Merge pull request #2354 from flatcar/buildbot/monthly-glsa-metadata-…

…updates-2024-10-01 Monthly GLSA metadata 2024-10-01
flatcar · Oct 1, 2024 · 7d7c106 · 7d7c106
2 parents db07824 + 9c3cc8a
commit 7d7c106
Show file tree

Hide file tree

Showing 36 changed files with 1,658 additions and 17 deletions.
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest
@@ -1,23 +1,23 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA512
 
-MANIFEST Manifest.files.gz 585357 BLAKE2B 90b484a7cfadba26e75b941b109643027b5530ea0e0da6565b28a1492ef9b8c6cfc7254e54f18ef93a17f476c8c87b2c8309fbac1afa85d144cc4d664931e811 SHA512 f5bbc1b0b0163958f91ecc02b4f0422622112ac5c642a105fef46e39550fd8622a03abd647b830a766a072ad993d41863d2d1d5ca05368f5af8d868f03aaeae4
-TIMESTAMP 2024-09-01T06:40:36Z
+MANIFEST Manifest.files.gz 590436 BLAKE2B 15aabc4185729e136cdcfaf5f8f985f8037a950c2674b40f4a60d6db55b6e66ddf62465183eec797a8745737731f08c9f5b7997b3092ca23932abe139760e3a2 SHA512 d4bc062a4c9898005fcd53314c2db40baaef3e5725ab92e762d55ae3747dcb34a1602299c2aa4bdf60a06b6f322e89ee0b897eafffb10de6e5392274ab828bc5
+TIMESTAMP 2024-10-01T06:40:44Z
 -----BEGIN PGP SIGNATURE-----
 
-iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmbUDGRfFIAAAAAALgAo
+iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAmb7mWxfFIAAAAAALgAo
 aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
 RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
-klDgsBAAoUHUrodoZqVv+dQRYagMfOtKu+cZ/yb+l9WuJq5v6zJV1SU3HFJjb8jB
-yvdsf1tED9myb4iYSBaUa3rGgXbpqT7MEBZDK8lCdxo/i9ATbjbD6eSmQNqMpWCE
-XfeWtJ0pa9zLEPJfzUDQ+XfJlGUkhjtiB59+/cP11gOmwRFyANr4lRvhX5hFU1sj
-X9HyFfr7RPSEnZNTRjIhtFRJQvWhkZzoZOzMnJPLzzMmJkU50hVsuutiRjsRZvlZ
-r+Q6yy23fOJltACl7wu8HL1BYFsMZTzMmsPABXjF20rSYMS1zqaXP/0yEuwUcmRJ
-EB9bE4ximGDUD55AI5t9v9M+N3wVCx7FWifhHdOLjr2fQ/aVURbAbXG+SGfSPcgq
-LSPafIb5H2N26gk7/Op/FdKb/kZ9KsHt0e63znXhvUsCLScQhrrTbR3Y2zhaZxKd
-EjghEbQcdMnVLzS5i/ZlhonjeOohRCeUqWFBTf2nrn/dwFPUEaG9aheroC3h6CNS
-P/x1d+kuGTu1nCmo1qyYEswpFhshdWaDphc/DF7X5glI49zT98la3FcViXIJI1NR
-+oWLc4T22ObxKiuZadtxFs+fxeDnWKE5K37e5/tAELKDlr/EsmK1lDHr04jThLKh
-4jALrrOHx9ELnhV2VQUAR9ZdbEd9jLY0d2LWvE8ZdvlpIXBxkUQ=
-=3RjN
+klAYfQ/+OORrhaCeew6AHMTI6JedDh1PU9GyUImC7rN1cUyze4keLTTj7PjtwYhA
+tdADi7qq9lVBlGdibw3zziyg6pZO6yBOCpBx7nRF6djTCh1PLutgv6YNywKEHNBn
+Re8whp1RlIHNLnnWYHrRbz5R1LmdKDXXy97j7JK/JnyAYT1z88DVkGA8aaZlb1Gw
+lhVrGeXoY38ak652IYpoCOpMY8klKRd5D2M6G7mccIFHHrPiqtVa+vqrPG1GNulS
+z08BF8/xrIG+4UQggWNOHEQvNF826oDwVFQtvSengpH2Sb7oEKzOdD8kCXxlCyQ5
+Tx4+Ig1KQosSdXga91F0z7fdIqtZu8gwa9D1b1f56slQdoMY8oJD1TU0wVCEqwhj
+fqU4zimrtssezq7g1JAxXxuBoBkAj5+7Fb6HNptnWZxOBjOnqdsx2EcYmbcbC4By
+xcfMpO/pTwYOn1w6OgZrJCuhafnvINOFzjl6+OqgtN294TeFKHXXdUB80ZMsib6r
+70gaBqjdgf5Q8GXC8Ry0tiHVCrzxOgL8YX/TluA3sbYlIFn7hy8atNmj0Hg+SDxX
+VCphysLRF6YNr74XcWJKPhr4M4YgCxRUwUL/hsb7U6/R2BriPyml9E0yiRCJ9bPC
+dKFEQ8OzRQ/4cupRgQGorqrv+ilHmwwh10JKh44yrAS7J6da+4w=
+=aTpw
 -----END PGP SIGNATURE-----
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz b/sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-01.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202409-01">
+    <title>Portage: Unverified PGP Signatures</title>
+    <synopsis>A vulnerability has been discovered in Portage, where PGP signatures would not be verified.</synopsis>
+    <product type="ebuild">portage</product>
+    <announced>2024-09-22</announced>
+    <revised count="1">2024-09-22</revised>
+    <bug>905356</bug>
+    <access>local</access>
+    <affected>
+        <package name="sys-apps/portage" auto="yes" arch="*">
+            <unaffected range="ge">3.0.47</unaffected>
+            <vulnerable range="lt">3.0.47</vulnerable>
+        </package>
+    </affected>
+    <background>
