CVE ID: CVE-2019-9948
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVE ID: CVE-2019-20907
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u4
Description:  In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVE ID: CVE-2019-5010
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

CVE ID: CVE-2019-9636
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.

CVE ID: CVE-2019-9740
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.

CVE ID: CVE-2019-9947
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.

CVE ID: CVE-2018-14647
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u3
Description:  Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

CVE ID: CVE-2019-9947
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVE ID: CVE-2018-20852
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

CVE ID: CVE-2018-1061
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u3
Description:  python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.  An attacker could use this flaw to cause denial of service.

CVE ID: CVE-2019-9636
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Package Name:  wget  Version :  1.18-5+deb9u1

 Vulnerabilities

CVE ID: CVE-2018-0494
Severity:  Medium
Fixed in Version:  1.18-5+deb9u2
Description:  GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

CVE ID: CVE-2019-5953
Severity:  High
Fixed in Version:  1.18-5+deb9u3
Description:  Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors.

Package Name:  subversion  Version :  1.9.5-1+deb9u1

 Vulnerabilities

CVE ID: CVE-2018-11782
Severity:  Medium
Fixed in Version:  1.9.5-1+deb9u4
Description:  In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server.

CVE ID: CVE-2019-0203
Severity:  Medium
Fixed in Version:  1.9.5-1+deb9u4
Description:  In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.

Package Name:  perl  Version :  5.24.1-3+deb9u3

 Vulnerabilities

CVE ID: CVE-2018-18311
Severity:  High
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE ID: CVE-2020-10543
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u7
Description:  Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE ID: CVE-2018-18314
Severity:  High
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE ID: CVE-2020-10878
Severity:  High
Fixed in Version:  5.24.1-3+deb9u7
Description:  Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE ID: CVE-2018-12015
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u4
Description:  In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.

CVE ID: CVE-2020-12723
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u7
Description:  regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE ID: CVE-2018-18313
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE ID: CVE-2018-18312
Severity:  High
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

Package Name:  curl  Version :  7.52.1-5+deb9u5

 Vulnerabilities

CVE ID: CVE-2020-8231
Severity:  Unknown
Fixed in Version:  7.52.1-5+deb9u12
Description:

CVE ID: CVE-2020-8177
Severity:  Unknown
Fixed in Version:  7.52.1-5+deb9u11
Description:

CVE ID: CVE-2018-1000301
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u6
Description:  curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.

CVE ID: CVE-2018-14618
Severity:  Critical
Fixed in Version:  7.52.1-5+deb9u7
Description:  curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)

CVE ID: CVE-2019-3823
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u9
Description:  libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to smtp_endofresp() isn't NUL terminated and contains no character ending the parsed number, and len is set to 5, then the strtol() call reads beyond the allocated buffer. The read contents will not be returned to the caller.

CVE ID: CVE-2018-16890
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u9
Description:  libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (lib/vauth/ntlm.c:ntlm_decode_type2_target) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

CVE ID: CVE-2019-5436
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u10
Description:  A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

CVE ID: CVE-2019-3822
Severity:  High
Fixed in Version:  7.52.1-5+deb9u9
Description:  libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.

CVE ID: CVE-2018-16842
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u8
Description:  Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

CVE ID: CVE-2019-5482
Severity:  High
Fixed in Version:  7.52.1-5+deb9u10
Description:  Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

CVE ID: CVE-2019-5481
Severity:  High
Fixed in Version:  7.52.1-5+deb9u10
Description:  Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

CVE ID: CVE-2018-16839
Severity:  High
Fixed in Version:  7.52.1-5+deb9u8
Description:  Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

IBM Cloud Continuous Delivery Bill of Materials
 Download Bill of Materials Report: [JSON Format]
Bill of Materials Diff
Compare To: [Branch = master] [Commitid = 0682c32a61f48bd349f5c3793a3a32f0c6b665f4]

IBM Cloud Continuous Delivery Deployment Configuration Analysis
 No configuration risks discovered

IBM Cloud Continuous Delivery Bill of Materials
 Download Bill of Materials Report: [JSON Format]
Bill of Materials Diff
Compare To: [Branch = master] [Commitid = 0682c32a61f48bd349f5c3793a3a32f0c6b665f4]

