opensuse-su-2021:0460-1
Vulnerability from csaf_opensuse
Published
2021-03-21 23:09
Modified
2021-03-21 23:09
Summary
Security update for privoxy

Notes

Title of the patch
Security update for privoxy
Description of the patch
This update for privoxy fixes the following issues: Update to version 3.0.32: - Security/Reliability (boo#1183129) - ssplit(): Remove an assertion that could be triggered with a crafted CGI request. Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272 Reported by: Joshua Rogers (Opera) - cgi_send_banner(): Overrule invalid image types. Prevents a crash with a crafted CGI request if Privoxy is toggled off. Commit e711c505c48. OVE-20210206-0001. CVE-2021-20273 Reported by: Joshua Rogers (Opera) - socks5_connect(): Don't try to send credentials when none are configured. Fixes a crash due to a NULL-pointer dereference when the socks server misbehaves. Commit 85817cc55b9. OVE-20210207-0001. CVE-2021-20274 Reported by: Joshua Rogers (Opera) - chunked_body_is_complete(): Prevent an invalid read of size two. Commit a912ba7bc9c. OVE-20210205-0001. CVE-2021-20275 Reported by: Joshua Rogers (Opera) - Obsolete pcre: Prevent invalid memory accesses with an invalid pattern passed to pcre_compile(). Note that the obsolete pcre code is scheduled to be removed before the 3.0.33 release. There has been a warning since 2008 already. Commit 28512e5b624. OVE-20210222-0001. CVE-2021-20276 Reported by: Joshua Rogers (Opera) - Bug fixes: - Properly parse the client-tag-lifetime directive. Previously it was not accepted as an obsolete hash value was being used. Reported by: Joshua Rogers (Opera) - decompress_iob(): Prevent reading of uninitialized data. Reported by: Joshua Rogers (Opera). - decompress_iob(): Don't advance cur past eod when looking for the end of the file name and comment. - decompress_iob(): Cast value to unsigned char before shifting. Prevents a left-shift of a negative value which is undefined behaviour. Reported by: Joshua Rogers (Opera) - gif_deanimate(): Confirm that that we have enough data before doing any work. Fixes a crash when fuzzing with an empty document. Reported by: Joshua Rogers (Opera). - buf_copy(): Fail if there's no data to write or nothing to do. Prevents undefined behaviour 'applying zero offset to null pointer'. Reported by: Joshua Rogers (Opera) - log_error(): Treat LOG_LEVEL_FATAL as fatal even when --stfu is being used while fuzzing. Reported by: Joshua Rogers (Opera). - Respect DESTDIR when considering whether or not to install config files with '.new' extension. - OpenSSL ssl_store_cert(): Fix two error messages. - Fix a couple of format specifiers. - Silence compiler warnings when compiling with NDEBUG. - fuzz_server_header(): Fix compiler warning. - fuzz_client_header(): Fix compiler warning. - cgi_send_user_manual(): Also reject requests if the user-manual directive specifies a https:// URL. Previously Privoxy would try and fail to open a local file. - General improvements: - Log the TLS version and the the cipher when debug 2 is enabled. - ssl_send_certificate_error(): Respect HEAD requests by not sending a body. - ssl_send_certificate_error(): End the body with a single new line. - serve(): Increase the chances that the host is logged when closing a server socket. - handle_established_connection(): Add parentheses to clarify an expression Suggested by: David Binderman - continue_https_chat(): Explicitly unset CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE if process_encrypted_request() fails. This makes it more obvious that the connection will not be reused. Previously serve() relied on CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED being unset. Inspired by a patch from Joshua Rogers (Opera). - decompress_iob(): Add periods to a couple of log messages - Terminate the body of the HTTP snipplets with a single new line instead of '\r\n'. - configure: Add --with-assertions option and only enable assertions when it is used - windows build: Use --with-brotli and --with-mbedtls by default and enable dynamic error checking. - gif_deanimate(): Confirm we've got an image before trying to write it Saves a pointless buf_copy() call. - OpenSSL ssl_store_cert(): Remove a superfluous space before the serial number. - Action file improvements: - Disable fast-redirects for .golem.de/ - Unblock requests to adri*. - Block requests for trc*.taboola.com/ - Disable fast-redirects for .linkedin.com/ - Filter file improvements: - Make the second pcrs job of the img-reorder filter greedy again. The ungreedy version broke the img tags on: https://bulk.fefe.de/scalability/. - Privoxy-Log-Parser: - Highlight a few more messages. - Clarify the --statistics output. The shown 'Reused connections' are server connections so name them appropriately. - Bump version to 0.9.3. - Privoxy-Regression-Test: - Add the --check-bad-ssl option to the --help output. - Bump version to 0.7.3. - Documentation: - Add pushing the created tag to the release steps in the developer manual. - Clarify that 'debug 32768' should be used in addition to the other debug directives when reporting problems. - Add a 'Third-party licenses and copyrights' section to the user manual. This update was imported from the openSUSE:Leap:15.2:Update update project.