+        <p>Portage is the default Gentoo package management system.</p>
+    </background>
+    <description>
+        <p>Multiple vulnerabilities have been discovered in Portage. Please review the CVE identifiers referenced below for details.</p>
+    </description>
+    <impact type="normal">
+        <p>When using the webrsync mechanism to sync the tree the PGP signatures that protect the integrity of the data in the tree would not be verified. This would allow a man-in-the-middle attack to inject arbitrary content into the tree.</p>
+    </impact>
+    <workaround>
+        <p>There is no known workaround at this time.</p>
+    </workaround>
+    <resolution>
+        <p>All Portage users should upgrade to the latest version:</p>
+
+        <code>
+          # emerge --sync
+          # emerge --ask --oneshot --verbose ">=sys-apps/portage-3.0.47"
+        </code>
+    </resolution>
+    <references>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2016-20021">CVE-2016-20021</uri>
+    </references>
+    <metadata tag="requester" timestamp="2024-09-22T05:36:27.160412Z">graaff</metadata>
+    <metadata tag="submitter" timestamp="2024-09-22T05:36:27.162654Z">graaff</metadata>
+</glsa>
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-02.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-02.xml
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202409-02">
+    <title>PostgreSQL: Privilege Escalation</title>
+    <synopsis>A vulnerability has been discovered in PostgreSQL, which can lead to privilege escalation.</synopsis>
+    <product type="ebuild">postgresql</product>
+    <announced>2024-09-22</announced>
+    <revised count="1">2024-09-22</revised>
+    <bug>937573</bug>
+    <access>local and remote</access>
+    <affected>
+        <package name="dev-db/postgresql" auto="yes" arch="*">
+            <unaffected range="ge" slot="12">12.20</unaffected>
+            <unaffected range="ge" slot="13">13.16</unaffected>
+            <unaffected range="ge" slot="14">14.13</unaffected>
+            <unaffected range="ge" slot="15">15.8</unaffected>
+            <unaffected range="ge" slot="16">16.4</unaffected>
+            <vulnerable range="lt" slot="12">12.20</vulnerable>
+            <vulnerable range="lt" slot="13">13.16</vulnerable>
+            <vulnerable range="lt" slot="14">14.13</vulnerable>
+            <vulnerable range="lt" slot="15">15.8</vulnerable>
+            <vulnerable range="lt" slot="16">16.4</vulnerable>
+        </package>
+    </affected>
+    <background>
+        <p>PostgreSQL is an open source object-relational database management system.</p>
+    </background>
+    <description>
+        <p>A vulnerability has been discovered in PostgreSQL. Please review the CVE identifier referenced below for details.</p>
+    </description>
+    <impact type="high">
+        <p>An attacker able to create and drop non-temporary objects could inject SQL code that would be executed by a concurrent pg_dump session with the privileges of the role running pg_dump (which is often a superuser). The attack involves replacing a sequence or similar object with a view or foreign table that will execute malicious code. To prevent this, introduce a new server parameter restrict_nonsystem_relation_kind that can disable expansion of non-builtin views as well as access to foreign tables, and teach pg_dump to set it when available. Note that the attack is prevented only if both pg_dump and the server it is dumping from are new enough to have this fix.</p>
+    </impact>
+    <workaround>
+        <p>There is no known workaround at this time.</p>
+    </workaround>
+    <resolution>
+        <p>All PostgreSQL users should upgrade to the latest version:</p>
+
