CVE-2017-7555
augeas: Improper handling of escaped strings leading to memory corruption
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (hoch), Oracle (hoch), Ubuntu (mittel).
Beschreibung
Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.3 | augeas | 1.4.0-r5 |
| alpine 3.4 | augeas | 1.5.0-r1 |
| alpine 3.5 | augeas | 1.6.0-r1 |
| alpine 3.6 | augeas | 1.8.1-r0 |
| chainguard | py3-augeas | 0 |
| debian 11 | augeas | 1.8.1-1 |
| debian 12 | augeas | 1.8.1-1 |
| debian 13 | augeas | 1.8.1-1 |
| debian 14 | augeas | 1.8.1-1 |
| debian 7 | augeas | 0.10.0-1+deb7u1 |
| debian 8 | augeas | 1.2.0-0.2+deb8u2 |
| debian 9 | augeas | 1.8.0-1+deb9u1 |
Alle 25 Einträge aus 20 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.3 | augeas | 1.4.0-r5 |
| alpine 3.4 | augeas | 1.5.0-r1 |
| alpine 3.5 | augeas | 1.6.0-r1 |
| alpine 3.6 | augeas | 1.8.1-r0 |
| chainguard | py3-augeas | 0 |
| debian 11 | augeas | 1.8.1-1 |
| debian 12 | augeas | 1.8.1-1 |
| debian 13 | augeas | 1.8.1-1 |
| debian 14 | augeas | 1.8.1-1 |
| debian 7 | augeas | 0.10.0-1+deb7u1 |
| debian 8 | augeas | 1.2.0-0.2+deb8u2 |
| debian 9 | augeas | 1.8.0-1+deb9u1 |
| echo | augeas | 1.8.1-1 |
| Oracle Linux 7 | augeas | 1.4.0-2.el7_4.1 |
| Oracle Linux 7 | augeas-devel | 1.4.0-2.el7_4.1 |
| Oracle Linux 7 | augeas-libs | 1.4.0-2.el7_4.1 |
| Red Hat | augeas | kein Fix angegeben |
| Red Hat | augeas-devel | kein Fix angegeben |
| Red Hat | augeas-libs | kein Fix angegeben |
| Red Hat | rhev-hypervisor | kein Fix angegeben |
| ubuntu 14.04 | augeas | 1.2.0-0ubuntu1.3 |
| ubuntu 14.04-ESM | augeas | 1.2.0-0ubuntu1.3 |
| ubuntu 16.04 | augeas | 1.4.0-0ubuntu1.1 |
| ubuntu 16.04-ESM | augeas | 1.4.0-0ubuntu1.1 |
| ubuntu 17.04 | augeas | 1.6.0-0ubuntu3.1 |
Referenzen
- http://www.debian.org/security/2017/dsa-3949
- http://www.securityfocus.com/bid/100378
- https://access.redhat.com/errata/RHSA-2017:2788
- https://access.redhat.com/errata/RHSA-2019:2403
- https://access.redhat.com/security/cve/CVE-2017-7555
- https://bugzilla.redhat.com/show_bug.cgi?id=1478373
- https://github.com/hercules-team/augeas/pull/480
- https://linux.oracle.com/cve/CVE-2017-7555.html