Patchnames
openSUSE-2021-460
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for privoxy",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for privoxy fixes the following issues:\n\nUpdate to version 3.0.32:\n\n  - Security/Reliability (boo#1183129)\n\n    - ssplit(): Remove an assertion that could be triggered with a\n      crafted CGI request.\n      Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272\n      Reported by: Joshua Rogers (Opera)\n    - cgi_send_banner(): Overrule invalid image types. Prevents a\n      crash with a crafted CGI request if Privoxy is toggled off.\n      Commit e711c505c48. OVE-20210206-0001. CVE-2021-20273\n      Reported by: Joshua Rogers (Opera)\n    - socks5_connect(): Don\u0027t try to send credentials when none are\n      configured. Fixes a crash due to a NULL-pointer dereference\n      when the socks server misbehaves.\n      Commit 85817cc55b9. OVE-20210207-0001. CVE-2021-20274\n      Reported by: Joshua Rogers (Opera)\n    - chunked_body_is_complete(): Prevent an invalid read of size\n      two.\n      Commit a912ba7bc9c. OVE-20210205-0001. CVE-2021-20275\n      Reported by: Joshua Rogers (Opera)\n    - Obsolete pcre: Prevent invalid memory accesses with an invalid\n      pattern passed to pcre_compile(). Note that the obsolete pcre\n      code is scheduled to be removed before the 3.0.33 release.\n      There has been a warning since 2008 already.\n      Commit 28512e5b624. OVE-20210222-0001. CVE-2021-20276\n      Reported by: Joshua Rogers (Opera)\n\n  - Bug fixes:\n\n    - Properly parse the client-tag-lifetime directive. Previously it was\n      not accepted as an obsolete hash value was being used.\n      Reported by: Joshua Rogers (Opera)\n    - decompress_iob(): Prevent reading of uninitialized data.\n      Reported by: Joshua Rogers (Opera).\n    - decompress_iob(): Don\u0027t advance cur past eod when looking\n      for the end of the file name and comment.\n    - decompress_iob(): Cast value to unsigned char before shifting.\n      Prevents a left-shift of a negative value which is undefined behaviour.\n      Reported by: Joshua Rogers (Opera)\n    - gif_deanimate(): Confirm that that we have enough data before doing\n      any work. Fixes a crash when fuzzing with an empty document.\n      Reported by: Joshua Rogers (Opera).\n    - buf_copy(): Fail if there\u0027s no data to write or nothing to do.\n      Prevents undefined behaviour \u0027applying zero offset to null pointer\u0027.\n      Reported by: Joshua Rogers (Opera)\n    - log_error(): Treat LOG_LEVEL_FATAL as fatal even when --stfu is\n      being used while fuzzing.\n      Reported by: Joshua Rogers (Opera).\n    - Respect DESTDIR when considering whether or not to install\n      config files with \u0027.new\u0027 extension.\n    - OpenSSL ssl_store_cert(): Fix two error messages.\n    - Fix a couple of format specifiers.\n    - Silence compiler warnings when compiling with NDEBUG.\n    - fuzz_server_header(): Fix compiler warning.\n    - fuzz_client_header(): Fix compiler warning.\n    - cgi_send_user_manual(): Also reject requests if the user-manual\n      directive specifies a https:// URL. Previously Privoxy would try and\n      fail to open a local file.\n\n  - General improvements:\n\n    - Log the TLS version and the the cipher when debug 2 is enabled.\n    - ssl_send_certificate_error(): Respect HEAD requests by not sending a body.\n    - ssl_send_certificate_error(): End the body with a single new line.\n    - serve(): Increase the chances that the host is logged when closing\n      a server socket.\n    - handle_established_connection(): Add parentheses to clarify an expression\n      Suggested by: David Binderman\n    - continue_https_chat(): Explicitly unset CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE\n      if process_encrypted_request() fails. This makes it more obvious that the\n      connection will not be reused. Previously serve() relied on\n      CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED being unset.\n      Inspired by a patch from Joshua Rogers (Opera).\n    - decompress_iob(): Add periods to a couple of log messages\n    - Terminate the body of the HTTP snipplets with a single new line\n      instead of \u0027\\r\\n\u0027.\n    - configure: Add --with-assertions option and only enable assertions\n      when it is used\n    - windows build: Use --with-brotli and --with-mbedtls by default and\n      enable dynamic error checking.\n    - gif_deanimate(): Confirm we\u0027ve got an image before trying to write it\n      Saves a pointless buf_copy() call.\n    - OpenSSL ssl_store_cert(): Remove a superfluous space before the serial number.