Security update for tinyproxy SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:0119-1 Final 1 1 2024-05-10T12:42:27Z current 2024-05-10T12:42:27Z 2024-05-10T12:42:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tinyproxy This update for tinyproxy fixes the following issues: - Update to release 1.11.2 * Fix potential use-after-free in header handling [CVE-2023-49606, boo#1223746] * Prevent junk from showing up in error page in invalid requests [CVE-2022-40468, CVE-2023-40533, boo#1223743] - Move tinyproxy program to /usr/bin. - Update to release 1.11.1 * New fnmatch based filtertype - Update to release 1.11 * Support for multiple bind directives. - update to 1.10.0: * Configuration file has moved from /etc/tinyproxy.conf to /etc/tinyproxy/tinyproxy.conf. * Add support for basic HTTP authentication * Add socks upstream support * Log to stdout if no logfile is specified * Activate reverse proxy by default * Support bind with transparent mode * Allow multiple listen statements in the configuration * Fix CVE-2017-11747: Create PID file before dropping privileges. * Fix CVE-2012-3505: algorithmic complexity DoS in hashmap * Bugfixes * BB#110: fix algorithmic complexity DoS in hashmap * BB#106: fix CONNECT requests with IPv6 literal addresses as host * BB#116: fix invalid free for GET requests to ipv6 literal address * BB#115: Drop supplementary groups * BB#109: Fix crash (infinite loop) when writing to log file fails * BB#74: Create log and pid files after we drop privs * BB#83: Use output of id instead of $USER The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2024-119 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OM62U7F2OTTTTR4PTM6RV3UAOCUHRC75/ E-Mail link for openSUSE-SU-2024:0119-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1200028 SUSE Bug 1200028 https://bugzilla.suse.com/1203553 SUSE Bug 1203553 https://bugzilla.suse.com/1223743 SUSE Bug 1223743 https://bugzilla.suse.com/1223746 SUSE Bug 1223746 https://www.suse.com/security/cve/CVE-2012-3505/ SUSE CVE CVE-2012-3505 page https://www.suse.com/security/cve/CVE-2017-11747/ SUSE CVE CVE-2017-11747 page https://www.suse.com/security/cve/CVE-2022-40468/ SUSE CVE CVE-2022-40468 page https://www.suse.com/security/cve/CVE-2023-40533/ SUSE CVE CVE-2023-40533 page https://www.suse.com/security/cve/CVE-2023-49606/ SUSE CVE CVE-2023-49606 page SUSE Package Hub 15 SP5 openSUSE Leap 15.5 tinyproxy-1.11.2-bp155.3.3.1 tinyproxy-1.11.2-bp155.3.3.1 as a component of SUSE Package Hub 15 SP5 tinyproxy-1.11.2-bp155.3.3.1 as a component of openSUSE Leap 15.5 Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably. bucket. CVE-2012-3505 SUSE Package Hub 15 SP5:tinyproxy-1.11.2-bp155.3.3.1 openSUSE Leap 15.5:tinyproxy-1.11.2-bp155.3.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OM62U7F2OTTTTR4PTM6RV3UAOCUHRC75/ https://www.suse.com/security/cve/CVE-2012-3505.html CVE-2012-3505 https://bugzilla.suse.com/776506 SUSE Bug 776506 main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executes a "kill `cat /run/tinyproxy/tinyproxy.pid`" command. CVE-2017-11747 SUSE Package Hub 15 SP5:tinyproxy-1.11.2-bp155.3.3.1 openSUSE Leap 15.5:tinyproxy-1.11.2-bp155.3.3.1 important 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OM62U7F2OTTTTR4PTM6RV3UAOCUHRC75/ https://www.suse.com/security/cve/CVE-2017-11747.html CVE-2017-11747 Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function. CVE-2022-40468 SUSE Package Hub 15 SP5:tinyproxy-1.11.2-bp155.3.3.1 openSUSE Leap 15.5:tinyproxy-1.11.2-bp155.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OM62U7F2OTTTTR4PTM6RV3UAOCUHRC75/ https://www.suse.com/security/cve/CVE-2022-40468.html CVE-2022-40468 https://bugzilla.suse.com/1203553 SUSE Bug 1203553 ** REJECT ** This CVE ID is a duplicate of CVE-2022-40468 CVE-2023-40533 SUSE Package Hub 15 SP5:tinyproxy-1.11.2-bp155.3.3.1 openSUSE Leap 15.5:tinyproxy-1.11.2-bp155.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OM62U7F2OTTTTR4PTM6RV3UAOCUHRC75/ https://www.suse.com/security/cve/CVE-2023-40533.html CVE-2023-40533 https://bugzilla.suse.com/1223743 SUSE Bug 1223743 A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trigger reuse of previously freed memory, which leads to memory corruption and could lead to remote code execution. An attacker needs to make an unauthenticated HTTP request to trigger this vulnerability. CVE-2023-49606 SUSE Package Hub 15 SP5:tinyproxy-1.11.2-bp155.3.3.1 openSUSE Leap 15.5:tinyproxy-1.11.2-bp155.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OM62U7F2OTTTTR4PTM6RV3UAOCUHRC75/ https://www.suse.com/security/cve/CVE-2023-49606.html CVE-2023-49606 https://bugzilla.suse.com/1223746 SUSE Bug 1223746