+        <code>
+          # emerge --sync
+          # emerge --ask --oneshot --verbose ">=dev-db/postgresql-12.20:12"
+          # emerge --ask --oneshot --verbose ">=dev-db/postgresql-13.16:13"
+          # emerge --ask --oneshot --verbose ">=dev-db/postgresql-14.13:14"
+          # emerge --ask --oneshot --verbose ">=dev-db/postgresql-15.8:15"
+          # emerge --ask --oneshot --verbose ">=dev-db/postgresql-16.4:16"
+        </code>
+    </resolution>
+    <references>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7348">CVE-2024-7348</uri>
+    </references>
+    <metadata tag="requester" timestamp="2024-09-22T05:47:12.326843Z">graaff</metadata>
+    <metadata tag="submitter" timestamp="2024-09-22T05:47:12.329535Z">graaff</metadata>
+</glsa>
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-03.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-03.xml
@@ -0,0 +1,46 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202409-03">
+    <title>GPL Ghostscript: Multiple Vulnerabilities</title>
+    <synopsis>Multiple vulnerabilities have been discovered in GPL Ghostscript, the worst of which could lead to arbitrary code execution.</synopsis>
+    <product type="ebuild">ghostscript-gpl</product>
+    <announced>2024-09-22</announced>
+    <revised count="1">2024-09-22</revised>
+    <bug>932125</bug>
+    <access>remote</access>
+    <affected>
+        <package name="app-text/ghostscript-gpl" auto="yes" arch="*">
+            <unaffected range="ge">10.03.1</unaffected>
+            <vulnerable range="lt">10.03.1</vulnerable>
+        </package>
+    </affected>
+    <background>
+        <p>Ghostscript is an interpreter for the PostScript language and for PDF.</p>
+    </background>
+    <description>
+        <p>Multiple vulnerabilities have been discovered in GPL Ghostscript. Please review the CVE identifiers referenced below for details.</p>
+    </description>
+    <impact type="high">
+        <p>Please review the referenced CVE identifiers for details.</p>
+    </impact>
+    <workaround>
+        <p>There is no known workaround at this time.</p>
+    </workaround>
+    <resolution>
+        <p>All GPL Ghostscript users should upgrade to the latest version:</p>
+
+        <code>
+          # emerge --sync
+          # emerge --ask --oneshot --verbose ">=app-text/ghostscript-gpl-10.03.1"
+        </code>
+    </resolution>
+    <references>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-52722">CVE-2023-52722</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-29510">CVE-2024-29510</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-33869">CVE-2024-33869</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-33870">CVE-2024-33870</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-33871">CVE-2024-33871</uri>
+    </references>
+    <metadata tag="requester" timestamp="2024-09-22T05:52:02.744888Z">graaff</metadata>
+    <metadata tag="submitter" timestamp="2024-09-22T05:52:02.747684Z">graaff</metadata>
+</glsa>
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-04.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-04.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202409-04">
+    <title>calibre: Multiple Vulnerabilities</title>
+    <synopsis>Multiple vulnerabilities have been discovered in calibre, the worst of which could lead to remote code execution.</synopsis>
+    <product type="ebuild">calibre</product>
+    <announced>2024-09-22</announced>
+    <revised count="1">2024-09-22</revised>
+    <bug>918429</bug>
+    <bug>936961</bug>
+    <access>local and remote</access>
+    <affected>
+        <package name="app-text/calibre" auto="yes" arch="*">
+            <unaffected range="ge">7.16.0</unaffected>