\n\n  - Action file improvements:\n\n    - Disable fast-redirects for .golem.de/\n    - Unblock requests to adri*.\n    - Block requests for trc*.taboola.com/\n    - Disable fast-redirects for .linkedin.com/\n\n  - Filter file improvements:\n\n    - Make the second pcrs job of the img-reorder filter greedy again.\n      The ungreedy version broke the img tags on:\n      https://bulk.fefe.de/scalability/.\n\n  - Privoxy-Log-Parser:\n\n    - Highlight a few more messages.\n    - Clarify the --statistics output. The shown \u0027Reused connections\u0027\n      are server connections so name them appropriately.\n    - Bump version to 0.9.3.\n\n  - Privoxy-Regression-Test:\n\n    - Add the --check-bad-ssl option to the --help output.\n    - Bump version to 0.7.3.\n\n  - Documentation:\n\n    - Add pushing the created tag to the release steps in the developer manual.\n    - Clarify that \u0027debug 32768\u0027 should be used in addition to the other debug\n      directives when reporting problems.\n    - Add a \u0027Third-party licenses and copyrights\u0027 section to the user manual.\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-460",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0460-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0460-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6NB5FOTUR2SOWL7YMKEJTBMYYI245FRZ/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0460-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6NB5FOTUR2SOWL7YMKEJTBMYYI245FRZ/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1183129",
        "url": "https://bugzilla.suse.com/1183129"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20272 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20272/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20273 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20273/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20274 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20274/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20275 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20275/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20276 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20276/"
      }
    ],
    "title": "Security update for privoxy",
    "tracking": {
      "current_release_date": "2021-03-21T23:09:36Z",
      "generator": {
        "date": "2021-03-21T23:09:36Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0460-1",
      "initial_release_date": "2021-03-21T23:09:36Z",
      "revision_history": [
        {
          "date": "2021-03-21T23:09:36Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "privoxy-3.0.32-bp152.4.9.1.aarch64",
                "product": {
                  "name": "privoxy-3.0.32-bp152.4.9.1.aarch64",
                  "product_id": "privoxy-3.0.32-bp152.4.9.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "privoxy-doc-3.0.32-bp152.4.9.1.noarch",
                "product": {
                  "name": "privoxy-doc-3.0.32-bp152.4.9.1.noarch",
                  "product_id": "privoxy-doc-3.0.32-bp152.4.9.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "privoxy-3.0.32-bp152.4.9.1.ppc64le",
                "product": {
                  "name": "privoxy-3.0.32-bp152.4.9.1.ppc64le",
                  "product_id": "privoxy-3.0.32-bp152.4.9.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "privoxy-3.0.32-bp152.4.9.1.s390x",
                "product": {
                  "name": "privoxy-3.0.32-bp152.4.9.1.s390x",
                  "product_id": "privoxy-3.0.32-bp152.4.9.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "privoxy-3.0.32-bp152.4.9.1.x86_64",
                "product": {
                  "name": "privoxy-3.0.32-bp152.4.9.1.x86_64",
                  "product_id": "privoxy-3.0.32-bp152.4.9.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP2",
                "product": {
                  "name": "SUSE Package Hub 15 SP2",
                  "product_id": "SUSE Package Hub 15 SP2"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "privoxy-3.0.32-bp152.4.9.1.aarch64 as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64"
        },
        "product_reference": "privoxy-3.0.32-bp152.4.9.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "privoxy-3.0.32-bp152.4.9.1.ppc64le as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le"
        },
        "product_reference": "privoxy-3.0.32-bp152.4.9.1.ppc64le",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "privoxy-3.0.32-bp152.4.9.1.s390x as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x"
        },
        "product_reference": "privoxy-3.0.32-bp152.4.9.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "privoxy-3.0.32-bp152.4.9.1.x86_64 as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64"
