mSszGaNvp7i/2KXs4xBSP4k8mJ+EG2SDOKxIeiu2HU5PhGmhrSp  
PmJE3xFU5R2mov03nwu0yPKve6iijgYdh1evPBgSdexLJjJciasu5GtIl+MAmrq1  
r7qVro8GabC4Ul4ALRp7k3qxFR2+wPD1jfFlKHavxpc8gSmfBLlLoOwfsNhmXXz5  
eI87n7tbp35/nDv1m/VU/BkQh1LWqGQlO7sU25I/y2Vz/5SMyYuwjquSIVOkxVYm  
UM2QntYVuRO+sooZHSDzjBpB4Wn99jWAPq7jYwec7tmATKE/Yea3rQQ7b5b6rk+t  
Pp+TDsjx17uL3c656rGrf5vy0F4udxgCtRvEXCpf2Dn2DLKV3xudKwn99cwj2Vco  
4fKZLjtbpLUqCtbcGZ3OhSHNatbXW6lvdAlb/vQI/N5TDwVHQlRygUSVGumiO6T9  
eNCVc/IEUeyD7hfpcUglMNXroxaFelViAfjadj5NrOsbS0eRgfzhSAFY0MwE7quC  
0j1RgfNgM6RmkWEyWzLjHcmDr+eX2SFDRAcb+re6EoAAzuIY22Db+SlXgTiVBIPv  
bIu++eOnIo92uUKjFaKCXF6NGEBRhkYx5MpdRXGw0ehVuZ4ueWvuZAcFC5z5GSMN  
o36hFYQ/p8K06OFuBKzP9ce76BXsGWIBQiDz1mbP69E4jwBT3b4=oxcS  
-----END PGP SIGNATURE-----

Debian Security Advisory 5527-1

Debian Linux Security Advisory 5526-1 - Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5526-1                   security@debian.org  
https://www.debian.org/security/                       Moritz Muehlenhoff  
October 12, 2023                      https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : chromium  
CVE ID         : CVE-2023-5218 CVE-2023-5473 CVE-2023-5474 CVE-2023-5475  
                 CVE-2023-5476 CVE-2023-5477 CVE-2023-5478 CVE-2023-5479  
                 CVE-2023-5481 CVE-2023-5483 CVE-2023-5484 CVE-2023-5485  
                 CVE-2023-5486 CVE-2023-5487

Multiple security issues were discovered in Chromium, which could result  
in the execution of arbitrary code, denial of service or information  
disclosure.

For the oldstable distribution (bullseye) the updates need an additional  
toolchain update. When completed, fixes will be made available as  
118.0.5993.70-1~deb11u1.

For the stable distribution (bookworm), these problems have been fixed in  
version 118.0.5993.70-1~deb12u1.

We recommend that you upgrade your chromium packages.

For the detailed security status of chromium please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/chromium

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmUoLQkACgkQEMKTtsN8  
TjbT1w//SZOz5ggSz+pko8nfcD8AFJ7C1s4z145zm5I7fK/7rrISgq3VGcV/iZEw  
KhVz9CNCuDsyEW1sL9pB7piGdS4jBIvoQQ3Eu197ReS+Ln/l9wDj6xftGafGX3ve  
ypRVROQF1RUn0P0mevGkLVh3ECcFFEA4eIST+6IDWqOG/rZbPy1hxui+n8RgEQ8M  
D6hMZuJw4gB+LSB/Xf8zeguqbLfqizz3Z+N158c4pYXbwqlwEzmU7bJxuh/3zokz  
o9Ze+Y7H0KzKDADHY2U3DH0OGv5gW5aDZ+x2ozPpXzA+iD8JLj7JV+oilOQuD7YU  
jRi0L+hMDjaHIVFWgZVn9yLAKXNZPRQ+H52ZeWr2Pxl7HzJr18FroXG3Vp7XZgsB  
2nOt5/Ko/7K7LbjnCMhUWzqMwq93uH9IQRgnKiHK8lAJw8hG8siCbNiIYhLlvUJ8  
F1l7WijdSjpu3E5jRTHTYrHJCjXC8v/M+1p5b0IPzBG98GzZzNMibmzSGy11PITL  
/fMZpMU2ngyOI1OeXAG0gJM7r0NkiUOliThR7cLXiIfaHReVA5BzKfUR3HqtECzz  
qu8MeoLoohqJ9NILpz5FzXkEm89wuT93G6GwUraUD9tOLnn4+v7uI+bOTh83CRuh  
fYmHSIJTzmB1ULZuxfBl9MZ8zLFJhlmFvp/E5Rzik3+AchnEH8U=HjjW  
-----END PGP SIGNATURE-----

Debian Security Advisory 5526-1

This Tech Tip outlines how enterprise defenders can mitigate the risks of the curl and libcurl  vulnerabilities in their environments.

Security teams don’t have to swing into crisis mode to address the recently fixed vulnerabilities in the command-line tool curl and the libcurl library, but that doesn't mean they don't have to worry about identifying and remediating impacted systems. If the systems are not immediately exploitable, security teams have some time to make those updates.

