This affects all versions of package google-cloudstorage-commands.

Read More

This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js

Read More

This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.

Read More

This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.

Read More

This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function.

Read More

All versions of package git-archive are vulnerable to Command Injection via the exports function.

Read More

A vulnerability was found in Tecrail Responsive Filemanger up to 9.10.x and classified as critical. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 9.11.0 is able to address this issue. It is recommended to upgrade the affected component.

Read More

FortiGuard Labs is aware of a report that H0lyGh0st ransomware was primarily used against “small-to-midsized businesses, including manufacturing organizations, banks, schools, and event and meeting planning companies”. Microsoft attributed the ransomware to a North Korean hacking group. After the victim’s networks are infiltrated, the threat actor then exfiltrates information which then deploys H0lyGh0st ransomware that encrypts files.Why is this Significant?This is significant as H0lyGh0st ransomware is a newly reported ransomware that was deployed to compromised small-to-midsized businesses by an alleged North Korean hacking group in newly discovered attacks.What is H0lyGh0st Ransomware?H0lyGh0st is a ransomware which encrypts files on a compromised machine for financial gain. After the victim’s networks are compromised, the threat actor will exfiltrate information from the victim’s machine. Then, H0lyGhst ransomware is deployed and encrypts files. The ransomware adds a “.h0lyenc” file extension to the affected files and leaves a ransom note in FOR_DECRYPT.html.The html file includes ransom message below:Please Read this text to decrypt all files encrypted.We have uploaded all files to cloud. Url: [redacted]Don’t worry, you can return all of your files immediately if you pay.If you want to restore all of your files, Send mail to [redacted] with your Id. Your ID is [redacted]Or install tor browser and contact us with your id or [redacted] (If all of pcs in your company are encrypted).Our site : “A link to H0lyGh0st Onion site”After you pay, We will send unlocker with decryption keyAttention1. Do not rename encrypted files.2. Do not try to decrypt your data using third party software, it may cause permanent data loss.3. Decryption of your files with the help of third parties may cause increase price.4. Antivirus may block our unlocker, So disable antivirus first and execute unlocker with decryption key.According to the report, the ransom amount ranges from 1.2 to 5 Bitcoins, which amounts to 26,000 to 110,000 US dollars based on the exchange rate as of this publishing.What are the Initial Attack Vectors?While initial attack vectors have not been identified, CVE-2022-26352 is called out as a potential vulnerability that was exploited to break into target networks. CVE-2022-26352 is a critical arbitrary file upload vulnerability in dotCMS. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successfully exploiting this vulnerability could result in arbitrary file be saved in target server and lead to remote code execution.Has the Vendor Released a Fix for CVE-2022-26352?Yes, a patch is available. For more information, see the Appendix for a link to “SI-62: Multipart File Directory Traversal can lead to remote execution”.What is the Status of Coverage?FortiGuard Labs provides the following AV coverage against known samples of H0lyGh0st ransomware:W64/Filecoder.788A!tr.ransomW32/Filecoder.AX!trW64/Agent.ACR!trW32/PossibleThreatMalicious_Behavior.SBFortiGuard Labs provides the following IPS coverage for CVE-2022-26352:DotCMS.API.Content.Arbitrary.File.Upload (default action is set to pass)Known network IOCs for H0lyGh0st ransomware are blocked by the WebFiltering client.

Read More

FEDORA-2022-d26586b419

Packages in this update:

java-11-openjdk-11.0.16.0.8-1.fc35

Update description:

New in release OpenJDK 11.0.16 (2022-07-19)

The release announcement can be found at https://bit.ly/openjdk11016
Full release details can be found at https://builds.shipilev.net/backports-monitor/release-notes-11.0.16.txt

Security fixes

JDK-8277608: Address IP Addressing
JDK-8272243: Improve DER parsing
JDK-8272249: Better properties of loaded Properties
JDK-8281859, CVE-2022-21540: Improve class compilation
JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations
JDK-8283190: Improve MIDI processing
JDK-8284370: Improve zlib usage
JDK-8285407, CVE-2022-34169: Improve Xalan supports

FIPS Changes

RH2007331: SecretKey generate/import operations don’t add the CKA_SIGN attribute in FIPS mode
RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
RH2090378: Revert to disabling system security properties and FIPS mode support together
Depend on crypto-policies package at build-time and run-time

Other Changes

Add javaver- and origin-specific javadoc and javadoczip alternatives (thanks to FeRD (Frank Dana) ferdnyc@gmail.com)

JDK-8285240: HTTPS Channel Binding support for Java GSS/Kerberos

Support has been added for TLS channel binding tokens for Negotiate/Kerberos authentication over HTTPS through javax.net.HttpsURLConnection.