IBM Cloud Continuous Delivery Deployment Configuration Analysis
 No configuration risks discovered

IBM Cloud Continuous Delivery Vulnerability Report

 :white_check_mark: Manifest File: Dockerfile-scratch:

Vulnerability Data by Clair
No OS package vulnerabilities found

 :white_check_mark: Manifest File: Gopkg.lock

Vulnerability Data by Snyk
No application package vulnerabilities found

 :x: Manifest File: Dockerfile-golang:1.10.1

Vulnerability Data by Clair
Package Name:  procps  Version :  2:3.3.12-3

 Vulnerabilities

CVE ID: CVE-2018-1123
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).

CVE ID: CVE-2018-1125
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.

CVE ID: CVE-2018-1126
Severity:  High
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.

CVE ID: CVE-2018-1124
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.

CVE ID: CVE-2018-1122
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.

Package Name:  git  Version :  1:2.11.0-3+deb9u2

 Vulnerabilities

CVE ID: CVE-2018-17456
Severity:  High
Fixed in Version:  1:2.11.0-3+deb9u4
Description:  Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

CVE ID: CVE-2019-1353
Severity:  High
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as "WSL") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.

CVE ID: CVE-2019-1387
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

CVE ID: CVE-2019-1349
Severity:  Critical
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.

CVE ID: CVE-2019-1348
Severity:  Low
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.

CVE ID: CVE-2019-1352
Severity:  Critical
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.

CVE ID: CVE-2018-11233
Severity:  Negligible
Fixed in Version:  1:2.11.0-3+deb9u3
Description:  In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.

CVE ID: CVE-2020-11008
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u7
Description:  Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where some credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching any URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's "store" helper - Git's "cache" helper - the "osxkeychain" helper that ships in Git's "contrib" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability.

CVE ID: CVE-2018-11235
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u3
Description:  In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

CVE ID: CVE-2020-5260
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u6
Description:  Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.

Package Name:  libgcrypt20  Version :  1.7.6-2+deb9u2

 Vulnerabilities

CVE ID: CVE-2018-0495
Severity:  Low
Fixed in Version:  1.7.6-2+deb9u3
Description:  Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Package Name:  mercurial  Version :  4.0-1+deb9u1

 Vulnerabilities

CVE ID: CVE-2018-1000132
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.

CVE ID: CVE-2018-13346
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

CVE ID: CVE-2018-13347
Severity:  High
Fixed in Version:  4.0-1+deb9u2
Description:  mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.

CVE ID: CVE-2017-17458
Severity:  Critical
Fixed in Version:  4.0-1+deb9u2
Description:  In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.

CVE ID: CVE-2019-3902
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.

CVE ID: CVE-2018-13348
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.

Package Name:  python2.7  Version :  2.7.13-2+deb9u2

 Vulnerabilities

CVE ID: CVE-2019-20907
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u4
Description:  In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVE ID: CVE-2019-9636
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVE ID: CVE-2018-20852
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

CVE ID: CVE-2019-20907
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u4
Description:  In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVE ID: CVE-2018-1000802
Severity:  Negligible
Fixed in Version:  2.7.13-2+deb9u3
Description:  Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.

CVE ID: CVE-2019-16056
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

CVE ID: CVE-2019-9636
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.

CVE ID: CVE-2019-9948
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVE ID: CVE-2018-1061
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u3
Description:  python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.  An attacker could use this flaw to cause denial of service.

CVE ID: CVE-2019-9740
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVE ID: CVE-2019-9947
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVE ID: CVE-2018-14647
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u3
Description:  Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

CVE ID: CVE-2019-9740
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.

CVE ID: CVE-2019-9947
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.

CVE ID: CVE-2019-5010
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

CVE ID: CVE-2018-1060
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u3
Description:  python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

Package Name:  openssl  Version :  1.1.0f-3+deb9u2

 Vulnerabilities

CVE ID: CVE-2018-0734
Severity:  Medium
Fixed in Version:  1.1.0j-1~deb9u1
Description:  The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

CVE ID: CVE-2019-1563
Severity:  Medium
Fixed in Version:  1.1.0l-1~deb9u1
Description:  In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

CVE ID: CVE-2018-0737
Severity:  Low
Fixed in Version:  1.1.0j-1~deb9u1
Description:  The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).

