|
This file lists the major changes made between the last released
version of Owl and Owl-current. While some of the changes listed here
may also be made to a stable branch, the complete lists of stable
branch changes are included with those branches and as errata for the
corresponding Owl releases only.
This is very far from an exhaustive list of changes. Small changes to
individual packages won't be mentioned here unless they fix a security
or a critical reliability problem. They are, however, mentioned in
change logs for the packages themselves.
Security fixes have a "Severity" specified for the issue(s) being fixed.
The three comma-separated metrics given after "Severity:" are: risk
impact (low, medium, or high), attack vector (local, remote, or
indirect), and whether the attack may be carried out at will (active) or
not (passive). Please note that the specified risk impact is just that,
it is not the overall severity, so other metrics are not factored into
it. For example, a "high" impact "local, passive" issue is generally of
lower overall severity than a "high" impact "remote, active" one - this
is left up to our users to consider given their specific circumstances.
Per our current conventions, a Denial of Service (DoS) vulnerability is
generally considered to have a "low" risk impact (even if it is a
"remote, active" one, which is to be considered separately as it may
make the vulnerability fairly critical under specific circumstances).
Some examples of "medium" impact vulnerabilities would be persistent DoS
(where the DoS effect does not go away with a (sub)system restart), data
loss, bugs enabling non-critical information leaks, cryptographic
signature forgeries, and/or sending of or accepting spoofed/forged
network traffic (where such behavior was unexpected), as long as they
would not directly allow for a "high" impact attack. Finally, a typical
"high" impact vulnerability would allow for privilege escalation such as
ability to execute code as another user ID than the attacker's (a
"local" attack) or without "legitimately" having such an ability (a
"remote" attack).
The metrics specified are generally those for a worst case scenario,
however in certain cases ranges such as "none to low" or/and "local to
remote" may be specified, referring to the defaults vs. a worst case yet
"legitimate" custom configuration. In some complicated cases, multiple
issues or attacks may be dealt with at once. When those differ in their
severity metrics, we use slashes to denote the possible combinations.
For example, "low/none to high, remote/local" means that we've dealt
with issue(s) or attack(s) that are "low, remote" and those that are
"none to high, local". In those tricky cases, we generally try to
clarify the specific issue(s) and their severities in the description.
Changes made between Owl 3.1 and Owl-current.
2021/01/25 -
2021/04/04 Package: passwdqc
Updated to 2.0.2 (and first to intermediate releases).
2021/03/10 Package: scanlogd
Updated to 2.2.8
2021/01/11 Package: tcb
Updated to 1.2.
2020/05/19 Package: kernel
SECURITY FIX Severity: high, local, active
Merged the most relevant fixes from RHEL5's -436, including for the
following local vulnerabilities: use-after-free in sys_mq_notify()
allowing for a local root compromise and container escape by any user
(CVE-2017-11176), divide-by-zero in __tcp_select_window() allowing for a
local DoS (CVE-2017-14106), use-after-free in ALSA allowing for a local
root compromise by a host user in group "audio" if the vulnerable kernel
module is loaded (CVE-2017-15265). Also fixed is an inconsistency in
modify_ldt(2)'s memory (de)allocation, which got introduced along with
KPTI in our update to -431 and is known as Red Hat's "bug 1584622" and
might have had local security impact.
References:
https://access.redhat.com/errata/RHSA-2018:3822
https://access.redhat.com/errata/RHSA-2018:2172
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11176
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14106
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15265
https://blog.lexfo.fr/cve-2017-11176-linux-kernel-exploitation-part1.html
2020/02/04 Package: e2fsprogs
SECURITY FIX Severity: none to high, indirect, passive
Updated to 1.45.5. Since the version of e2fsprogs that we had packaged
previously, multiple vulnerabilities with attack vectors via malicious
filesystem images have been found and fixed in e2fsprogs components.
Those vulnerabilities don't pose a risk to typical systems that do not
use untrusted filesystem images, but are high impact on those that do.
References:
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1572
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0247
2019/12/25 Package: passwdqc
Updated to 1.4.0.
2019/04/12 Package: john
Updated to 1.9.0.
2018/07/03 Package: gnupg
SECURITY FIX Severity: medium, local/indirect, passive
Updated to 1.4.23, which, compared to 1.4.21, fixes a side-channel leak
(CVE-2017-7526) and a bypass of signature verification in third-party
programs that invoke GnuPG (CVE-2018-12020).
