CVE-2021-20275

A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in chunked_body_is_complete() leading to denial of service.

A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in chunked_body_is_complete() leading to denial of service.

This update for privoxy fixes the following issues:

Update to version 3.0.32:

• Security/Reliability (boo#1183129)

  • ssplit(): Remove an assertion that could be triggered with a crafted CGI request. Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272 Reported by: Joshua Rogers (Opera)
  • cgi_send_banner(): Overrule invalid image types. Prevents a crash with a crafted CGI request if Privoxy is toggled off. Commit e711c505c48. OVE-20210206-0001. CVE-2021-20273 Reported by: Joshua Rogers (Opera)
  • socks5_connect(): Don't try to send credentials when none are configured. Fixes a crash due to a NULL-pointer dereference when the socks server misbehaves. Commit 85817cc55b9. OVE-20210207-0001. CVE-2021-20274 Reported by: Joshua Rogers (Opera)
  • chunked_body_is_complete(): Prevent an invalid read of size two. Commit a912ba7bc9c. OVE-20210205-0001. CVE-2021-20275 Reported by: Joshua Rogers (Opera)
  • Obsolete pcre: Prevent invalid memory accesses with an invalid pattern passed to pcre_compile(). Note that the obsolete pcre code is scheduled to be removed before the 3.0.33 release. There has been a warning since 2008 already. Commit 28512e5b624. OVE-20210222-0001. CVE-2021-20276 Reported by: Joshua Rogers (Opera)

• Bug fixes:

  • Properly parse the client-tag-lifetime directive. Previously it was not accepted as an obsolete hash value was being used. Reported by: Joshua Rogers (Opera)
  • decompress_iob(): Prevent reading of uninitialized data. Reported by: Joshua Rogers (Opera).
  • decompress_iob(): Don't advance cur past eod when looking for the end of the file name and comment.
  • decompress_iob(): Cast value to unsigned char before shifting. Prevents a left-shift of a negative value which is undefined behaviour. Reported by: Joshua Rogers (Opera)
  • gif_deanimate(): Confirm that that we have enough data before doing any work. Fixes a crash when fuzzing with an empty document. Reported by: Joshua Rogers (Opera).
  • buf_copy(): Fail if there's no data to write or nothing to do. Prevents undefined behaviour 'applying zero offset to null pointer'. Reported by: Joshua Rogers (Opera)
  • log_error(): Treat LOG_LEVEL_FATAL as fatal even when --stfu is being used while fuzzing. Reported by: Joshua Rogers (Opera).
  • Respect DESTDIR when considering whether or not to install config files with '.new' extension.
  • OpenSSL ssl_store_cert(): Fix two error messages.
  • Fix a couple of format specifiers.
  • Silence compiler warnings when compiling with NDEBUG.
  • fuzz_server_header(): Fix compiler warning.
  • fuzz_client_header(): Fix compiler warning.
  • cgi_send_user_manual(): Also reject requests if the user-manual directive specifies a https:// URL. Previously Privoxy would try and fail to open a local file.

• General improvements:

  • Log the TLS version and the the cipher when debug 2 is enabled.
  • ssl_send_certificate_error(): Respect HEAD requests by not sending a body.
  • ssl_send_certificate_error(): End the body with a single new line.
  • serve(): Increase the chances that the host is logged when closing a server socket.
  • handle_established_connection(): Add parentheses to clarify an expression Suggested by: David Binderman
  • continue_https_chat(): Explicitly unset CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE if process_encrypted_request() fails. This makes it more obvious that the connection will not be reused. Previously serve() relied on CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED being unset. Inspired by a patch from Joshua Rogers (Opera).
  • decompress_iob(): Add periods to a couple of log messages
  • Terminate the body of the HTTP snipplets with a single new line instead of '\r\n'. -…

This update for privoxy fixes the following issues:

Update to version 3.0.32:

• Security/Reliability (boo#1183129)

