Bug 1112532 (CVE-2018-16396)

Summary: VUL-0: CVE-2018-16396: ruby,ruby2.1: Tainted flags are not propagated in Array#pack and String#unpack with some directives
Product: [Novell Products] SUSE Security Incidents Reporter: Robert Frohl <rfrohl>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: NEW --- QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: bgeuken, ematsumiya, meissner, mrueckert, smash_bz
Version: unspecifiedFlags: ematsumiya: needinfo?
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/216979/
Whiteboard: CVSSv3:SUSE:CVE-2018-16396:4.8:(AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Robert Frohl 2018-10-19 09:11:19 UTC
CVE-2018-16396
Array#pack method converts the receiver’s contents into a string with specified format. If the receiver contains some tainted objects, the returned string also should be tainted. String#unpack method which converts the receiver into an array also should propagate its tainted flag to the objects contained in the returned array. But, with B, b, H and h directives, the tainted flags are not propagated. So, if a script processes unreliable inputs by Array#pack and/or String#unpack with these directives and checks the reliability with tainted flags, the check might be wrong.


upstream patch:
https://github.com/ruby/ruby/commit/a2958f6743664006d21fc0bafd4ca6214df1d429

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16396
https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/
Comment 1 Robert Frohl 2018-10-19 11:28:01 UTC
Hi Marcus,
my review suggest that the following codestreams are affected:
- SUSE:SLE-15:Update/ruby
- SUSE:SLE-12:Update/ruby
- SUSE:SLE-12:Update/ruby2.1

It looks like the following are not affected:
- SUSE:SLE-11-SP2:Update/ruby19
- SUSE:SLE-11-SP1:Update/ruby

I had to search for the patch [0] in the upstream git history, even though I am convinced that this is the correct fix it might be a good idea to verify that I did not miss any additional commits.


[0] https://github.com/ruby/ruby/commit/a2958f6743664006d21fc0bafd4ca6214df1d429
Comment 6 Swamp Workflow Management 2019-07-10 13:14:03 UTC
SUSE-SU-2019:1804-1: An update that solves 21 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1082007,1082008,1082009,1082010,1082011,1082014,1082058,1087433,1087434,1087436,1087437,1087440,1087441,1112530,1112532,1130028,1130611,1130617,1130620,1130622,1130623,1130627,1133790
CVE References: CVE-2017-17742,CVE-2018-1000073,CVE-2018-1000074,CVE-2018-1000075,CVE-2018-1000076,CVE-2018-1000077,CVE-2018-1000078,CVE-2018-1000079,CVE-2018-16395,CVE-2018-16396,CVE-2018-6914,CVE-2018-8777,CVE-2018-8778,CVE-2018-8779,CVE-2018-8780,CVE-2019-8320,CVE-2019-8321,CVE-2019-8322,CVE-2019-8323,CVE-2019-8324,CVE-2019-8325
Sources used:
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    ruby2.5-2.5.5-4.3.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    ruby2.5-2.5.5-4.3.1
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    ruby2.5-2.5.5-4.3.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    ruby2.5-2.5.5-4.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Swamp Workflow Management 2019-07-21 10:23:10 UTC
openSUSE-SU-2019:1771-1: An update that solves 21 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1082007,1082008,1082009,1082010,1082011,1082014,1082058,1087433,1087434,1087436,1087437,1087440,1087441,1112530,1112532,1130028,1130611,1130617,1130620,1130622,1130623,1130627,1133790
CVE References: CVE-2017-17742,CVE-2018-1000073,CVE-2018-1000074,CVE-2018-1000075,CVE-2018-1000076,CVE-2018-1000077,CVE-2018-1000078,CVE-2018-1000079,CVE-2018-16395,CVE-2018-16396,CVE-2018-6914,CVE-2018-8777,CVE-2018-8778,CVE-2018-8779,CVE-2018-8780,CVE-2019-8320,CVE-2019-8321,CVE-2019-8322,CVE-2019-8323,CVE-2019-8324,CVE-2019-8325
Sources used:
openSUSE Leap 15.1 (src):    ruby-bundled-gems-rpmhelper-0.0.2-lp151.2.1, ruby2.5-2.5.5-lp151.4.3.1
openSUSE Leap 15.0 (src):    ruby-bundled-gems-rpmhelper-0.0.2-lp150.2.1, ruby2.5-2.5.5-lp150.3.3.1
Comment 9 Swamp Workflow Management 2020-06-09 13:23:03 UTC
SUSE-SU-2020:1570-1: An update that fixes 42 vulnerabilities is now available.

Category: security (important)
Bug References: 1043983,1048072,1055265,1056286,1056782,1058754,1058755,1058757,1062452,1069607,1069632,1073002,1078782,1082007,1082008,1082009,1082010,1082011,1082014,1082058,1087433,1087434,1087436,1087437,1087440,1087441,1112530,1112532,1130611,1130617,1130620,1130622,1130623,1130627,1152990,1152992,1152994,1152995,1171517,1172275
CVE References: CVE-2015-9096,CVE-2016-2339,CVE-2016-7798,CVE-2017-0898,CVE-2017-0899,CVE-2017-0900,CVE-2017-0901,CVE-2017-0902,CVE-2017-0903,CVE-2017-10784,CVE-2017-14033,CVE-2017-14064,CVE-2017-17405,CVE-2017-17742,CVE-2017-17790,CVE-2017-9228,CVE-2017-9229,CVE-2018-1000073,CVE-2018-1000074,CVE-2018-1000075,CVE-2018-1000076,CVE-2018-1000077,CVE-2018-1000078,CVE-2018-1000079,CVE-2018-16395,CVE-2018-16396,CVE-2018-6914,CVE-2018-8777,CVE-2018-8778,CVE-2018-8779,CVE-2018-8780,CVE-2019-15845,CVE-2019-16201,CVE-2019-16254,CVE-2019-16255,CVE-2019-8320,CVE-2019-8321,CVE-2019-8322,CVE-2019-8323,CVE-2019-8324,CVE-2019-8325,CVE-2020-10663
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    ruby2.1-2.1.9-19.3.2
SUSE OpenStack Cloud 8 (src):    ruby2.1-2.1.9-19.3.2
SUSE OpenStack Cloud 7 (src):    ruby2.1-2.1.9-19.3.2, yast2-ruby-bindings-3.1.53-9.8.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    ruby2.1-2.1.9-19.3.2
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    ruby2.1-2.1.9-19.3.2
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    ruby2.1-2.1.9-19.3.2
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    ruby2.1-2.1.9-19.3.2, yast2-ruby-bindings-3.1.53-9.8.1
SUSE Linux Enterprise Server 12-SP5 (src):    ruby2.1-2.1.9-19.3.2
SUSE Linux Enterprise Server 12-SP4 (src):    ruby2.1-2.1.9-19.3.2
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    ruby2.1-2.1.9-19.3.2
SUSE Linux Enterprise Server 12-SP3-BCL (src):    ruby2.1-2.1.9-19.3.2
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    ruby2.1-2.1.9-19.3.2, yast2-ruby-bindings-3.1.53-9.8.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    ruby2.1-2.1.9-19.3.2, yast2-ruby-bindings-3.1.53-9.8.1
SUSE Enterprise Storage 5 (src):    ruby2.1-2.1.9-19.3.2
HPE Helion Openstack 8 (src):    ruby2.1-2.1.9-19.3.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.