Security bugs CVE-2020-16121 and aptcc specific CVE-2020-16122 #433
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
+1 by me |
hughsie
reviewed
Sep 24, 2020
hughsie
reviewed
Sep 24, 2020
8 tasks
Debs do not have signatures on their own, so they are always untrusted. Bug-Ubuntu: https://bugs.launchpad.net/bugs/1882098
…ocal (CVE-2020-16121) These functions revealed existence and content type of files, which allows a non-root user to check existence and content type of any file on the system, regardless of permission, as the checks are performed as root. A correct fix would move those checks into the client, and pass an fd to the daemon. Here we just hide which failure it is, which we would need to do anyway, but don't provide an improved version as that's out of scope for a security issue and requires changes the reverse dependencies using those functions. Bug-Ubuntu: https://bugs.launchpad.net/bugs/1888887
julian-klode
force-pushed
the
security-bugs
branch
from
8a68c21
to
7bd7a17
Compare
|
Addressed review comments. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Vaisha Bernard discovered that PackageKit incorrectly handled certain
methods. A local attacker could use this issue to learn the MIME type of
any file on the system. (CVE-2020-16121)
https://bugs.launchpad.net/bugs/1888887
Sami Niemimäki discovered that PackageKit incorrectly handled local deb
packages. A local user could possibly use this issue to install untrusted
packages, contrary to expectations. (CVE-2020-16122)
https://bugs.launchpad.net/bugs/1882098