        },
        "product_reference": "privoxy-3.0.32-bp152.4.9.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "privoxy-doc-3.0.32-bp152.4.9.1.noarch as component of SUSE Package Hub 15 SP2",
          "product_id": "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
        },
        "product_reference": "privoxy-doc-3.0.32-bp152.4.9.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-20272",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20272"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in privoxy before 3.0.32. An assertion failure could be triggered with a crafted CGI request leading to server crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
          "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20272",
          "url": "https://www.suse.com/security/cve/CVE-2021-20272"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1183129 for CVE-2021-20272",
          "url": "https://bugzilla.suse.com/1183129"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
            "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
            "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-03-21T23:09:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20272"
    },
    {
      "cve": "CVE-2021-20273",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20273"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
          "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20273",
          "url": "https://www.suse.com/security/cve/CVE-2021-20273"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1183129 for CVE-2021-20273",
          "url": "https://bugzilla.suse.com/1183129"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
            "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
            "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-03-21T23:09:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20273"
    },
    {
      "cve": "CVE-2021-20274",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20274"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
          "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20274",
          "url": "https://www.suse.com/security/cve/CVE-2021-20274"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1183129 for CVE-2021-20274",
          "url": "https://bugzilla.suse.com/1183129"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
            "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
            "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-03-21T23:09:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20274"
    },
    {
      "cve": "CVE-2021-20275",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20275"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in chunked_body_is_complete() leading to denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
          "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20275",
          "url": "https://www.suse.com/security/cve/CVE-2021-20275"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1183129 for CVE-2021-20275",
          "url": "https://bugzilla.suse.com/1183129"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
            "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
            "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-03-21T23:09:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20275"
    },
    {
      "cve": "CVE-2021-20276",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20276"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in privoxy before 3.0.32. Invalid memory access with an invalid pattern passed to pcre_compile() may lead to denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
          "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
          "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20276",
          "url": "https://www.suse.com/security/cve/CVE-2021-20276"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1183129 for CVE-2021-20276",
          "url": "https://bugzilla.suse.com/1183129"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
            "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.aarch64",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.ppc64le",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.s390x",
            "SUSE Package Hub 15 SP2:privoxy-3.0.32-bp152.4.9.1.x86_64",
            "SUSE Package Hub 15 SP2:privoxy-doc-3.0.32-bp152.4.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-03-21T23:09:36Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20276"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.