CVE ID: CVE-2018-0732
Severity:  Low
Fixed in Version:  1.1.0j-1~deb9u1
Description:  During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

CVE ID: CVE-2019-1547
Severity:  Low
Fixed in Version:  1.1.0l-1~deb9u1
Description:  Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

CVE ID: CVE-2019-1543
Severity:  Low
Fixed in Version:  1.1.0k-1~deb9u1
Description:  ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).

CVE ID: CVE-2018-5407
Severity:  Low
Fixed in Version:  1.1.0j-1~deb9u1
Description:  Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

CVE ID: CVE-2018-0735
Severity:  Negligible
Fixed in Version:  1.1.0j-1~deb9u1
Description:  The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).

Package Name:  apt  Version :  1.4.8

 Vulnerabilities

CVE ID: CVE-2019-3462
Severity:  Critical
Fixed in Version:  1.4.9
Description:  Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.

CVE ID: CVE-2020-3810
Severity:  Medium
Fixed in Version:  1.4.10
Description:  Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files.

Package Name:  e2fsprogs  Version :  1.43.4-2

 Vulnerabilities

CVE ID: CVE-2019-5188
Severity:  Medium
Fixed in Version:  1.43.4-2+deb9u2
Description:  A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVE ID: CVE-2019-5094
Severity:  Medium
Fixed in Version:  1.43.4-2+deb9u1
Description:  An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Package Name:  subversion  Version :  1.9.5-1+deb9u1

 Vulnerabilities

CVE ID: CVE-2019-0203
Severity:  Medium
Fixed in Version:  1.9.5-1+deb9u4
Description:  In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.

CVE ID: CVE-2018-11782
Severity:  Medium
Fixed in Version:  1.9.5-1+deb9u4
Description:  In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server.

Package Name:  wget  Version :  1.18-5+deb9u1

 Vulnerabilities

CVE ID: CVE-2019-5953
Severity:  High
Fixed in Version:  1.18-5+deb9u3
Description:  Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors.

CVE ID: CVE-2018-0494
Severity:  Medium
Fixed in Version:  1.18-5+deb9u2
Description:  GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Package Name:  perl  Version :  5.24.1-3+deb9u3

 Vulnerabilities

CVE ID: CVE-2020-12723
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u7
Description:  regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE ID: CVE-2020-10878
Severity:  High
Fixed in Version:  5.24.1-3+deb9u7
Description:  Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE ID: CVE-2018-12015
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u4
Description:  In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.

CVE ID: CVE-2018-18313
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE ID: CVE-2018-18311
Severity:  High
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE ID: CVE-2020-10543
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u7
Description:  Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE ID: CVE-2018-18314
Severity:  High
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE ID: CVE-2018-18312
Severity:  High
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

Package Name:  curl  Version :  7.52.1-5+deb9u5

 Vulnerabilities

CVE ID: CVE-2019-3822
Severity:  High
Fixed in Version:  7.52.1-5+deb9u9
Description:  libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.

CVE ID: CVE-2018-14618
Severity:  Critical
Fixed in Version:  7.52.1-5+deb9u7
Description:  curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)

CVE ID: CVE-2018-1000301
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u6
Description:  curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.

CVE ID: CVE-2019-5481
Severity:  High
Fixed in Version:  7.52.1-5+deb9u10
Description:  Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

CVE ID: CVE-2020-8177
Severity:  Unknown
Fixed in Version:  7.52.1-5+deb9u11
Description:

CVE ID: CVE-2018-16890
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u9
Description:  libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (lib/vauth/ntlm.c:ntlm_decode_type2_target) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

CVE ID: CVE-2019-5436
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u10
Description:  A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

CVE ID: CVE-2019-5482
Severity:  High
Fixed in Version:  7.52.1-5+deb9u10
Description:  Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

CVE ID: CVE-2018-16839
Severity:  High
Fixed in Version:  7.52.1-5+deb9u8
Description:  Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

CVE ID: CVE-2018-16842
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u8
Description:  Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

CVE ID: CVE-2020-8231
Severity:  Unknown
Fixed in Version:  7.52.1-5+deb9u12
Description:

CVE ID: CVE-2019-3823
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u9
Description:  libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to smtp_endofresp() isn't NUL terminated and contains no character ending the parsed number, and len is set to 5, then the strtol() call reads beyond the allocated buffer. The read contents will not be returned to the caller.