This Tech Tip aggregates guidance on what security teams need to do to ensure they aren't at risk.

A foundational networking tool for Unix and Linux systems, cURL is used in command lines and scripts to transfer data. Its prevalence is due to the fact that it is used as both a standalone utility (curl) as well as a library that is included in many different types of applications (libcurl). The libcurl library, which allows developers to access curl APIs from their own code, can be introduced directly into the code, used as a dependency, used as part of an operating system bundle, included as part of a Docker container, or installed on a Kubernetes cluster node.

**What Is CVE-2023-38545?**

The high severity vulnerability affects curl and libcurl versions 7.69.0 to 8.3.0, and the low severity vulnerability impacts libcurl versions 7.9.1 to 8.3.0. However, the vulnerabilities cannot be exploited under default conditions. An attacker trying to trigger the vulnerability would need to point curl at a malicious server under the attacker’s control, make sure curl is using a SOCKS5 proxy using proxy-resolver mode, configure curl to automatically follow redirects, and set the buffer size to a smaller size.

According to Yair Mizrahi, a senior security researcher at JFrog, the libcurl library is vulnerable only if the following environment variables are set: _CURLOPT\_PROXYTYPE_  set to type _CURLPROXY\_SOCKS5\_HOSTNAME_; or _CURLOPT\_PROXY_ or _CURLOPT\_PRE\_PROXY_  set to scheme _socks5h://_. The library is also vulnerable if one of the proxy environment variables is set to use the _socks5h://_ scheme. The command-line tool is vulnerable only if it is executed with the _\-socks5-hostname_ flag, or with _\--proxy_ (-x) or _\--preproxy_ set to use the scheme _socks5h://_. It is also vulnerable if curl is executed with the affected environment variables.

“The set of pre-conditions needed in order for a machine to be vulnerable (see previous section) is more restrictive than initially believed. Therefore, we believe the vast majority of curl users won’t be affected by this vulnerability,” Mizrahi wrote in the analysis.

**Scan the Environment for Vulnerable Systems**

The first thing organizations need to do is to scope their environments to identify all systems using curl and libcurl to assess whether those preconditions exist. Organizations should inventory their systems and evaluate their software delivery processes using software composition analysis tools for code, scanning containers, and application security posture management utilities, notes Alex Ilgayev, head of security research at Cycode. Even though the vulnerability does not affect every implementation of curl, it would be easier to identify the impacted systems if the team starts with a list of potential locations to look.

The following commands identify which versions of curl are installed:

_Linux/MacOS:_

_find / -name curl 2>/dev/null -exec echo "Found: {}" \\; -exec {} --version \\;_

_Windows:_

_Get-ChildItem -Path C:\\ -Recurse -ErrorAction SilentlyContinue -Filter curl.exe | ForEach-Object { Write-Host "Found: $($\_.FullName)"; & $\_.FullName --version }_

GitHub has a query to run in Defender for Endpoint to identify all devices in the environment that have curl installed or use curl. Qualys has published its rules for using its platform.

Organizations using Docker containers or other container technologies should also scan the images for vulnerable versions. A sizable number of rebuilds are expected, particularly in docker images and similar entities that incorporate liburl copies. Docker has pulled together a list of instructions on assessing all images.

_To find existing repositories:_

_docker scout repo enable --org <org-name> <org-name>/scout-demo_

_To analyze local container images:_

_docker scout policy \[IMAGE\] --org \[ORG\]_

This issue highlights the importance of keeping meticulous track of all open source software being used in an organization, according to Henrik Plate, a security researcher at Endor Labs.

“Knowing about all the uses of curl and libcurl is the prerequisite for assessing the actual risk and taking remediation actions, be it patching curl, restricting access to affected systems from untrusted networks, or implementing other countermeasures,” Plate said.

If the application comes with a software bill of materials, that would be a good place to start looking for instances of curl, adds John Gallagher, vice president of Viakoo Labs.

Just because the flaws are not exploitable doesn’t mean the updates are not necessary. Patches are available directly for curl and libcurl, and many of the operating systems (Debian, Ubuntu, Red Hat, etc.) have also pushed fixed versions. Keep an eye out for security updates from other applications, as libcurl is a library used by many operating systems and applications.

One workaround until the updates can be deployed is to force curl to use local hostname resolving when connecting to a SOCKS5 proxy, according to JFrog’s Mizrahi. This syntax uses the socks5 scheme and not socks5h: _curl -x socks5://someproxy.com_. In the library, replace the environment variable _CURLPROXY\_SOCKS5\_HOSTNAME_ with _CURLPROXY\_SOCKS5_.

According to Benjamin Marr, a security engineer at Intruder,  security teams should be monitoring curl flags for excessive large strings, as that would indicate the system had been compromised. The flags are _\--socks5-hostname_, or _\--proxy_ or _\--preproxy_ set to use the scheme _socks5h://_.

Tag

#debian