Security update for apt-cacher-ng SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:0146-1 Final 1 1 2020-01-29T16:50:27Z current 2020-01-29T16:50:27Z 2020-01-29T16:50:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apt-cacher-ng This update for apt-cacher-ng fixes the following issues: - CVE-2019-18899: Fixed a symlink attack which could allow to overwrite arbitrary data (boo#1157703). - CVE-2020-5202: Fixed an information leak if a local user won a race condition to listen to localhost:3142 (boo#1157706). This update was imported from the openSUSE:Leap:15.1:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-146 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WNHKIYENNBZYQZDAXUMNWHSYC2SN5WOD/ E-Mail link for openSUSE-SU-2020:0146-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1157703 SUSE Bug 1157703 https://bugzilla.suse.com/1157706 SUSE Bug 1157706 https://www.suse.com/security/cve/CVE-2019-18899/ SUSE CVE CVE-2019-18899 page https://www.suse.com/security/cve/CVE-2020-5202/ SUSE CVE CVE-2020-5202 page SUSE Package Hub 15 SP1 apt-cacher-ng-3.1-bp151.4.3.1 apt-cacher-ng-3.1-bp151.4.3.1 as a component of SUSE Package Hub 15 SP1 The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers to influence the outcome of these operations. This issue affects: openSUSE Leap 15.1 apt-cacher-ng versions prior to 3.1-lp151.3.3.1. CVE-2019-18899 SUSE Package Hub 15 SP1:apt-cacher-ng-3.1-bp151.4.3.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WNHKIYENNBZYQZDAXUMNWHSYC2SN5WOD/ https://www.suse.com/security/cve/CVE-2019-18899.html CVE-2019-18899 https://bugzilla.suse.com/1157703 SUSE Bug 1157703 apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /usr/lib/apt-cacher-ng/acngtool program attempts to connect to apt-cacher-ng via TCP on localhost port 3142, even if the explicit SocketPath=/var/run/apt-cacher-ng/socket command-line option is passed. The cron job /etc/cron.daily/apt-cacher-ng (which is active by default) attempts this periodically. Because 3142 is an unprivileged port, any local user can try to bind to this port and will receive requests from acngtool. There can be sensitive data in these requests, e.g., if AdminAuth is enabled in /etc/apt-cacher-ng/security.conf. This sensitive data can leak to unprivileged local users that manage to bind to this port before the apt-cacher-ng daemon can. CVE-2020-5202 SUSE Package Hub 15 SP1:apt-cacher-ng-3.1-bp151.4.3.1 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WNHKIYENNBZYQZDAXUMNWHSYC2SN5WOD/ https://www.suse.com/security/cve/CVE-2020-5202.html CVE-2020-5202 https://bugzilla.suse.com/1157706 SUSE Bug 1157706