  • ssplit(): Remove an assertion that could be triggered with a crafted CGI request. Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272 Reported by: Joshua Rogers (Opera)
  • cgi_send_banner(): Overrule invalid image types. Prevents a crash with a crafted CGI request if Privoxy is toggled off. Commit e711c505c48. OVE-20210206-0001. CVE-2021-20273 Reported by: Joshua Rogers (Opera)
  • socks5_connect(): Don't try to send credentials when none are configured. Fixes a crash due to a NULL-pointer dereference when the socks server misbehaves. Commit 85817cc55b9. OVE-20210207-0001. CVE-2021-20274 Reported by: Joshua Rogers (Opera)
  • chunked_body_is_complete(): Prevent an invalid read of size two. Commit a912ba7bc9c. OVE-20210205-0001. CVE-2021-20275 Reported by: Joshua Rogers (Opera)
  • Obsolete pcre: Prevent invalid memory accesses with an invalid pattern passed to pcre_compile(). Note that the obsolete pcre code is scheduled to be removed before the 3.0.33 release. There has been a warning since 2008 already. Commit 28512e5b624. OVE-20210222-0001. CVE-2021-20276 Reported by: Joshua Rogers (Opera)

• Bug fixes:

  • Properly parse the client-tag-lifetime directive. Previously it was not accepted as an obsolete hash value was being used. Reported by: Joshua Rogers (Opera)
  • decompress_iob(): Prevent reading of uninitialized data. Reported by: Joshua Rogers (Opera).
  • decompress_iob(): Don't advance cur past eod when looking for the end of the file name and comment.
  • decompress_iob(): Cast value to unsigned char before shifting. Prevents a left-shift of a negative value which is undefined behaviour. Reported by: Joshua Rogers (Opera)
  • gif_deanimate(): Confirm that that we have enough data before doing any work. Fixes a crash when fuzzing with an empty document. Reported by: Joshua Rogers (Opera).
  • buf_copy(): Fail if there's no data to write or nothing to do. Prevents undefined behaviour 'applying zero offset to null pointer'. Reported by: Joshua Rogers (Opera)
  • log_error(): Treat LOG_LEVEL_FATAL as fatal even when --stfu is being used while fuzzing. Reported by: Joshua Rogers (Opera).
  • Respect DESTDIR when considering whether or not to install config files with '.new' extension.
  • OpenSSL ssl_store_cert(): Fix two error messages.
  • Fix a couple of format specifiers.
  • Silence compiler warnings when compiling with NDEBUG.
  • fuzz_server_header(): Fix compiler warning.
  • fuzz_client_header(): Fix compiler warning.
  • cgi_send_user_manual(): Also reject requests if the user-manual directive specifies a https:// URL. Previously Privoxy would try and fail to open a local file.

• General improvements:

  • Log the TLS version and the the cipher when debug 2 is enabled.
  • ssl_send_certificate_error(): Respect HEAD requests by not sending a body.
  • ssl_send_certificate_error(): End the body with a single new line.
  • serve(): Increase the chances that the host is logged when closing a server socket.
  • handle_established_connection(): Add parentheses to clarify an expression Suggested by: David Binderman
  • continue_https_chat(): Explicitly unset CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE if process_encrypted_request() fails. This makes it more obvious that the connection will not be reused. Previously serve() relied on CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED being unset. Inspired by a patch from Joshua Rogers (Opera).
  • decompress_iob(): Add periods to a couple of log messages
  • Terminate the body of the HTTP snipplets with a single new line instead of '\r\n'. -…

These are all security issues fixed in the privoxy-3.0.32-2.3 package on the GA media of openSUSE Tumbleweed.

It was discovered that Privoxy incorrectly handled CGI requests. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2020-35502, CVE-2021-20209, CVE-2021-20210, CVE-2021-20213, CVE-2021-20215, CVE-2021-20216, CVE-2021-20217, CVE-2021-20272, CVE-2021-20273, CVE-2021-20275)

It was discovered that Privoxy incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2021-20212, CVE-2021-20276)

It was discovered that Privoxy incorrectly handled client tags. An attacker could possibly use this issue to cause Privoxy to consume resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-20211)

It was discovered that Privoxy incorrectly handled client tags. An attacker could possibly use this issue to cause Privoxy to consume resources, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-20214)