References:
http://www.openwall.com/lists/oss-security/2017/07/06/8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526
http://www.openwall.com/lists/oss-security/2018/06/08/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12020
2018/06/28 Package: kernel
Fixed a regression introduced with the previous update (to -431) where
some 32-bit syscalls would fail with EFAULT on a 64-bit kernel because
of improper alignment of the newly introduced KAISER/KPTI trampoline
stack. This fix is due to investigation and patch by Pavel Kankovsky
and bug report by Chris Bopp.
2018/05/24 Package: lftp
Updated to 4.8.3.
2018/05/23 Packages: procps, procps-ng
SECURITY FIX Severity: high, local, passive
Replaced procps with procps-ng 3.3.14 plus all Qualys patches fixing a
number of issues that Qualys found during their security audit,
including some issues that might have allowed successful attacks on a
user (or root) invoking top(1) or other procps programs.
References:
http://www.openwall.com/lists/oss-security/2018/05/17/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1122
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1123
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1124
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1125
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1126
2018/05/21 Package: kernel
SECURITY FIX Severity: low to high, local, active
Updated to 2.6.18-431.el5.028stab123.1. This is a belated (with Owl
being barely on life support at this point) addition of kernel page
table isolation (KPTI) on x86-64 (only) as a software fix for Meltdown
(CVE-2017-5754) - an issue that allowed userspace processes to read
kernel memory (except on AMD CPUs). Also included is a fix for the "POP
SS" vulnerability (CVE-2018-8897), which allowed for a local DoS attack.
However, this update does not mitigate the set of CPU vulnerabilities
known as Spectre, although the exposure to them might be lower than it
is in newer kernels because of the lack of eBPF.
References:
https://meltdownattack.com
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5754
https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html
http://www.openwall.com/lists/oss-security/2018/05/08/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8897
2017/10/25 Package: glibc
SECURITY FIX Severity: none to high, remote, active
Backported upstream fix for the recently discovered glob heap buffer
overflow (CVE-2017-15670) and while at it also for integer overflows in
pvalloc, valloc, posix_memalign/memalign/aligned_alloc (CVE-2013-4332).
References:
http://www.openwall.com/lists/oss-security/2017/10/21/5
https://sourceware.org/bugzilla/show_bug.cgi?id=22320
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15670
http://www.openwall.com/lists/oss-security/2013/09/12/6
https://sourceware.org/bugzilla/show_bug.cgi?id=15855
https://sourceware.org/bugzilla/show_bug.cgi?id=15856
https://sourceware.org/bugzilla/show_bug.cgi?id=15857
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332
2017/10/19 Package: kernel
SECURITY FIX Severity: none to high, local, active
Updated to 2.6.18-419.el5.028stab122.4. This addresses the issue of
Position Independent Executables' (PIE) data potentially overlapping in
memory with their stack areas (CVE-2017-1000253). (Un)fortunately, on
Owl we do not yet build our SUID/SGID binaries as PIE (which would be a
security enhancement if it were not for this issue), so this did not
affect Owl itself, but it could affect third-party SUID/SGID binaries
installed on Owl (including e.g. as part of third-party distros in
containers). The many other security issues also addressed with this
upstream update, as compared to the much older upstream revision we
built upon previously, had already been fixed or worked around in prior
kernel updates for Owl.
References:
http://www.openwall.com/lists/oss-security/2017/09/26/16
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000253
https://openvz.org/Download/kernel/rhel5/028stab122.4
https://openvz.org/Download/kernel/rhel5/028stab122.3
https://openvz.org/Download/kernel/rhel5/028stab122.2
https://openvz.org/Download/kernel/rhel5/028stab122.1
https://openvz.org/Download/kernel/rhel5/028stab120.3
https://openvz.org/Download/kernel/rhel5/028stab120.2
2017/06/19 Package: kernel
SECURITY FIX Severity: none to high, local, active
On SUID/SGID exec, limit the size of argv+envp to 512 KiB and the stack
size to 10 MiB, similarly to what grsecurity did in 2012. This prevents
some of the stack/heap clash attacks described by Qualys, while some
others were already prevented for years by our glibc hardening changes.