IBM Cloud Continuous Delivery Deployment Configuration Analysis
 No configuration risks discovered

IBM Cloud Continuous Delivery Bill of Materials
 Download Bill of Materials Report: [JSON Format]
Bill of Materials Diff
Compare To: [Branch = master] [Commitid = 0682c32a61f48bd349f5c3793a3a32f0c6b665f4]

IBM Cloud Continuous Delivery Vulnerability Report

 :white_check_mark: Manifest File: Dockerfile-scratch:

Vulnerability Data by Clair
No OS package vulnerabilities found

 :white_check_mark: Manifest File: Gopkg.lock

Vulnerability Data by Snyk
No application package vulnerabilities found

 :x: Manifest File: Dockerfile-golang:1.10.1

Vulnerability Data by Clair
Package Name:  procps  Version :  2:3.3.12-3

 Vulnerabilities

CVE ID: CVE-2018-1126
Severity:  High
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.

CVE ID: CVE-2018-1124
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.

CVE ID: CVE-2018-1122
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.

CVE ID: CVE-2018-1123
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).

CVE ID: CVE-2018-1125
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.

Package Name:  libgcrypt20  Version :  1.7.6-2+deb9u2

 Vulnerabilities

CVE ID: CVE-2018-0495
Severity:  Low
Fixed in Version:  1.7.6-2+deb9u3
Description:  Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Package Name:  git  Version :  1:2.11.0-3+deb9u2

 Vulnerabilities

CVE ID: CVE-2019-1352
Severity:  Critical
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.

CVE ID: CVE-2020-11008
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u7
Description:  Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where some credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching any URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's "store" helper - Git's "cache" helper - the "osxkeychain" helper that ships in Git's "contrib" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability.

CVE ID: CVE-2019-1353
Severity:  High
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as "WSL") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.

CVE ID: CVE-2019-1349
Severity:  Critical
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.

CVE ID: CVE-2019-1348
Severity:  Low
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.

CVE ID: CVE-2020-5260
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u6
Description:  Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.

CVE ID: CVE-2018-17456
Severity:  High
Fixed in Version:  1:2.11.0-3+deb9u4
Description:  Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

CVE ID: CVE-2019-1387
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

CVE ID: CVE-2018-11233
Severity:  Negligible
Fixed in Version:  1:2.11.0-3+deb9u3
Description:  In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.

CVE ID: CVE-2018-11235
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u3
Description:  In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

Package Name:  mercurial  Version :  4.0-1+deb9u1

 Vulnerabilities

CVE ID: CVE-2018-13348
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.

CVE ID: CVE-2018-13346
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

CVE ID: CVE-2018-1000132
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.

CVE ID: CVE-2017-17458
Severity:  Critical
Fixed in Version:  4.0-1+deb9u2
Description:  In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.

CVE ID: CVE-2019-3902
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.

CVE ID: CVE-2018-13347
Severity:  High
Fixed in Version:  4.0-1+deb9u2
Description:  mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.

Package Name:  python2.7  Version :  2.7.13-2+deb9u2

 Vulnerabilities

CVE ID: CVE-2019-9948
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVE ID: CVE-2019-9636
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVE ID: CVE-2018-14647
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u3
Description:  Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

CVE ID: CVE-2019-20907
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u4
Description:  In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVE ID: CVE-2019-9636
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.

CVE ID: CVE-2018-20852
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

CVE ID: CVE-2019-9947
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.

CVE ID: CVE-2019-9947
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVE ID: CVE-2019-9740
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.

CVE ID: CVE-2018-1060
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u3
Description:  python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

CVE ID: CVE-2019-9740
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVE ID: CVE-2019-5010
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

CVE ID: CVE-2019-20907
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u4
Description:  In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVE ID: CVE-2018-1061
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u3
Description:  python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.  An attacker could use this flaw to cause denial of service.