+            <vulnerable range="lt">7.16.0</vulnerable>
+        </package>
+    </affected>
+    <background>
+        <p>calibre is a powerful and easy to use e-book manager.</p>
+    </background>
+    <description>
+        <p>Multiple vulnerabilities have been discovered in calibre. Please review the CVE identifiers referenced below for details.</p>
+    </description>
+    <impact type="high">
+        <p>Please review the referenced CVE identifiers for details.</p>
+    </impact>
+    <workaround>
+        <p>There is no known workaround at this time.</p>
+    </workaround>
+    <resolution>
+        <p>All calibre users should upgrade to the latest version:</p>
+
+        <code>
+          # emerge --sync
+          # emerge --ask --oneshot --verbose ">=app-text/calibre-7.16.0"
+        </code>
+    </resolution>
+    <references>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-46303">CVE-2023-46303</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6781">CVE-2024-6781</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-6782">CVE-2024-6782</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7008">CVE-2024-7008</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2024-7009">CVE-2024-7009</uri>
+    </references>
+    <metadata tag="requester" timestamp="2024-09-22T05:54:09.323646Z">graaff</metadata>
+    <metadata tag="submitter" timestamp="2024-09-22T05:54:09.325619Z">graaff</metadata>
+</glsa>
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-05.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-05.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202409-05">
+    <title>PJSIP: Heap Buffer Overflow</title>
+    <synopsis>A vulnerability has been discovered in PJSIP, which could lead to arbitrary code execution.</synopsis>
+    <product type="ebuild">pjproject</product>
+    <announced>2024-09-22</announced>
+    <revised count="1">2024-09-22</revised>
+    <bug>917463</bug>
+    <access>local and remote</access>
+    <affected>
+        <package name="net-libs/pjproject" auto="yes" arch="*">
+            <unaffected range="ge">2.13.1</unaffected>
+            <vulnerable range="lt">2.13.1</vulnerable>
+        </package>
+    </affected>
+    <background>
+        <p>PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.</p>
+    </background>
+    <description>
+        <p>Please review the CVE identifier referenced below for details.</p>
+    </description>
+    <impact type="normal">
+        <p>Please review the CVE identifier referenced below for details.</p>
+    </impact>
+    <workaround>
+        <p>There is no known workaround at this time.</p>
+    </workaround>
+    <resolution>
+        <p>All PJSIP users should upgrade to the latest version:</p>
+
+        <code>
+          # emerge --sync
+          # emerge --ask --oneshot --verbose ">=net-libs/pjproject-2.13.1"
+        </code>
+    </resolution>
+    <references>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-27585">CVE-2023-27585</uri>
+    </references>
+    <metadata tag="requester" timestamp="2024-09-22T06:00:28.996175Z">graaff</metadata>
+    <metadata tag="submitter" timestamp="2024-09-22T06:00:28.999302Z">graaff</metadata>
+</glsa>
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-06.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-06.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202409-06">
+    <title>file: Stack Buffer Overread</title>
+    <synopsis>A vulnerability has been discovered in file, which could lead to a denial of service.</synopsis>
+    <product type="ebuild">file</product>
+    <announced>2024-09-22</announced>
+    <revised count="1">2024-09-22</revised>
+    <bug>918554</bug>