References:
http://www.openwall.com/lists/oss-security/2017/06/19/1
https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash
2017/06/15 Package: db4
SECURITY FIX Severity: medium to high, local, active
Don't open the DB_CONFIG file in the current directory. This unexpected
property of db4 could have allowed for local DoS, information leaks, and
privilege escalation via programs using db4, including Postfix.
Reference:
http://www.openwall.com/lists/oss-security/2017/06/15/3
2017/06/08 Package: kernel
Backported upstream reimplementation of restricted hard links,
controllable via the fs.protected_hardlinks sysctl and enabled by
default, similar to what we had as part of CONFIG_HARDEN_LINK in -ow
patches and what grsecurity had as part of CONFIG_GRKERNSEC_LINK. This
reinforces the group crontab vs. root privilege separation in our
package of ISC/Vixie Cron.
Reference:
http://www.openwall.com/lists/oss-security/2017/06/08/3
2017/04/02 Package: kernel
SECURITY FIX Severity: high, local, active
Merged upstream fix to locking in net/ipv4/ping.c: ping_unhash(), where
the race condition could have been exploited by container root into e.g.
container escape. Without a vulnerability in ping(1), the issue was not
triggerable by non-root users (neither host nor container).
References:
http://www.openwall.com/lists/oss-security/2017/03/24/6
http://lists.openwall.net/netdev/2017/03/25/16
2017/01/25 Package: kernel
SECURITY FIX Severity: high, local, active
Merged in a fix of use-after-free in the recvmmsg() exit path
(CVE-2016-7117) from Red Hat's -417. The vulnerability appears likely
to be exploitable locally. Remote exploitation might be possible as
well, but would require specific (unlikely?) behavior of a service.
References:
https://blog.lizzie.io/notes-about-cve-2016-7117.html
https://access.redhat.com/security/cve/cve-2016-7117
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7117
2016/12/10 Package: kernel
Merged in Red Hat's CVE-2016-5195 "Dirty COW" fix while also keeping the
mitigation introduced in Owl earlier. In the kernel build for x86-64,
bumped up the maximum number of logical CPUs from 32 to 96, enabled
support for NUMA, huge pages, hugetlbfs, modules for I2C and many
sensors (similar to what's enabled in RHEL) and CPU microcode update.
2016/10/23 Package: kernel
SECURITY FIX Severity: high, local, active
Added a mitigation for the "Dirty COW" Linux kernel privilege escalation
vulnerability (CVE-2016-5195).
References:
http://www.openwall.com/lists/oss-security/2016/10/21/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5195
2016/10/17 -
2016/10/21 Package: bind
SECURITY FIX Severity: low, remote, active
Merged multiple DoS vulnerability fixes from Red Hat's package, most
notably for two easily triggerable assertion failures (CVE-2016-2776,
CVE-2016-2848).
References:
http://www.openwall.com/lists/oss-security/2016/09/27/8
https://kb.isc.org/article/AA-01419
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2776
http://www.openwall.com/lists/oss-security/2016/10/20/7
https://kb.isc.org/article/AA-01433/74/CVE-2016-2848
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2848
2016/08/23 Package: openssh
Backported upstream fix for a use-after-free in sshd's debugging output,
with no known security impact.
2016/08/23 Package: openssl
SECURITY FIX Severity: none to high, remote, active
Updated to 1.0.0t, which fixes the "X509_ATTRIBUTE memory leak"
(CVE-2015-3195) and "Race condition handling PSK identify hint"
(CVE-2015-3196) vulnerabilities. Neither of these affects the uses of
OpenSSL in Owl, but third-party applications using Owl's OpenSSL might
be affected. The "high" impact potential is for the double-free
possibility mentioned in the OpenSSL advisory, even though the OpenSSL
team has rated the corresponding issue as "low" overall severity
(possibly considering its low risk probability, or/and other mitigating
factors). This Owl package update also adds a CA certificate bundle.
Reference:
https://www.openssl.org/news/secadv/20151203.txt
2016/08/23 Package: kernel
SECURITY FIX Severity: low, local, active
Updated to 2.6.18-408.el5.028stab120.1, which addresses several DoS
vulnerabilities, and additionally fixed a kernel panic triggerable via
the move_pages() syscall.