CVE ID: CVE-2018-1000802
Severity:  Negligible
Fixed in Version:  2.7.13-2+deb9u3
Description:  Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.

CVE ID: CVE-2019-16056
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

Package Name:  apt  Version :  1.4.8

 Vulnerabilities

CVE ID: CVE-2020-3810
Severity:  Medium
Fixed in Version:  1.4.10
Description:  Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files.

CVE ID: CVE-2019-3462
Severity:  Critical
Fixed in Version:  1.4.9
Description:  Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.

Package Name:  openssl  Version :  1.1.0f-3+deb9u2

 Vulnerabilities

CVE ID: CVE-2018-0737
Severity:  Low
Fixed in Version:  1.1.0j-1~deb9u1
Description:  The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).

CVE ID: CVE-2018-0734
Severity:  Medium
Fixed in Version:  1.1.0j-1~deb9u1
Description:  The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

CVE ID: CVE-2019-1547
Severity:  Low
Fixed in Version:  1.1.0l-1~deb9u1
Description:  Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

CVE ID: CVE-2018-0735
Severity:  Negligible
Fixed in Version:  1.1.0j-1~deb9u1
Description:  The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).

CVE ID: CVE-2019-1563
Severity:  Medium
Fixed in Version:  1.1.0l-1~deb9u1
Description:  In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

CVE ID: CVE-2018-5407
Severity:  Low
Fixed in Version:  1.1.0j-1~deb9u1
Description:  Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

CVE ID: CVE-2019-1543
Severity:  Low
Fixed in Version:  1.1.0k-1~deb9u1
Description:  ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).

CVE ID: CVE-2018-0732
Severity:  Low
Fixed in Version:  1.1.0j-1~deb9u1
Description:  During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

Package Name:  e2fsprogs  Version :  1.43.4-2

 Vulnerabilities

CVE ID: CVE-2019-5188
Severity:  Medium
Fixed in Version:  1.43.4-2+deb9u2
Description:  A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVE ID: CVE-2019-5094
Severity:  Medium
Fixed in Version:  1.43.4-2+deb9u1
Description:  An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Package Name:  subversion  Version :  1.9.5-1+deb9u1

 Vulnerabilities

CVE ID: CVE-2019-0203
Severity:  Medium
Fixed in Version:  1.9.5-1+deb9u4
Description:  In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.

CVE ID: CVE-2018-11782
Severity:  Medium
Fixed in Version:  1.9.5-1+deb9u4
Description:  In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server.

Package Name:  wget  Version :  1.18-5+deb9u1

 Vulnerabilities

CVE ID: CVE-2019-5953
Severity:  High
Fixed in Version:  1.18-5+deb9u3
Description:  Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors.

CVE ID: CVE-2018-0494
Severity:  Medium
Fixed in Version:  1.18-5+deb9u2
Description:  GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

Package Name:  curl  Version :  7.52.1-5+deb9u5

 Vulnerabilities

CVE ID: CVE-2018-16839
Severity:  High
Fixed in Version:  7.52.1-5+deb9u8
Description:  Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

CVE ID: CVE-2020-8177
Severity:  Unknown
Fixed in Version:  7.52.1-5+deb9u11
Description:

CVE ID: CVE-2018-14618
Severity:  Critical
Fixed in Version:  7.52.1-5+deb9u7
Description:  curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)

CVE ID: CVE-2018-16842
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u8
Description:  Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

CVE ID: CVE-2019-3823
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u9
Description:  libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to smtp_endofresp() isn't NUL terminated and contains no character ending the parsed number, and len is set to 5, then the strtol() call reads beyond the allocated buffer. The read contents will not be returned to the caller.

CVE ID: CVE-2018-1000301
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u6
Description:  curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.

CVE ID: CVE-2019-3822
Severity:  High
Fixed in Version:  7.52.1-5+deb9u9
Description:  libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.

