From security em unicamp.br  Thu Oct  3 17:23:56 2024
From: security em unicamp.br (CSIRT Unicamp)
Date: Thu, 3 Oct 2024 17:23:56 -0300
Subject: [SECURITY-L] Fwd: [RNP/CAIS Alerta #0160] Vulnerabilidade no Zimbra
In-Reply-To: <CPWP152MB57093033CAD573C1A81E47C5B0712@CPWP152MB5709.LAMP152.PROD.OUTLOOK.COM>
References: <CPWP152MB57093033CAD573C1A81E47C5B0712@CPWP152MB5709.LAMP152.PROD.OUTLOOK.COM>
Message-ID: <CAEsueBNv9acxueJMV7S5U_qM3DdK-DzbgBQPU7DxZDMUJjLoWQ@mail.gmail.com>

---------- Forwarded message ---------
De: RNP-Alerta <rnp-alerta em rnp.br>
Date: qui., 3 de out. de 2024 às 16:34
Subject: [RNP/CAIS Alerta #0160] Vulnerabilidade no Zimbra
To: CAIS/RNP Alerta <rnp-alerta em listas.rnp.br>


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

CAIS-Alerta [03-10-2024] Vulnerabilidade no Zimbra

Prezados(as),
O CAIS alerta a comunidade de segurança cibernética sobre vulnerabilidade
crítica recentemente divulgada pela Zimbra, esta vulnerabilidade de
Execução Remota de Código (RCE) foi identificada no serviço 'postjournal'
do Zimbra , que lida com o processamento de mensagens SMTP.

Até a última revisão deste alerta, foram identificados códigos capazes de
explorar esta vulnerabilidade.

1) Produtos e versões afetadas;
2) Identificadores CVE (http://cve.mitre.org);
3) Descrição das vulnerabilidades;
4) Mitigação e correções disponíveis; e
5) Mais informações.

1) Produtos e versões afetadas:


Versões anteriores a:
8.8.15 Patch 46;
9 antes do 9.0.0 Patch 41;
10 antes do 10.0.9; e
10.1 antes do 10.1.1


2) Identificadores CVE (http://cve.mitre.org):

CVE-2024-45519

3) Descrição das vulnerabilidades:

Trata-se de vulnerabilidade na função 'read_maps' a partir de uma validação
inadequada da entrada do usuário, que passa diretamente para 'popen' sem a
devida sanitização. Isso permite que um agente malicioso, com acesso à rede
do serviço postjounal, execute comandos arbitrários no servidor (RCE), sem
necessidade de autenticação, o que pode resultar em controle total do
servidor Zimbra.

4) Mitigação e correções disponíveis:

O CAIS recomenda fortemente aos administradores a atualizarem seus
servidores Zimbra para as últimas versões corrigidas:

9.0.0 Patch 41;
10.0.9;
10.1.1; e
8.8.15 Patch 46.

Se a atualização imediata dos servidores Zimbra não for possível,
recomenda-se desabilitar o Postjournal nos casos em que não estiver sendo
utilizado.

5) Mais informações:
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://nvd.nist.gov/vuln/detail/CVE-2024-45519

O CAIS recomenda que os administradores mantenham seus sistemas e
aplicativos sempre atualizados, de acordo com as últimas versões e
correções oferecidas pelos fabricantes.

Os alertas do CAIS também podem ser acompanhados pelas redes sociais da
RNP. Siga-nos!!
Twitter: @caisRNP
Facebook: facebook.com/RedeNacionaldeEnsinoePesquisaRNP.