Reference:
https://openvz.org/Download/kernel/rhel5-testing/028stab120.1
2016/08/23 Package: gnupg
SECURITY FIX Severity: medium, remote, passive
Updated to 1.4.21, which, compared to 1.4.18, fixes side-channel leaks
(CVE-2014-3591, CVE-2015-0837) and a bug in the random number generator
where an attacker who obtains 4640 bits from the RNG could trivially
predict the next 160 bits of output (CVE-2016-6313).
References:
https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html
http://www.openwall.com/lists/oss-security/2016/08/17/8
https://lists.gnupg.org/pipermail/gnupg-announce/2015q4/000382.html
https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html
http://www.cs.tau.ac.il/~tromer/radioexp/
2016/07/20 Package: passwdqc
In version 1.3.1, fixed a bug in pam_passwdqc's rarely used "non-unix"
option. The bug existed since passwdqc 1.1.3, released in 2009.
Reference:
http://www.openwall.com/lists/announce/2016/07/22/1
2015/08/01 Package: openssl
SECURITY FIX Severity: none to medium, remote, passive to active
Updated to 1.0.0s, which fixes many Low and Moderate severity issues
(per OpenSSL's classification), as well as one High severity issue in
the client: silent downgrades of RSA to EXPORT_RSA (CVE-2015-0204), with
the corresponding attack known as FREAK.
References:
https://www.openssl.org/news/secadv_20150108.txt
https://www.openssl.org/news/secadv_20150319.txt
https://www.openssl.org/news/secadv_20150611.txt
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204
https://freakattack.com
https://en.wikipedia.org/wiki/FREAK
2015/07/31 Package: bind
SECURITY FIX Severity: low, remote, active
Merged multiple DoS vulnerability fixes from Red Hat's package, most
notably for the easily triggerable error in handling of TKEY queries
(CVE-2015-5477).
References:
http://www.openwall.com/lists/oss-security/2015/07/29/3
https://kb.isc.org/article/AA-01272
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5477
2015/06/11 Package: kernel
SECURITY FIX Severity: high, local, active
Fixed OpenVZ container filesystem (simfs) escape vulnerability via bind
mounts (CVE-2015-2925).
References:
https://bugs.openvz.org/browse/OVZ-6296
http://www.openwall.com/lists/oss-security/2015/04/03/7
https://access.redhat.com/security/cve/CVE-2015-2925
https://bugzilla.redhat.com/show_bug.cgi?id=1209367
2015/06/09 Package: kernel
SECURITY FIX Severity: high, local, active
Updated to 2.6.18-406.el5.028stab119.1. Most importantly, this fixes a
possible I/O vector array overrun, which could allow for local privilege
escalation (CVE-2015-1805).
References:
https://openvz.org/Download/kernel/rhel5-testing/028stab119.1
http://rhn.redhat.com/errata/RHSA-2015-1042.html
http://www.openwall.com/lists/oss-security/2015/06/06/2
https://openvz.org/Download/kernel/rhel5/028stab118.1
http://rhn.redhat.com/errata/RHSA-2015-0164.html
2015/03/06 Package: strace
Updated to 4.10.
2015/01/28 Package: glibc
SECURITY FIX Severity: none to high, remote, active
Backported upstream's fix for a buffer overflow in gethostbyname*()
functions, which could be triggered via a crafted IP address argument.
Depending on the application that uses these functions, this
vulnerability could allow a local or a remote attacker to execute
arbitrary code. Due to the analysis by Qualys (referenced below), it is
known that the issue could be exploited remotely via Exim (which we do
not include in Owl) or locally via clockdiff or procmail if these are
installed SUID/SGID or with filesystem capabilities (not the case on
Owl). While there's no known security impact on Owl itself, Owl with
third-party software added (as many real-world installs have) may be
affected, with worst-case impact ranging up to a remote root compromise.
References:
http://www.openwall.com/lists/oss-security/2015/01/27/9
https://blog.qualys.com/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability
https://sourceware.org/bugzilla/show_bug.cgi?id=15014
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0235
2015/01/26 Package: libnss
SECURITY FIX Severity: none to medium, indirect, passive
Updated to 3.17.3. which includes a fix for "RSA PKCS#1 signature
verification forgery is possible due to too-permissive SignatureAlgorithm
parameter parsing" (CVE-2014-1568) since version 3.17.1. The only part
potentially affected by this in Owl is RPM since it is the only package
using NSS currently, although we do not use RPM's signature verification
for Owl's own packages (we use GnuPG-signed mtree files instead).