CVE ID: CVE-2019-5436
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u10
Description:  A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

CVE ID: CVE-2018-16890
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u9
Description:  libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (lib/vauth/ntlm.c:ntlm_decode_type2_target) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

CVE ID: CVE-2019-5482
Severity:  High
Fixed in Version:  7.52.1-5+deb9u10
Description:  Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

CVE ID: CVE-2020-8231
Severity:  Unknown
Fixed in Version:  7.52.1-5+deb9u12
Description:

CVE ID: CVE-2019-5481
Severity:  High
Fixed in Version:  7.52.1-5+deb9u10
Description:  Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

Package Name:  perl  Version :  5.24.1-3+deb9u3

 Vulnerabilities

CVE ID: CVE-2018-18311
Severity:  High
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE ID: CVE-2018-12015
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u4
Description:  In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.

CVE ID: CVE-2020-10878
Severity:  High
Fixed in Version:  5.24.1-3+deb9u7
Description:  Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE ID: CVE-2020-10543
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u7
Description:  Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE ID: CVE-2018-18313
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE ID: CVE-2020-12723
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u7
Description:  regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE ID: CVE-2018-18312
Severity:  High
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE ID: CVE-2018-18314
Severity:  High
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

IBM Cloud Continuous Delivery Bill of Materials
 Download Bill of Materials Report: [JSON Format]
Bill of Materials Diff
Compare To: [Branch = master] [Commitid = 0682c32a61f48bd349f5c3793a3a32f0c6b665f4]

IBM Cloud Continuous Delivery Deployment Configuration Analysis
 No configuration risks discovered

IBM Cloud Continuous Delivery Vulnerability Report

 :white_check_mark: Manifest File: Dockerfile-scratch:

Vulnerability Data by Clair
No OS package vulnerabilities found

 :white_check_mark: Manifest File: Gopkg.lock

Vulnerability Data by Snyk
No application package vulnerabilities found

 :x: Manifest File: Dockerfile-golang:1.10.1

Vulnerability Data by Clair
Package Name:  procps  Version :  2:3.3.12-3

 Vulnerabilities

CVE ID: CVE-2018-1123
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).

CVE ID: CVE-2018-1125
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.

CVE ID: CVE-2018-1126
Severity:  High
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.

CVE ID: CVE-2018-1124
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.

CVE ID: CVE-2018-1122
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.

Package Name:  libgcrypt20  Version :  1.7.6-2+deb9u2

 Vulnerabilities

CVE ID: CVE-2018-0495
Severity:  Low
Fixed in Version:  1.7.6-2+deb9u3
Description:  Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Package Name:  git  Version :  1:2.11.0-3+deb9u2

 Vulnerabilities

CVE ID: CVE-2019-1387
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

CVE ID: CVE-2018-11233
Severity:  Negligible
Fixed in Version:  1:2.11.0-3+deb9u3
Description:  In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.

CVE ID: CVE-2018-11235
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u3
Description:  In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

CVE ID: CVE-2018-17456
Severity:  High
Fixed in Version:  1:2.11.0-3+deb9u4
Description:  Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

CVE ID: CVE-2019-1348
Severity:  Low
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.

CVE ID: CVE-2019-1352
Severity:  Critical
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.

CVE ID: CVE-2019-1349
Severity:  Critical
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.

CVE ID: CVE-2020-5260
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u6
Description:  Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.

CVE ID: CVE-2020-11008
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u7
Description:  Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where some credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching any URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's "store" helper - Git's "cache" helper - the "osxkeychain" helper that ships in Git's "contrib" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability.

CVE ID: CVE-2019-1353
Severity:  High
Fixed in Version:  1:2.11.0-3+deb9u5
Description:  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as "WSL") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.

Package Name:  openssl  Version :  1.1.0f-3+deb9u2

 Vulnerabilities

CVE ID: CVE-2019-1547
Severity:  Low
Fixed in Version:  1.1.0l-1~deb9u1
Description:  Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

CVE ID: CVE-2018-0734
Severity:  Medium
Fixed in Version:  1.1.0j-1~deb9u1
Description:  The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

CVE ID: CVE-2018-5407
Severity:  Low
Fixed in Version:  1.1.0j-1~deb9u1
Description:  Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

CVE ID: CVE-2018-0732
Severity:  Low
Fixed in Version:  1.1.0j-1~deb9u1
Description:  During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

CVE ID: CVE-2019-1543
Severity:  Low
Fixed in Version:  1.1.0k-1~deb9u1
Description:  ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).

CVE ID: CVE-2018-0735
Severity:  Negligible
Fixed in Version:  1.1.0j-1~deb9u1
Description:  The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).

