CVE-2017-5929

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderClient class in logback-classic and the SocketNode classes in logback-classic and logback-access allow data to be deserialized over a Java Socket, via an ObjectInputStream, without validating the data beforehand. When data is received from the Socket, to be logged, it is deserialized into Java objects.An attacker can exploit this vulnerability by sending malicious, serialized Java objects over the connection to the Socket, which may result in execution of arbitrary code when those objects are deserialized. Note that although logback-core is implicated by the Logback project here, the Sonatype Security Research team discovered that the vulnerability is actually present in the logback-classic and logback-access components. Versions prior to 1.2.0 are vulnerable, as stated in the advisory.

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.

TuxCare rebuilt 2 ch.qos.logback packages to address 4 CVEs. Fixed in 1.1.7-tuxcare.1.

It was found that logback is vulnerable to a deserialization issue. Logback can be configured to allow remote logging through SocketServer/ServerSocketReceiver interfaces that can accept untrusted serialized data. Authenticated attackers on the adjacent network can leverage this vulnerability to execute arbitrary code through deserialization of custom gadget chains (CVE-2017-5929).

Root has patched CVE-2017-5929 in the io.root.ch.qos.logback:logback-classic package for Root:Maven. Multiple fixed versions available.

This update for ardana-cobbler, cassandra, cassandra-kit, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-heat-templates, openstack-monasca-installer, openstack-nova, python-Django, python-elementpath, python-eventlet, python-py, python-pysaml2, python-six, python-xmlschema fixes the following issues:

Security fixes included on this update:

cassandra-kit:

• CVE-2020-17516: Internode encryption enforcement vulnerability

cassandra:

• CVE-2020-17516: Internode encryption enforcement vulnerability
• CVE-2017-5929 logback: Fixed a serialization vulnerability in SocketServer and ServerSocketReceiver

crowbar-core: CVE-2020-26247: Potentially XXE or SSRF attacks by parsed Nokogiri::XML::Schema

grafana:

• CVE-2021-27358: Unauthenticated remote attackers to trigger a Denial of Service via a remote API call

kibana:

• CVE-2017-11481: Fixed an XSS via URL fields
• CVE-2017-11499: Fixed a constant hashtable seeds vulnerability

python-Django:

• CVE-2021-28658: Potential directory-traversal via uploaded files
• CVE-2021-31542: Potential directory-traversal via uploaded files
• CVE-2021-33203: Potential directory traversal via admindocs
• CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
• CVE-2021-23336: Fixed web cache poisoning via django.utils.http.limited_parse_qsl

python-eventlet:

• CVE-2021-21419: Improper handling of highly compressed data and memory allocation with excessive size value

python-pysaml2:

• CVE-2021-21238: Fixed an improper verification of cryptographic signatures for signed SAML documents
• CVE-2021-21239: Fixed an improper verification of cryptographic signatures when using CryptoBackendXmlSec1()_

python-py:

• CVE-2020-29651: Regular expression denial of service in svnwc.py

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a hijack sessions by using timing attacks targeting the session id CVE-2019-16782

Non-security fixes included on this update:

Changes in ardana-cobbler:

• Update to version 8.0+git.1614096566.e8c2b27:
  • Change install_recommended to true (bsc#1181828)

Changes in cassandra:

• update to 3.11.10 (bsc#1181689, CVE-2020-17516)

• Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)
• Reduce amount of allocations during batch statement execution (CASSANDRA-16201)
• Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)
• Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)
• Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)
• SASI's max_compaction_flush_memory_in_mb settings over 100GB revert to default of 1GB (CASSANDRA-16071)
• Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)
• Improve empty hint file handling during startup (CASSANDRA-16162)
• Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)
• Fix skipping on pre-3.0 created compact storage sstables due to missing primary key liveness (CASSANDRA-16226)
• Extend the exclusion of replica filtering protection to other indices instead of just SASI (CASSANDRA-16311)
• Synchronize transaction logs for JBOD (CASSANDRA-16225)
• Fix the counting of cells per partition (CASSANDRA-16259)
• Fix serial read/non-applying CAS linearizability (CASSANDRA-12126)
• Avoid potential NPE in JVMStabilityInspector (CASSANDRA-16294)
• Improved check of num_tokens against the length of initial_token (CASSANDRA-14477)
• Fix a race condition on ColumnFamilyStore and TableMetrics (CASSANDRA-16228)
• Remove the SEPExecutor blocking behavior (CASSANDRA-16186)
• Fix invalid cell value skipping when reading from disk (CASSANDRA-16223)
• Prevent invoking enable/disable gossip when not in NORMAL (CASSANDRA-16146)
• Wait for schema agreement when bootstrapping (CASSANDRA-15158)
• Fix the histogram merge of the table metrics (CASSANDRA-16259)
• Synchronize Keyspace instance store/clear…