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       https://www.rnp.br/sistema-rnp/cais   #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponível   https://www.rnp.br/cais/cais-pgp.key  #
################################################################

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEmWJsLogaTfQskA851Per/VOaV4AFAmb+8UcACgkQ1Per/VOa
V4BVyhAAlq6G+d7oviSu1kswSboIKTM7ePI9BVFV7LpCsmDWnAqZz9S8kdxwT/ry
pk67D1cRGfj9l2kds621MXcuxc0lMMkWTu1FqHRZFoRN2switts0ZXu2w8KAghZw
YJyUILabOP3kpALjYT4XTuLvSxQcgzWm3D3x+KeuDu0TR1lJOnp5DFHKSC3xfO+M
THA/ATLV4pQdD2fLTJnSUOJyUvntEBU9+B82GF+BVwvw1Vi9i6WFNHCC/e9m9jCn
4sjzmfXZ1sFtVl50/4E1ez9PgZUikDYkJ5D2vOE+1KXwdItPspLCJDuYmq5lTo8h
MQ1/2JJek7CvZWjYZFHTqnaFzwDO05pPbdthaoNBVN2snc55522eHTABqkN5CxhG
AmwrctJryEfDy0Q51GUX2ILWylMqCyL6uOwYkVJFsshnojR5CNEw63sq41zPUoQo
Tx/aYj2umLv3fnw3saNdMemhmH4sLDVGzMq6RPDqxi/rFiyJwSOUULY6TZlmvJ2y
dro5TOyO1VJMJRxmV2gPjW4HntliaWxrOEITtHWlcxoGnoS6F8KSDHz6RsoU6e/c
fVWr3numTzUDCVcTPgx3nyfZG/JG2noqDgM3IBTtFuXoKFkcA+9ILLAA0kYVeQrV
INCguKQY6IWznN7ZmtcL8WYY0IV0wXvkGsV88aS9R6n0F3jaKeI=
=W3G6
-----END PGP SIGNATURE-----
_______________________________________________
RNP-Alerta
rnp-alerta em listas.rnp.br
https://listas.rnp.br/mailman/listinfo/rnp-alerta
-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: <http://www.listas.unicamp.br/pipermail/security-l/attachments/20241003/5810bf07/attachment.html>

From security em unicamp.br  Fri Oct 11 11:27:18 2024
From: security em unicamp.br (CSIRT Unicamp)
Date: Fri, 11 Oct 2024 11:27:18 -0300
Subject: [SECURITY-L] =?utf-8?q?=5BRNP/CAIS_Alerta_=230161=5D_Vulnerabili?=
	=?utf-8?q?dade_de_Eleva=C3=A7=C3=A3o_de_Privil=C3=A9gio_do_Windows?=
	=?utf-8?q?_Netlogon?=
In-Reply-To: <CPWP152MB5709A3E3DB45827F218DDCC9B0782@CPWP152MB5709.LAMP152.PROD.OUTLOOK.COM>
References: <CPWP152MB5709A3E3DB45827F218DDCC9B0782@CPWP152MB5709.LAMP152.PROD.OUTLOOK.COM>
Message-ID: <CAEsueBPP2XQp11S5fDQEUiQiE_LaD5imdoyRRQLg3ni5qU9A+Q@mail.gmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

CAIS-Alerta [10-10-2024] Vulnerabilidade de Elevação de Privilégio do
Windows Netlogon

Prezados(as),

O CAIS alerta a comunidade de segurança cibernética sobre uma
vulnerabilidade crítica recentemente divulgada pela Microsoft no Windows
Netlogon, do tipo Escalação de Privilégios (EoP), classificada com uma
pontuação CVSSv3 de 9.

O Netlogon é um serviço do Windows que facilita a autenticação de usuários
e computadores em uma rede. Ele permite que os dispositivos se conectem e
se autentiquem em um controlador de domínio, gerenciando a troca de
credenciais e o estabelecimento de sessões seguras.

Produtos e versões afetadas;
Identificadores CVE (http://cve.mitre.org);
Descrição das vulnerabilidades;
Mitigação e correções disponíveis; e
Mais informações.

1) Produtos e versões afetadas:

Windows Server nas versões:

2012 R2
2012
2008 R2 x64, SP1 e SP2
2008 32 bits, SP2
2016
2019
2022

2) Identificadores CVE (http://cve.mitre.org):

CVE-2024-38124

3) Descrição das vulnerabilidades:

Um agente malicioso com acesso autenticado na mesma rede que um dispositivo
vulnerável pode renomear sua máquina para coincidir com o controlador de
domínio. Após essa modificação, o invasor pode potencialmente comprometer
todo o domínio ao usar um canal seguro.

