Security

security@lists.puri.sm

3 discussions

Re: [Security] [Fwd: [SECURITY] [DSA 4404-1] chromium security update]
by Matthias Klumpp 03 Apr '19

03 Apr '19

Am Mi., 3. Apr. 2019 um 20:59 Uhr schrieb Jeremiah C. Foster <jeremiah.foster(a)puri.sm>: > > This security message from Debian I'm forwarding affects PureOS. I can > see in our repos that we have the fixed (and compromised) version. > https://repo.pureos.net/pureos/pool/main/c/chromium/ > > @Matthias -- is there some action we should take to remove the old > version? apt-cache policy is still saying the old, compromised version > of chromium will be installed; > > apt-cache policy chromium > chromium: > Installed: (none) > Candidate: 72.0.3626.109-1 > Version table: > 72.0.3626.109-1 500 > 500 https://repo.puri.sm/pureos green/main amd64 Packages > $ dak ls chromium chromium | 73.0.3683.75-1 | green | source, amd64, arm64 chromium | 73.0.3683.75-1 | landing | source, amd64, arm64 chromium | 73.0.3683.75-1 | purple | source, amd64, arm64 So, according to our archive (*the* authoritative source for questions of which package version is where) this is fixed in PureOS, and for about 1-2 days already. It is a bit odd that apt-policy doesn't seem to reflect that - did you run an apt update before? Maybe there was some other kind of lag somewhere? (actually hard to tell now) >From a new debspawn chroot: root@sirius-green-amd64-yzj3:/srv# apt-cache policy chromium chromium: Installed: (none) Candidate: 73.0.3683.75-1 Version table: 73.0.3683.75-1 500 500 https://repo.pureos.net/pureos green/main amd64 Packages Cheers, Matthias > > ---------- Forwarded message ---------- > From: Michael Gilbert <mgilbert(a)debian.org> > To: debian-security-announce(a)lists.debian.org > Cc: > Bcc: > Date: Sat, 9 Mar 2019 23:14:35 -0500 > Subject: [SECURITY] [DSA 4404-1] chromium security update > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA512 > > - ------------------------------------------------------------------------- > Debian Security Advisory DSA-4404-1 security(a)debian.org > https://www.debian.org/security/ Michael Gilbert > March 09, 2019 https://www.debian.org/security/faq > - ------------------------------------------------------------------------- > > Package : chromium > CVE ID : CVE-2019-5786 > > Clement Lecigne discovered a use-after-free issue in chromium's file > reader implementation. A maliciously crafted file could be used to > remotely execute arbitrary code because of this problem. > > This update also fixes a regression introduced in a previous update. The > browser would always crash when launched in remote debugging mode. > > For the stable distribution (stretch), this problem has been fixed in > version 72.0.3626.122-1~deb9u1. > > We recommend that you upgrade your chromium packages. > > For the detailed security status of chromium please refer to > its security tracker page at: > https://security-tracker.debian.org/tracker/chromium > > Further information about Debian Security Advisories, how to apply > these updates to your system and frequently asked questions can be > found at: https://www.debian.org/security/ > > Mailing list: debian-security-announce(a)lists.debian.org > -----BEGIN PGP SIGNATURE----- > > iQQzBAEBCgAdFiEEluhy7ASCBulP9FUWuNayzQLW9HMFAlyEjvYACgkQuNayzQLW > 9HPz2R//TxP9/mMURq2yCcS9lIXFM42c+YdBZSJK+hA5uRH4UKpycqOyJnpSvCqL > WfsApfLCKGrMyUmke0ZvV0iIe87WOHU9SpS8Hs6jdRTa2LEhn+2lmU28F3EpqXAB > 4yipvbAwpoN8j6Ab+hr8T1qBYZfqhTC8iK4tpe6D7JoT4xBf+471CIXhmmWTbOqt > TpFhjOhOiBT0ZUNR7BcePRhTOUiy/0Nu38fvBPbAnbcVR+M+6QfdbWMbBUyLU1bJ > 3c3upOLSic/CsuMhH1FXbw8R1Tj+mgNUqO6Sca7EpmuN10Xh8TUft56kClffYl6Q > Z7dt+TwyyFvvxR5bR7Q/fIw+oV/YgITtSWC7SokyN7so31Kh9DOnHYRzjY9OmhUx > febodihqFMJ91KLSGMt2KtmdDsYlIp/LuKmmcrKhq4a7k9LfYI50hRCR87bh5frg > 9ZcO2sdhI3H8Z8ejdbc/IO39aJ/BgG/LxZyx9smQTxK7SO5wt73SN2MtHXlmeqz3 > ReSk4oIZd06kHVk0OsKhwO2lennDWxc+g2UOGYz40k2E3mMdDBN9bD5KXSAmnsxW > +vOv+tznqLrjgJwCFz+gd14iP65CIQ9qL6zr6yxKFWozSQarZ8qeCbgND0gKBLH3 > O2Epo5kMX8zxZEhR2dmiCefmIf76E+90E1XXv+F32X6rJ41S4ibONF4KKufv26NJ > ehhPUUFJ03YZdA4cEeL/7T67Bt3dlBY53xhQuVosaMYqwo3Eyv2I6dmUxigjE2wx > b6q/kJsbYnPjkZ74Pd12JqSTBkvP3enQ4jAj28gpy0pnAQcjtPrygUDNfYV3S++a > 1LaZx78yoJ9w2jse0erB14SChFpbOvmdGZSe0kr7mchYmr+eik22SpFuwIb/f//X > 2dbqIKT5OP6QOnT7rsaycIIyIM0D7VhVCRkD4DPx6uimcLTHQjyEJCl1Q0V3Fnif > OYcl3mM5HYnR0tRefppaWdfhdLe/lPXGTE+ADeGtMORNMuarT0oYsKi7nevtsk/v > SEW40t1Ed65jZz2kyjJzBqLUiPpj0piL8eIcu+/sVOuPmBKVCVm3gjYGtestTyTf > 9fWTFc3w2pHFyDDAYDZYyAnweHxzUbOCF2wa8sULpurlLLk53sO39e8YRbJeqeWt > 1ajic6+3C6DXzqi/rCBJIBK/vgnqNaEJhB2yR4dj0HZuzd8C5kkElEELnbD8KCkd > ElsvOWikocbDoV0qxCm01KXCnQEpVe79PGJeh/Rkrk3tgftyja0wdzY/TAsTVbLc > MM/e19sg1o2pvTzydF0YjImhD8pbeSVlzXAtsv3JIf3oxd2yuJP5S+sfyKPPOdS1 > mDynXcm1ch/pLwS65mgSt980E07e9g== > =sUh4 > -----END PGP SIGNATURE----- >

