Security Leftovers

posted by Roy Schestowitz on Dec 10, 2024

• LWN ☛ Security updates for Monday

  Security updates have been issued by AlmaLinux (redis:7, ruby, ruby:2.5, and ruby:3.1), Debian (avahi, ceph, chromium, gsl, jinja2, php7.4, renderdoc, ruby-doorkeeper, and zabbix), Fedora (chromium, python3.11, and uv), Gentoo (Asterisk, Cacti, Chromium, Surveillance Giant Google Chrome, Abusive Monopolist Microsoft Edge. Opera, Dnsmasq, firefox, HashiCorp Consul, icinga2, OATH Toolkit, OpenJDK, PostgreSQL, R, Salt, Spidermonkey, and thunderbird), Mageia (kubernetes), Red Hat (grafana, grafana-pcp, osbuild-composer, and postgresql), SUSE (ansible-core, firefox, glib2, java-1_8_0-ibm, kernel-firmware, nanopb, netty, python310-django-ckeditor, python310-jupyter-ydoc, radare2, skopeo, and webkit2gtk3), and Ubuntu (tinyproxy).

• Trail of Bits ☛ 35 more Semgrep rules: infrastructure, supply chain, and Ruby

  We are publishing another set of custom Semgrep rules, bringing our total number of public rules to 115.

• PCLinuxOS

  • PCLOS Official ☛ PCLinuxOS Recent Updates

• Devices/Embedded

  • The Register UK ☛ OpenWrt supply chain attack scare prompts urgent upgrades

    Spooren wrote: "Due to the combination of the command injection in the 'openwrt/imagebuilder' image and the truncated SHA-256 hash included in the build request hash, an attacker can pollute the legitimate image by providing a package list that causes the hash collision."

  • Security Week ☛ Critical OpenWrt Flaw Exposes Firmware Update Server to Exploitation

    The OpenWrt Project, an open-source initiative providing a Linux-based operating system for embedded devices, has pushed a critical patch to cover flaws that expose its firmware update server to malicious exploitation.

    The vulnerability, tracked as CVE-2024-54143, affects the OpenWrt sysupgrade server and exposes users to potential risks of installing compromised firmware images.

  • LWN ☛ A vulnerability in the OpenWrt attended sysupgrade server

    The OpenWrt project has issued an

    advisory regarding a vulnerability found in its Attended Sysupgrade

    Server that could allow compromised packages to be installed on a router by

    an attacker. No official OpenWrt images were affected, and the

    vulnerability is not known to be exploited, but users who have installed

    images created with an instance of this server are recommended to

    reinstall.