安全公告详情

NS-SA-2021-0016

2021-03-09 13:05:16

简介

moderate: cloud-init/libxml2 security update

严重级别

moderate

主题

An update for cloud-init/libxml2 is now available for NewStart CGSL MAIN 5.04/CGSL CORE 5.04.
NewStart Security has rated this update as having a security impact of moderate. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

详细描述

cloud-init: Cloud-init is a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install ssh keys and to let the user run various scripts.
libxml2: This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.


Security Fix(es):
cloud-init: The default cloud-init configuration included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.(CVE-2018-10896)
cloud-init: A flaw was found in cloud-init, where it uses short passwords when generating a random password in new instances. Depending on the instance configuration, a remote or local attacker may abuse this vulnerability to guess the password of the victim user.(CVE-2020-8632)
cloud-init: A flaw was found in cloud-init, where it uses the random.choice function when creating sensitive random strings used for generating a random password in new instances. Depending on the instance configuration, a remote or local attacker may abuse this vulnerability to guess the password of the victim user.(CVE-2020-8631)
cloud-init: bugfix
libxml2: StringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.(CVE-2020-7595)
libxml2: ParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.(CVE-2019-19956)
libxml2: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. System availability is the highest threat from this vulnerability.(CVE-2019-20388)
libxml2: bugfix


Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 5.04.F29B5.

影响组件

  • cloud-init
  • libxml2

影响产品

  • CGSL MAIN 5.04
  • CGSL CORE 5.04

更新包

{"fix":[{"product":"CGSL MAIN 5.04","pkgs":[{"binary":["cloud-init-19.4-7.el7.2.cgslv5.0.3.g204af97.x86_64.rpm"],"source":"cloud-init-19.4-7.el7.2.cgslv5.0.3.g204af97.src.rpm"},{"binary":["libxml2-devel-2.9.1-6.el7.5.x86_64.rpm","libxml2-python-2.9.1-6.el7.5.x86_64.rpm","libxml2-static-2.9.1-6.el7.5.x86_64.rpm","libxml2-2.9.1-6.el7.5.x86_64.rpm","libxml2-debuginfo-2.9.1-6.el7.5.x86_64.rpm"],"source":"libxml2-2.9.1-6.el7.5.src.rpm"}]},{"product":"CGSL CORE 5.04","pkgs":[{"binary":["cloud-init-19.4-7.el7.2.cgslv5.0.3.g204af97.x86_64.rpm"],"source":"cloud-init-19.4-7.el7.2.cgslv5.0.3.g204af97.src.rpm"},{"binary":["libxml2-devel-2.9.1-6.el7.5.x86_64.rpm","libxml2-python-2.9.1-6.el7.5.x86_64.rpm","libxml2-static-2.9.1-6.el7.5.x86_64.rpm","libxml2-2.9.1-6.el7.5.x86_64.rpm","libxml2-debuginfo-2.9.1-6.el7.5.x86_64.rpm"],"source":"libxml2-2.9.1-6.el7.5.src.rpm"}]}]}

CVE

参考