1 0

[PSA-1-1] PureOS OEM installer
by Kyle Rankin 11 Dec '18

11 Dec '18

Purism Security Advisory PSA-1-1 2018-12-11 PureOS OEM Installer It was discovered that the PureOS OEM installer's post-install script had a bug whereby the user's LUKS encryption passphrase was logged in /var/log/auth.log. Because this was a bug in the PureOS OEM installer in particular, it only affects Purism laptop customers who are still using the OEM OS and have not reinstalled. It does *not* affect anyone who has reinstalled PureOS themselves and has been fixed in the OEM installer released on 2018-12-10 so will not affect any new customers. Testing for the bug: You can test whether your passphrase was logged by typing the following in a terminal: sudo grep cryptsetup-helper /var/log/auth.log Because this log does rotate, it's possible your passphrase was logged in a prior file that was rotated and gzipped. In that case you can test with: sudo zgrep cryptsetup-helper /var/log/auth.log.*.gz Impact: Because the password was disclosed in a log file at the moment of install and was owned by the root user and adm group, it would be visible only to someone who had root privileges on the machine for the first four weeks the laptop was used, after which the log file would have been rotated out. Remediation: The first step is to remove any traces of the passphrase from log files. If your passphase does show up in any log files, you can remove it with: sudo rm -f /var/log/auth.log or truncate it with: sudo bash -c '> /var/log/auth.log' Alternatively if you discover the passphrase in a gzipped log file, just remove that particular file instead. If you are concerned that your LUKS password is compromised and want to change it, you can change it from the GUI by launching the "Disks" application on the desktop, selecting your hard drive from the left-hand column and then selecting your main partition that is labeled with "LUKS" (it should be the largest partition on your hard drive). Note that the other, smaller LUKS partition is your swap partition and it does not have to be changed, as it uses a random password that is rotated at each boot. Once you have selected your partition, click the gear icon and select "Change Passphrase" to change the passphrase. Figure 1 (attached) shows a sample screenshot of what this looks like. -- Kyle Rankin Chief Security Officer Purism, SPC

1 0

Welcome to the Purism Security Mailing List
by Kyle Rankin 08 Dec '18

08 Dec '18

The Purism security mailing list will serve to notify customers of hardware and software security issues within Purism products and services. This is aimed to be a low-traffic notification-focused mailing list. For discussions on these and other security topics go to https://forums.puri.sm. -- Kyle Rankin Chief Security Officer Purism, SPC

1 0

2024

2023

2022

2021

2020

2019

2018

Security