4) Mitigação e correções disponíveis:

O CAIS recomenda fortemente aos administradores que atualizem seus
servidores com os pacotes disponibilizados pela Microsoft. No comunicado, a
Microsoft informa não haver soluções alternativas, mas faz algumas
recomendações: "Evitar nomes previsíveis para controladores de domínio,
assegurar validação mais rigorosa do canal seguro, monitorar renomeações de
computadores e considerar autenticação aprimorada."

5) Mais informações:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38124

O CAIS recomenda que os administradores mantenham seus sistemas e
aplicativos sempre atualizados, de acordo com as últimas versões e
correções oferecidas pelos fabricantes.

Os alertas do CAIS também podem ser acompanhados pelas redes sociais da
RNP. Siga-nos!
Twitter: @caisRNP
Facebook: facebook.com/RedeNacionaldeEnsinoePesquisaRNP.

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       https://www.rnp.br/sistema-rnp/cais   #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponível   https://www.rnp.br/cais/cais-pgp.key  #
################################################################

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEmWJsLogaTfQskA851Per/VOaV4AFAmcIKokACgkQ1Per/VOa
V4D4zQ/9GIEXnbTE5x0DfWM/j9MagMFj+NpyBtsYKvVQRaP2bDqXA5cTclN7+tiE
ZfV88Tb6u53nu2VEvD27WJGdFbN/s7fqNzTJXsDaV9HkKgPSRLszMi/cO2ch0eLd
D6MnkXXhL6AnnmAxyIncEuQRwZRY6S3nkA1iSJatXnj7CDS7JAgV2rpRV+UHrjmw
vv8BoohOdpx3yqSbMW5S9DC4j8Zp9r22kk/AMH3niEuww/Luqojht6k4ldhjwae+
MsSTgDOUrEQ83MEU6MaxMXw4tGyip17kczddH/6j0XuHxo+fTEp5VDGv5P78zhUt
ktrW3AaYtdXRT2lIjFuuxWpsjOclRbWtBJXtPV3HsIuZGV3fO6ARLVD4mxjQNlHy
dugKQMALuvirplaETKc5vZL8CuRtHJuosc6rVutHp8hHPKuI4W3OiWCh8ygV2cdU
+R3GfeSEhUjP8UYMiEl5KVzjTL4BXEbfE/kJtM/ncsOlFsJeZEN5sy8vT60rz9PA
EjcDyagp4SGACF7c2AioU5VnbWL4G+iGF9S4GKyoCDzLgkgx8N+Nup5Z7mNowY0o
Eo7teU2s5630X+ycXKKQdO8PYrNdj8UvYnRiXMD5CAiaUy4IvLOs1mCstK7zwp1N
gRxwuXX9wfHge3EPrdRpXvKQrktbUmgXak/027KBMUmoMSJyPZ8=
=/1xz
-----END PGP SIGNATURE-----
_______________________________________________
RNP-Alerta
rnp-alerta em listas.rnp.br
https://listas.rnp.br/mailman/listinfo/rnp-alerta

===
Computer Security Incident Response Team - CSIRT
Universidade Estadual de Campinas - Unicamp
Centro de Computacao - CCUEC
GnuPG Public Key: http://www.security.unicamp.br/security.asc [^]
Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830
-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: <http://www.listas.unicamp.br/pipermail/security-l/attachments/20241011/27322cea/attachment.html>

From security em unicamp.br  Fri Oct 11 11:44:05 2024
From: security em unicamp.br (CSIRT Unicamp)
Date: Fri, 11 Oct 2024 11:44:05 -0300
Subject: [SECURITY-L] [Security-news] wkhtmltopdf - Highly critical -
 Unsupported - SA-CONTRIB-2024-049
In-Reply-To: <mailman.1844.1728492793.749.security-news@drupal.org>
References: <mailman.1844.1728492793.749.security-news@drupal.org>
Message-ID: <CAEsueBOyZ=Vy6ZxqKrBBqxEQe3J=icB_zmMM+=OPg3jGeMos9g@mail.gmail.com>