CVE ID: CVE-2018-0737
Severity:  Low
Fixed in Version:  1.1.0j-1~deb9u1
Description:  The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).

CVE ID: CVE-2019-1563
Severity:  Medium
Fixed in Version:  1.1.0l-1~deb9u1
Description:  In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

Package Name:  python2.7  Version :  2.7.13-2+deb9u2

 Vulnerabilities

CVE ID: CVE-2019-9740
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVE ID: CVE-2019-9740
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.

CVE ID: CVE-2018-1000802
Severity:  Negligible
Fixed in Version:  2.7.13-2+deb9u3
Description:  Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.

CVE ID: CVE-2019-16056
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

CVE ID: CVE-2018-1060
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u3
Description:  python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

CVE ID: CVE-2019-9636
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.

CVE ID: CVE-2018-14647
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u3
Description:  Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

CVE ID: CVE-2019-9947
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVE ID: CVE-2019-20907
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u4
Description:  In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVE ID: CVE-2018-1061
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u3
Description:  python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.  An attacker could use this flaw to cause denial of service.

CVE ID: CVE-2019-5010
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

CVE ID: CVE-2019-20907
Severity:  Low
Fixed in Version:  2.7.13-2+deb9u4
Description:  In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVE ID: CVE-2018-20852
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

CVE ID: CVE-2019-9948
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVE ID: CVE-2019-9947
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.

CVE ID: CVE-2019-9636
Severity:  Medium
Fixed in Version:  2.7.13-2+deb9u4
Description:  Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

Package Name:  mercurial  Version :  4.0-1+deb9u1

 Vulnerabilities

CVE ID: CVE-2018-13348
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.

CVE ID: CVE-2018-13347
Severity:  High
Fixed in Version:  4.0-1+deb9u2
Description:  mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.

CVE ID: CVE-2017-17458
Severity:  Critical
Fixed in Version:  4.0-1+deb9u2
Description:  In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.

CVE ID: CVE-2019-3902
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.

CVE ID: CVE-2018-13346
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

CVE ID: CVE-2018-1000132
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.

Package Name:  e2fsprogs  Version :  1.43.4-2

 Vulnerabilities

CVE ID: CVE-2019-5188
Severity:  Medium
Fixed in Version:  1.43.4-2+deb9u2
Description:  A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVE ID: CVE-2019-5094
Severity:  Medium
Fixed in Version:  1.43.4-2+deb9u1
Description:  An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Package Name:  apt  Version :  1.4.8

 Vulnerabilities

CVE ID: CVE-2019-3462
Severity:  Critical
Fixed in Version:  1.4.9
Description:  Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.

CVE ID: CVE-2020-3810
Severity:  Medium
Fixed in Version:  1.4.10
Description:  Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files.

Package Name:  wget  Version :  1.18-5+deb9u1

 Vulnerabilities

CVE ID: CVE-2018-0494
Severity:  Medium
Fixed in Version:  1.18-5+deb9u2
Description:  GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.

CVE ID: CVE-2019-5953
Severity:  High
Fixed in Version:  1.18-5+deb9u3
Description:  Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors.

Package Name:  subversion  Version :  1.9.5-1+deb9u1

 Vulnerabilities

CVE ID: CVE-2018-11782
Severity:  Medium
Fixed in Version:  1.9.5-1+deb9u4
Description:  In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server.

CVE ID: CVE-2019-0203
Severity:  Medium
Fixed in Version:  1.9.5-1+deb9u4
Description:  In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.

Package Name:  perl  Version :  5.24.1-3+deb9u3

 Vulnerabilities

CVE ID: CVE-2018-12015
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u4
Description:  In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.