Channel binding tokens are increasingly required as an enhanced form of security which can mitigate certain kinds of socially engineered, man in the middle (MITM) attacks. They work by communicating from a client to a server the client’s understanding of the binding between connection security (as represented by a TLS server cert) and higher level authentication credentials (such as a username and password). The server can then detect if the client has been fooled by a MITM and shutdown the session/connection.

The feature is controlled through a new system property jdk.https.negotiate.cbt which is described fully at the following
page: https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/doc-files/net-properties.html#jdk.https.negotiate.cbt

JDK-8278386: Default JDK compressor will be closed when IOException is encountered

DeflaterOutputStream.close() and GZIPOutputStream.finish() methods have been modified to close out the associated default JDK compressor before propagating a Throwable up the stack. ZIPOutputStream.closeEntry() method has been modified to close out the associated default JDK compressor before propagating an IOException, not of type ZipException, up the stack.

JDK-8277157: Vector should throw ClassNotFoundException for a missing class of an element

java.util.Vector is updated to correctly report ClassNotFoundException that occurs during deserialization usingjava.io.ObjectInputStream.GetField.get(name, object)when the class of an element of the Vector is not found. Without this fix, aStreamCorruptedException` is thrown that does not provide information about the missing class.

Read More

FEDORA-2022-ae563934f7

Packages in this update:

java-11-openjdk-11.0.16.0.8-1.fc36

Update description:

New in release OpenJDK 11.0.16 (2022-07-19)

The release announcement can be found at https://bit.ly/openjdk11016
Full release details can be found at https://builds.shipilev.net/backports-monitor/release-notes-11.0.16.txt

Security fixes

JDK-8277608: Address IP Addressing
JDK-8272243: Improve DER parsing
JDK-8272249: Better properties of loaded Properties
JDK-8281859, CVE-2022-21540: Improve class compilation
JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations
JDK-8283190: Improve MIDI processing
JDK-8284370: Improve zlib usage
JDK-8285407, CVE-2022-34169: Improve Xalan supports

FIPS Changes

RH2007331: SecretKey generate/import operations don’t add the CKA_SIGN attribute in FIPS mode
RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
RH2090378: Revert to disabling system security properties and FIPS mode support together
Depend on crypto-policies package at build-time and run-time

Other Changes

Add javaver- and origin-specific javadoc and javadoczip alternatives (thanks to FeRD (Frank Dana) ferdnyc@gmail.com)

JDK-8285240: HTTPS Channel Binding support for Java GSS/Kerberos

Support has been added for TLS channel binding tokens for Negotiate/Kerberos authentication over HTTPS through javax.net.HttpsURLConnection.

Channel binding tokens are increasingly required as an enhanced form of security which can mitigate certain kinds of socially engineered, man in the middle (MITM) attacks. They work by communicating from a client to a server the client’s understanding of the binding between connection security (as represented by a TLS server cert) and higher level authentication credentials (such as a username and password). The server can then detect if the client has been fooled by a MITM and shutdown the session/connection.

The feature is controlled through a new system property jdk.https.negotiate.cbt which is described fully at the following
page: https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/doc-files/net-properties.html#jdk.https.negotiate.cbt

JDK-8278386: Default JDK compressor will be closed when IOException is encountered

DeflaterOutputStream.close() and GZIPOutputStream.finish() methods have been modified to close out the associated default JDK compressor before propagating a Throwable up the stack. ZIPOutputStream.closeEntry() method has been modified to close out the associated default JDK compressor before propagating an IOException, not of type ZipException, up the stack.

JDK-8277157: Vector should throw ClassNotFoundException for a missing class of an element

java.util.Vector is updated to correctly report ClassNotFoundException that occurs during deserialization usingjava.io.ObjectInputStream.GetField.get(name, object)when the class of an element of the Vector is not found. Without this fix, aStreamCorruptedException` is thrown that does not provide information about the missing class.

Read More