View online: https://www.drupal.org/sa-contrib-2024-049

Project: wkhtmltopdf [1]
Date: 2024-October-09
Security risk: *Highly critical* 23 ? 25
AC:None/A:None/CI:All/II:All/E:Proof/TD:All [2]
Vulnerability: Unsupported

Affected versions: *
Description:
The security team is marking this project unsupported. There is a known
security issue with the project that has not been fixed by the maintainer.
If
you would like to maintain this project, please read:
https://www.drupal.org/node/251466#procedure---own-project---unsupported [3]

Solution:
If you use this project, you should uninstall it.  To take over
maintainership, please read
https://www.drupal.org/node/251466#procedure---own-project---unsupported [4]
in full.


[1] https://www.drupal.org/project/wkhtmltopdf
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/node/251466#procedure---own-project---unsupported
[4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

_______________________________________________
Security-news mailing list
Security-news em drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news


===
Computer Security Incident Response Team - CSIRT
Universidade Estadual de Campinas - Unicamp
Centro de Computacao - CCUEC
GnuPG Public Key: http://www.security.unicamp.br/security.asc [^]
Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830
-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: <http://www.listas.unicamp.br/pipermail/security-l/attachments/20241011/80a809f6/attachment.html>

From security em unicamp.br  Mon Oct 14 09:09:11 2024
From: security em unicamp.br (CSIRT Unicamp)
Date: Mon, 14 Oct 2024 09:09:11 -0300
Subject: [SECURITY-L] =?utf-8?q?=5BRNP/CAIS_Alerta_=230161=5D_Vulnerabili?=
	=?utf-8?q?dade_de_Eleva=C3=A7=C3=A3o_de_Privil=C3=A9gio_do_Windows?=
	=?utf-8?q?_Netlogon?=
Message-ID: <CAEsueBNQwr1M0VZNj-s0Sqi+xMYJYfijDnJLomJ2c9e0cpz1bw@mail.gmail.com>

CAIS-Alerta [10-10-2024] Vulnerabilidade de Elevação de Privilégio do
Windows Netlogon

Prezados(as),

O CAIS alerta a comunidade de segurança cibernética sobre uma
vulnerabilidade crítica recentemente divulgada pela Microsoft no Windows
Netlogon, do tipo Escalação de Privilégios (EoP), classificada com uma
pontuação CVSSv3 de 9.

O Netlogon é um serviço do Windows que facilita a autenticação de usuários
e computadores em uma rede. Ele permite que os dispositivos se conectem e
se autentiquem em um controlador de domínio, gerenciando a troca de
credenciais e o estabelecimento de sessões seguras.

Produtos e versões afetadas;
Identificadores CVE (http://cve.mitre.org);
Descrição das vulnerabilidades;
Mitigação e correções disponíveis; e
Mais informações.

1) Produtos e versões afetadas:

Windows Server nas versões:

2012 R2
2012
2008 R2 x64, SP1 e SP2
2008 32 bits, SP2
2016
2019
2022

2) Identificadores CVE (http://cve.mitre.org):

CVE-2024-38124

3) Descrição das vulnerabilidades:

Um agente malicioso com acesso autenticado na mesma rede que um dispositivo
vulnerável pode renomear sua máquina para coincidir com o controlador de
domínio. Após essa modificação, o invasor pode potencialmente comprometer
todo o domínio ao usar um canal seguro.

4) Mitigação e correções disponíveis:

O CAIS recomenda fortemente aos administradores que atualizem seus
servidores com os pacotes disponibilizados pela Microsoft. No comunicado, a
Microsoft informa não haver soluções alternativas, mas faz algumas
recomendações: "Evitar nomes previsíveis para controladores de domínio,
assegurar validação mais rigorosa do canal seguro, monitorar renomeações de
computadores e considerar autenticação aprimorada."