+    <access>remote</access>
+    <affected>
+        <package name="sys-apps/file" auto="yes" arch="*">
+            <unaffected range="ge">5.42</unaffected>
+            <vulnerable range="lt">5.42</vulnerable>
+        </package>
+    </affected>
+    <background>
+        <p>The file utility attempts to identify a file’s format by scanning binary data for patterns.</p>
+    </background>
+    <description>
+        <p>Multiple vulnerabilities have been discovered in file. Please review the CVE identifiers referenced below for details.</p>
+    </description>
+    <impact type="normal">
+        <p>File has an stack-based buffer over-read in file_copystr in funcs.c.</p>
+    </impact>
+    <workaround>
+        <p>There is no known workaround at this time.</p>
+    </workaround>
+    <resolution>
+        <p>All file users should upgrade to the latest version:</p>
+
+        <code>
+          # emerge --sync
+          # emerge --ask --oneshot --verbose ">=sys-apps/file-5.42"
+        </code>
+    </resolution>
+    <references>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-48554">CVE-2022-48554</uri>
+    </references>
+    <metadata tag="requester" timestamp="2024-09-22T06:04:59.257322Z">graaff</metadata>
+    <metadata tag="submitter" timestamp="2024-09-22T06:04:59.260356Z">graaff</metadata>
+</glsa>
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-07.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202409-07.xml
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202409-07">
+    <title>Rust: Multiple Vulnerabilities</title>
+    <synopsis>Multiple vulnerabilities have been discovered in Rust, the worst of which could lead to arbitrary code execution.</synopsis>
+    <product type="ebuild">rust,rust-bin</product>
+    <announced>2024-09-22</announced>
+    <revised count="1">2024-09-22</revised>
+    <bug>890371</bug>
+    <bug>911685</bug>
+    <access>remote</access>
+    <affected>
+        <package name="dev-lang/rust" auto="yes" arch="*">
+            <unaffected range="ge">1.71.1</unaffected>
+            <vulnerable range="lt">1.71.1</vulnerable>
+        </package>
+        <package name="dev-lang/rust-bin" auto="yes" arch="*">
+            <unaffected range="ge">1.71.1</unaffected>
+            <vulnerable range="lt">1.71.1</vulnerable>
+        </package>
+    </affected>
+    <background>
+        <p>A systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety.</p>
+    </background>
+    <description>
+        <p>Multiple vulnerabilities have been discovered in Rust. Please review the CVE identifiers referenced below for details.</p>
+    </description>
+    <impact type="normal">
+        <p>Please review the referenced CVE identifiers for details.</p>
+    </impact>
+    <workaround>
+        <p>There is no known workaround at this time.</p>
+    </workaround>
+    <resolution>
+        <p>All Rust binary users should upgrade to the latest version:</p>
+
+        <code>
+          # emerge --sync
+          # emerge --ask --oneshot --verbose ">=dev-lang/rust-bin-1.71.1"
+        </code>
+
+        <p>All Rust users should upgrade to the latest version:</p>
+
+        <code>
+          # emerge --sync
+          # emerge --ask --oneshot --verbose ">=dev-lang/rust-1.71.1"
+        </code>
+    </resolution>
+    <references>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2022-46176">CVE-2022-46176</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-38497">CVE-2023-38497</uri>
+    </references>
+    <metadata tag="requester" timestamp="2024-09-22T06:09:00.541000Z">graaff</metadata>
+    <metadata tag="submitter" timestamp="2024-09-22T06:09:00.543705Z">graaff</metadata>
+</glsa>