References:
https://bugzilla.mozilla.org/show_bug.cgi?id=1064636
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568
2015/01/26 Package: libnspr
Updated to 4.10.7.
2015/01/04 Package: openssl
SECURITY FIX Severity: none to medium, remote, active
Updated to 1.0.0o, which fixes "Information leak in pretty printing
functions" (CVE-2014-3508), "Race condition in
ssl_parse_serverhello_tlsext" (CVE-2014-3509), "Session Ticket Memory
Leak" (CVE-2014-3567), and adds support for "SSL 3.0 Fallback
protection" to let applications mitigate POODLE (CVE-2014-3566).
References:
https://www.openssl.org/news/secadv_20140806.txt
https://www.openssl.org/news/secadv_20141015.txt
2015/01/04 Package: bash
Updated to 3.1 patchlevel 23.
2015/01/04 Package: help2man
New package: help2man, which creates simple man pages from the output of
programs. It currently generates the diff(1) man page during Owl build.
2014/12/28 Package: kernel
SECURITY FIX Severity: none to high, local, active
Updated to 2.6.18-400.el5.028stab117.2, which most importantly fixes a
local privilege escalation vulnerability on x86-64 (CVE-2014-9322).
References:
https://openvz.org/Download/kernel/rhel5/028stab117.2
http://www.openwall.com/lists/oss-security/2014/12/15/6
https://rhn.redhat.com/errata/RHSA-2014-2008.html
https://rhn.redhat.com/errata/RHSA-2014-1959.html
https://openvz.org/Download/kernel/rhel5/028stab116.1
https://rhn.redhat.com/errata/RHBA-2014-1196.html
https://rhn.redhat.com/errata/RHSA-2014-1143.html
https://rhn.redhat.com/errata/RHSA-2014-0926.html
2014/10/25 Package: tzdata
Updated to 2014i.
2014/09/25 -
2014/09/27 Package: bash
SECURITY FIX Severity: none to high, remote, active
Updated to 3.1 patchlevel 19 with additional patches by Florian Weimer
of Red Hat. This fixes vulnerabilities with and introduces security
hardening of function imports, which could in many setups be exploited
remotely.
References:
http://www.openwall.com/lists/oss-security/2014/09/24/10
http://www.openwall.com/lists/oss-security/2014/09/24/11
http://www.openwall.com/lists/oss-security/2014/09/24/40
http://www.openwall.com/lists/oss-security/2014/09/25/5
http://www.openwall.com/lists/oss-security/2014/09/25/13
http://www.openwall.com/lists/oss-security/2014/09/25/32
http://www.openwall.com/lists/oss-security/2014/09/26/2
http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html
https://access.redhat.com/blogs/766093/posts/1976383
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187
2014/08/16 Package: strace
Updated to 4.9.
2014/07/12 Package: sqlite
Introduced a new package due to the new RPM requirements.
2014/07/12 Package: rpm
Updated to 4.11.2.
The payload compression method was changed from bzip2 to xz.
2014/07/12 Package: mpfr
Updated to 3.1.2 patch-level 8.
2014/07/12 Package: m4
Updated to 1.4.17.
2014/07/12 Package: libtool
Updated to 2.4.2.
2014/07/12 Package: libpopt
Updated to 1.16.
Introduced the libpopt library as an independent, separate package.
2014/07/12 Package: libnss
Introduced a new package due to the new RPM requirements.
2014/07/12 Package: libnspr
Introduced a new package due to the new RPM requirements.
2014/07/12 Package: libnet
Updated to 1.2-rc3.
2014/07/12 Package: libmpc
Updated to 1.0.2.
2014/07/12 Package: gmp
Updated to 6.0.0a.
2014/07/12 Package: gettext
Updated to 0.19.1.
2014/07/12 Package: gdbm
Updated to 1.11.
2014/07/12 Package: flex
Updated to 2.5.39.
2014/07/12 Package: file
Updated to 5.19.
2014/07/12 Package: coreutils
Updated to 8.22.
2014/07/12 Package: bison
Updated to 3.0.2.
2014/07/12 Package: automake
Updated to 1.14.
2014/07/12 Package: autoconf
Updated to 2.69.
$Owl: Owl/doc/CHANGES-current,v 1.50 2021/04/04 17:18:36 solar Exp $
| 