5) Mais informações:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38124

O CAIS recomenda que os administradores mantenham seus sistemas e
aplicativos sempre atualizados, de acordo com as últimas versões e
correções oferecidas pelos fabricantes.

Os alertas do CAIS também podem ser acompanhados pelas redes sociais da
RNP. Siga-nos!
Twitter: @caisRNP
Facebook: facebook.com/RedeNacionaldeEnsinoePesquisaRNP.

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       https://www.rnp.br/sistema-rnp/cais   #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponível   https://www.rnp.br/cais/cais-pgp.key  #
################################################################
===
Computer Security Incident Response Team - CSIRT
Universidade Estadual de Campinas - Unicamp
Centro de Computacao - CCUEC
GnuPG Public Key: http://www.security.unicamp.br/security.asc [^]
Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830
-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: <http://www.listas.unicamp.br/pipermail/security-l/attachments/20241014/88d86dd5/attachment.html>

From security em unicamp.br  Mon Oct 14 14:51:32 2024
From: security em unicamp.br (CSIRT Unicamp)
Date: Mon, 14 Oct 2024 14:51:32 -0300
Subject: [SECURITY-L] [oss-security] [kubernetes] CVE-2024-9486 and
 CVE-2024-9594: VM images built with Kubernetes Image Builder use default
 credentials
Message-ID: <CAEsueBPDGFZEGtsnbWjDrH1hdbLQKYhmRRUSOvyuctRYcjckoA@mail.gmail.com>

Hello Kubernetes Community,

A security issue was discovered in Kubernetes where an unauthorized user
may be able to ssh to a node VM which uses a VM image built with the
Kubernetes Image Builder project (
https://github.com/kubernetes-sigs/image-builder).

For images built with the Proxmox provider, this issue has been rated
Critical (
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
)
(9.8), and assigned CVE-2024-9486.

For images built with the Nutanix, OVA, QEMU or raw providers, this issue
has been rated Medium (
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
)
(6.3), and assigned CVE-2024-9594.

Am I vulnerable?

Clusters using virtual machine images built with Kubernetes Image Builder (
https://github.com/kubernetes-sigs/image-builder) version v0.1.37 or
earlier are affected.

CVE-2024-9486: VMs using images built with the Proxmox provider are
confirmed to be vulnerable.

CVE-2024-9594: VMs using images built with the Nutanix, OVA, QEMU or raw
providers were vulnerable during the build process and are affected only if
an attacker was able to reach the VM where the image build was happening
and used the vulnerability to modify the image at the time the image build
was occurring.

VMs using images built with all other providers are not affected.

To determine the version of Image Builder you are using, use one of the
following methods:

* For git clones of the image builder repository:
    cd <local path to image builder repo>

    make version

* For installations using a tarball download:
    cd <local path to install location>

    grep -o v0\\.[0-9.]* RELEASE.md | head -1

* For a container image release:

    docker run --rm <image pull spec> version
  or
    podman run --rm <image pull spec> version

  or look at the image tag specified, in the case of an official image such
as
registry.k8s.io/scl-image-builder/cluster-node-image-builder-amd64:v0.1.37

How do I mitigate this vulnerability?

Rebuild any affected images using a fixed version of Image Builder.
Re-deploy the fixed images to any affected VMs.

Prior to upgrading, this vulnerability can be mitigated by disabling the
builder account on affected VMs:

usermod -L builder

Fixed Versions

Kubernetes Image Builder versions >= v0.1.38

Detection

The linux command "last builder" can be used to view logins to the affected
"builder" account.

If you find evidence that this vulnerability has been exploited, please
contact security em kubernetes.io

Additional Details

See the GitHub issues for more details:

https://github.com/kubernetes/kubernetes/issues/128006

https://github.com/kubernetes/kubernetes/issues/128007

Acknowledgements

This vulnerability was reported by Nicolai Rybnikar @rybnico from Rybnikar
Enterprises GmbH.