CVE ID: CVE-2020-12723
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u7
Description:  regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE ID: CVE-2018-18312
Severity:  High
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE ID: CVE-2020-10878
Severity:  High
Fixed in Version:  5.24.1-3+deb9u7
Description:  Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE ID: CVE-2018-18313
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE ID: CVE-2020-10543
Severity:  Medium
Fixed in Version:  5.24.1-3+deb9u7
Description:  Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE ID: CVE-2018-18314
Severity:  High
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE ID: CVE-2018-18311
Severity:  High
Fixed in Version:  5.24.1-3+deb9u5
Description:  Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

Package Name:  curl  Version :  7.52.1-5+deb9u5

 Vulnerabilities

CVE ID: CVE-2020-8231
Severity:  Unknown
Fixed in Version:  7.52.1-5+deb9u12
Description:

CVE ID: CVE-2019-5481
Severity:  High
Fixed in Version:  7.52.1-5+deb9u10
Description:  Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

CVE ID: CVE-2018-14618
Severity:  Critical
Fixed in Version:  7.52.1-5+deb9u7
Description:  curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)

CVE ID: CVE-2019-5436
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u10
Description:  A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

CVE ID: CVE-2019-5482
Severity:  High
Fixed in Version:  7.52.1-5+deb9u10
Description:  Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

CVE ID: CVE-2018-16839
Severity:  High
Fixed in Version:  7.52.1-5+deb9u8
Description:  Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

CVE ID: CVE-2020-8177
Severity:  Unknown
Fixed in Version:  7.52.1-5+deb9u11
Description:

CVE ID: CVE-2019-3823
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u9
Description:  libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to smtp_endofresp() isn't NUL terminated and contains no character ending the parsed number, and len is set to 5, then the strtol() call reads beyond the allocated buffer. The read contents will not be returned to the caller.

CVE ID: CVE-2018-1000301
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u6
Description:  curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.

CVE ID: CVE-2019-3822
Severity:  High
Fixed in Version:  7.52.1-5+deb9u9
Description:  libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.

CVE ID: CVE-2018-16842
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u8
Description:  Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

CVE ID: CVE-2018-16890
Severity:  Medium
Fixed in Version:  7.52.1-5+deb9u9
Description:  libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (lib/vauth/ntlm.c:ntlm_decode_type2_target) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

IBM Cloud Continuous Delivery Bill of Materials
 Download Bill of Materials Report: [JSON Format]
Bill of Materials Diff
Compare To: [Branch = master] [Commitid = 0682c32a61f48bd349f5c3793a3a32f0c6b665f4]

IBM Cloud Continuous Delivery Deployment Configuration Analysis
 No configuration risks discovered

IBM Cloud Continuous Delivery Vulnerability Report

 :white_check_mark: Manifest File: Dockerfile-scratch:

Vulnerability Data by Clair
No OS package vulnerabilities found

 :white_check_mark: Manifest File: Gopkg.lock

Vulnerability Data by Snyk
No application package vulnerabilities found

 :x: Manifest File: Dockerfile-golang:1.10.1

Vulnerability Data by Clair
Package Name:  procps  Version :  2:3.3.12-3

 Vulnerabilities

CVE ID: CVE-2018-1123
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).

CVE ID: CVE-2018-1125
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.

CVE ID: CVE-2018-1126
Severity:  High
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.

CVE ID: CVE-2018-1124
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.

CVE ID: CVE-2018-1122
Severity:  Medium
Fixed in Version:  2:3.3.12-3+deb9u1
Description:  procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.

Package Name:  libgcrypt20  Version :  1.7.6-2+deb9u2

 Vulnerabilities

CVE ID: CVE-2018-0495
Severity:  Low
Fixed in Version:  1.7.6-2+deb9u3
Description:  Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Package Name:  mercurial  Version :  4.0-1+deb9u1

 Vulnerabilities

CVE ID: CVE-2017-17458
Severity:  Critical
Fixed in Version:  4.0-1+deb9u2
Description:  In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.

CVE ID: CVE-2018-13348
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.

CVE ID: CVE-2018-1000132
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.

CVE ID: CVE-2019-3902
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.

CVE ID: CVE-2018-13346
Severity:  Medium
Fixed in Version:  4.0-1+deb9u2
Description:  The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

CVE ID: CVE-2018-13347
Severity:  High
Fixed in Version:  4.0-1+deb9u2
Description:  mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.

Package Name:  git  Version :  1:2.11.0-3+deb9u2

 Vulnerabilities

CVE ID: CVE-2018-11235
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u3
Description:  In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

CVE ID: CVE-2020-11008
Severity:  Medium
Fixed in Version:  1:2.11.0-3+deb9u7