[USN-6564-1] Node.js vulnerabilities
[USN-6566-1] SQLite vulnerabilities
[USN-6565-1] OpenSSH vulnerabilities
[USN-6564-1] Node.js vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6564-1
January 03, 2024
nodejs vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in Node.js.
Software Description:
- nodejs: An open-source, cross-platform JavaScript runtime environment.
Details:
Hubert Kario discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to obtain sensitive
information. (CVE-2022-4304)
CarpetFuzz, Dawei Wang discovered that Node.js incorrectly handled certain
inputs. If a user or an automated system were tricked into opening a specially
crafted input file, a remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-4450)
Octavio Galland and Marcel Böhme discovered that Node.js incorrectly handled
certain inputs. If a user or an automated system were tricked into opening a
specially crafted input file, a remote attacker could possibly use this issue
to cause a denial of service. (CVE-2023-0215)
David Benjamin discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to obtain sensitive
information. (CVE-2023-0286)
Hubert Kario and Dmitry Belyavsky discovered that Node.js incorrectly handled
certain inputs. If a user or an automated system were tricked into opening a
specially crafted input file, a remote attacker could possibly use this issue
to cause a denial of service. (CVE-2023-0401)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
libnode-dev 12.22.9~dfsg-1ubuntu3.3
libnode72 12.22.9~dfsg-1ubuntu3.3
nodejs 12.22.9~dfsg-1ubuntu3.3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6564-1
CVE-2022-4304, CVE-2022-4450, CVE-2023-0215, CVE-2023-0286,
CVE-2023-0401
Package Information:
https://launchpad.net/ubuntu/+source/nodejs/12.22.9~dfsg-1ubuntu3.3
[USN-6566-1] SQLite vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6566-1
January 03, 2024
sqlite3 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in SQLite.
Software Description:
- sqlite3: C library that implements an SQL database engine
Details:
It was discovered that SQLite incorrectly handled certain protection
mechanisms when using a CLI script with the --safe option, contrary to
expectations. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-46908)
It was discovered that SQLite incorrectly handled certain memory operations
in the sessions extension. A remote attacker could possibly use this issue
to cause SQLite to crash, resulting in a denial of service. (CVE-2023-7104)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libsqlite3-0 3.42.0-1ubuntu0.1
Ubuntu 23.04:
libsqlite3-0 3.40.1-1ubuntu0.1
Ubuntu 22.04 LTS:
libsqlite3-0 3.37.2-2ubuntu0.3
Ubuntu 20.04 LTS:
libsqlite3-0 3.31.1-4ubuntu0.6
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6566-1
CVE-2022-46908, CVE-2023-7104
Package Information:
https://launchpad.net/ubuntu/+source/sqlite3/3.42.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/sqlite3/3.40.1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/sqlite3/3.37.2-2ubuntu0.3
https://launchpad.net/ubuntu/+source/sqlite3/3.31.1-4ubuntu0.6
[USN-6565-1] OpenSSH vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6565-1
January 03, 2024
openssh vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in OpenSSH.
Software Description:
- openssh: secure shell (SSH) for secure access to remote machines
Details:
It was discovered that OpenSSH incorrectly handled supplemental groups when
running helper programs for AuthorizedKeysCommand and
AuthorizedPrincipalsCommand as a different user. An attacker could possibly
use this issue to escalate privileges. This issue only affected Ubuntu
20.04 LTS. (CVE-2021-41617)
It was discovered that OpenSSH incorrectly added destination constraints
when PKCS#11 token keys were added to ssh-agent, contrary to expectations.
This issue only affected Ubuntu 22.04 LTS, and Ubuntu 23.04.
(CVE-2023-51384)
It was discovered that OpenSSH incorrectly handled user names or host names
with shell metacharacters. An attacker could possibly use this issue to
perform OS command injection. (CVE-2023-51385)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
openssh-client 1:9.3p1-1ubuntu3.2
openssh-server 1:9.3p1-1ubuntu3.2
Ubuntu 23.04:
openssh-client 1:9.0p1-1ubuntu8.7
openssh-server 1:9.0p1-1ubuntu8.7
Ubuntu 22.04 LTS:
openssh-client 1:8.9p1-3ubuntu0.6
openssh-server 1:8.9p1-3ubuntu0.6
Ubuntu 20.04 LTS:
openssh-client 1:8.2p1-4ubuntu0.11
openssh-server 1:8.2p1-4ubuntu0.11
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6565-1
CVE-2021-41617, CVE-2023-51384, CVE-2023-51385
Package Information:
https://launchpad.net/ubuntu/+source/openssh/1:9.3p1-1ubuntu3.2
https://launchpad.net/ubuntu/+source/openssh/1:9.0p1-1ubuntu8.7
https://launchpad.net/ubuntu/+source/openssh/1:8.9p1-3ubuntu0.6
https://launchpad.net/ubuntu/+source/openssh/1:8.2p1-4ubuntu0.11