The issue was fixed and coordinated by Marcus Noble of the Image Builder
project.

Thank You,

Joel Smith on behalf of the Kubernetes Security Response Committee
===
Computer Security Incident Response Team - CSIRT
Universidade Estadual de Campinas - Unicamp
Centro de Computacao - CCUEC
GnuPG Public Key: http://www.security.unicamp.br/security.asc [^]
Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830
-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: <http://www.listas.unicamp.br/pipermail/security-l/attachments/20241014/6d6b0693/attachment.html>

From security em unicamp.br  Wed Oct 16 15:21:26 2024
From: security em unicamp.br (CSIRT Unicamp)
Date: Wed, 16 Oct 2024 15:21:26 -0300
Subject: [SECURITY-L] [Security-news] Drupal core - Moderately critical -
 Improper error handling - SA-CORE-2024-002
Message-ID: <CAEsueBOR5ts=aNeji9hCX0WGnLWzJSj815VCmomudsztYmZLMg@mail.gmail.com>

View online: https://www.drupal.org/sa-core-2024-002

Project: Drupal core [1]
Date: 2024-October-16
Security risk: *Moderately critical* 13 ? 25
AC:Basic/A:None/CI:None/II:All/E:Theoretical/TD:Uncommon [2]
Vulnerability: Improper error handling

Affected versions: >=10.0 < 10.2.10
Description:
Under certain uncommon site configurations, a bug in the CKEditor 5 module
can cause some image uploads to move the entire webroot to a different
location on the file system. This could be exploited by a malicious user to
take down a site.

The issue is mitigated by the fact that several non-default site
configurations must exist simultaneously for this to occur.

Solution:
Install the latest version:

   * If you are using Drupal 10.2, update to Drupal 10.2.10 [3].
   * Drupal 10.3 and above are not affected, nor is Drupal 7.

All versions of Drupal 10 prior to 10.2 are end-of-life and do not receive
security coverage. (Drupal 8 [4] and Drupal 9 [5] have both reached
end-of-life.)

This advisory is not covered by Drupal Steward [6].

Reported By:
   * Pierre Rudloff [7]

Fixed By:
   * catch [8] of the Drupal Security Team
   * Lee Rowlands [9] of the Drupal Security Team
   * Benji Fisher [10] of the Drupal Security Team
   * Kim Pepper [11]
   * Wim Leers [12]
   * xjm [13] of the Drupal Security Team

Coordinated By:
   * xjm [14] of the Drupal Security Team
   * Dave Long [15] of the Drupal Security Team
   * Juraj Nemec [16] of the Drupal Security Team


[1] https://www.drupal.org/project/drupal
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/drupal/releases/10.2.10
[4] https://www.drupal.org/psa-2021-06-29
[5] https://www.drupal.org/psa-2023-11-01
[6] https://www.drupal.org/steward
[7] https://www.drupal.org/user/3611858
[8] https://www.drupal.org/user/35733
[9] https://www.drupal.org/user/395439
[10] https://www.drupal.org/user/683300
[11] https://www.drupal.org/user/370574
[12] https://www.drupal.org/user/99777
[13] https://www.drupal.org/user/65776
[14] https://www.drupal.org/user/65776
[15] https://www.drupal.org/u/longwave
[16] https://www.drupal.org/u/poker10

_______________________________________________
Security-news mailing list
Security-news em drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news

===
Computer Security Incident Response Team - CSIRT
Universidade Estadual de Campinas - Unicamp
Centro de Computacao - CCUEC
GnuPG Public Key: http://www.security.unicamp.br/security.asc [^]
Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830
-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: <http://www.listas.unicamp.br/pipermail/security-l/attachments/20241016/555dedbc/attachment.html>

From security em unicamp.br  Mon Oct 21 08:58:13 2024
From: security em unicamp.br (CSIRT Unicamp)
Date: Mon, 21 Oct 2024 08:58:13 -0300
Subject: [SECURITY-L] Grafana critical vulnerability risks remote code
 execution
Message-ID: <CAEsueBNVBqVOT2xqXTc0bcb_y9WyvQpcKAEfdYRxQOh=APTFmA@mail.gmail.com>

Original:
https://www.scworld.com/news/grafana-critical-vulnerability-risks-remote-code-execution

Grafana, an open-source data analytics and visualization platform, was
found to have a critical vulnerability that could lead to remote code
execution.

