CVE-2017-7555
augeas: Improper handling of escaped strings leading to memory corruption
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (yüksek), Oracle (yüksek), Ubuntu (orta).
Açıklama
Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible code execution.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.3 | augeas | 1.4.0-r5 |
| alpine 3.4 | augeas | 1.5.0-r1 |
| alpine 3.5 | augeas | 1.6.0-r1 |
| alpine 3.6 | augeas | 1.8.1-r0 |
| chainguard | py3-augeas | 0 |
| debian 11 | augeas | 1.8.1-1 |
| debian 12 | augeas | 1.8.1-1 |
| debian 13 | augeas | 1.8.1-1 |
| debian 14 | augeas | 1.8.1-1 |
| debian 7 | augeas | 0.10.0-1+deb7u1 |
| debian 8 | augeas | 1.2.0-0.2+deb8u2 |
| debian 9 | augeas | 1.8.0-1+deb9u1 |
20 kaynaktaki 25 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.3 | augeas | 1.4.0-r5 |
| alpine 3.4 | augeas | 1.5.0-r1 |
| alpine 3.5 | augeas | 1.6.0-r1 |
| alpine 3.6 | augeas | 1.8.1-r0 |
| chainguard | py3-augeas | 0 |
| debian 11 | augeas | 1.8.1-1 |
| debian 12 | augeas | 1.8.1-1 |
| debian 13 | augeas | 1.8.1-1 |
| debian 14 | augeas | 1.8.1-1 |
| debian 7 | augeas | 0.10.0-1+deb7u1 |
| debian 8 | augeas | 1.2.0-0.2+deb8u2 |
| debian 9 | augeas | 1.8.0-1+deb9u1 |
| echo | augeas | 1.8.1-1 |
| Oracle Linux 7 | augeas | 1.4.0-2.el7_4.1 |
| Oracle Linux 7 | augeas-devel | 1.4.0-2.el7_4.1 |
| Oracle Linux 7 | augeas-libs | 1.4.0-2.el7_4.1 |
| Red Hat | augeas | düzeltme belirtilmemiş |
| Red Hat | augeas-devel | düzeltme belirtilmemiş |
| Red Hat | augeas-libs | düzeltme belirtilmemiş |
| Red Hat | rhev-hypervisor | düzeltme belirtilmemiş |
| ubuntu 14.04 | augeas | 1.2.0-0ubuntu1.3 |
| ubuntu 14.04-ESM | augeas | 1.2.0-0ubuntu1.3 |
| ubuntu 16.04 | augeas | 1.4.0-0ubuntu1.1 |
| ubuntu 16.04-ESM | augeas | 1.4.0-0ubuntu1.1 |
| ubuntu 17.04 | augeas | 1.6.0-0ubuntu3.1 |
Referanslar
- http://www.debian.org/security/2017/dsa-3949
- http://www.securityfocus.com/bid/100378
- https://access.redhat.com/errata/RHSA-2017:2788
- https://access.redhat.com/errata/RHSA-2019:2403
- https://access.redhat.com/security/cve/CVE-2017-7555
- https://bugzilla.redhat.com/show_bug.cgi?id=1478373
- https://github.com/hercules-team/augeas/pull/480
- https://linux.oracle.com/cve/CVE-2017-7555.html