The flaw, tracked as CVE-2024-9264
<https://nvd.nist.gov/vuln/detail/CVE-2024-9264>, which has a CVSS v4 score
of 9.4, was introduced in Grafana version 11 released in May 2024, Grafana
Labs disclosed Thursday
<https://grafana.com/blog/2024/10/17/grafana-security-release-critical-severity-fix-for-cve-2024-9264/>.
The vulnerability stems from an experimental feature called SQL
Expressions, which allows for post-processing of data source query outputs
via SQL queries to the open-source relational database management system
DuckDB.

Grafana?s SQL Expressions feature does not properly sanitize these SQL
queries to the DuckDB command line interface (CLI), which can allow for
both command injection and local file inclusion via a malicious query. This
vulnerability could be exploited by any user with a ?viewer? permission or
higher, according to Grafana Labs
<https://grafana.com/security/security-advisories/cve-2024-9264/>.

SQL Expression is enabled by default for the Grafana API, however, Grafana
Lab noted that the vulnerability is only exploitable if the DuckDB binary
is installed and included in the PATH of the Grafana process? environment,
which is not the default.

SC Media contacted Grafana and asked how many users were believed to be
using vulnerable and exploitable versions of the platform, and did not
receive a response. The open-source intelligence (OSINT) platform Netlas.io
reported <https://x.com/Netlas_io/status/1847183420599730198> that more
than 100,000 Grafana instances were ?probably vulnerable to CVE-2024-9264?
Friday, including nearly 19,000 in the United States.
How to patch Grafana CVE-2024-9264

Grafana released six new versions that resolve the critical vulnerability,
including three downloads that only contain the security fix and three that
patch the flaw while also upgrading users to the most recent Grafana
versions.

Users who want to install the patch without installing the latest version
release can download versions 11.0.5+security-01
<https://grafana.com/grafana/download/11.0.5+security-01>,
11.1.6+security-01 <https://grafana.com/grafana/download/11.1.6+security-01>
or 11.2.1+security-01
<https://grafana.com/grafana/download/11.2.1+security-01>.

Users can also simultaneously patch and upgrade to the most recent versions
by installing release 11.0.6+security-01
<https://grafana.com/grafana/download/11.0.6+security-01>,
11.1.7+security-01 <https://grafana.com/grafana/download/11.1.7+security-01>
or 11.2.2+security-01 <http://Download%20Grafana%20v11.2.2+security-01>.

While Grafana Labs strongly recommended downloading the security patch ?as
soon as possible,? users can also mitigate the vulnerability by removing
the DuckDB binary from their system or the PATH where it is accessible to
Grafana. SQL Expressions was the only Grafana feature that utilized DuckDB,
the company said.

The vulnerability was first discovered by Grafana staff on Sept. 26, 2024,
and Grafana began rolling out the security patch across all channels for
Grafana Cloud the following day, according to a timeline published by
Grafana Labs.

By Oct. 1, the patch was completed across all Grafana Cloud instances, and
the patch for the Grafana Open-Source Software (OSS) and Grafana Enterprise
began to be privately released on Oct. 3. The patch completely removes the
SQL Expressions functionality.

===
Computer Security Incident Response Team - CSIRT
Universidade Estadual de Campinas - Unicamp
Centro de Computacao - CCUEC
GnuPG Public Key: http://www.security.unicamp.br/security.asc [^]
Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830
-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: <http://www.listas.unicamp.br/pipermail/security-l/attachments/20241021/15585d4b/attachment-0001.html>