A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbehaves.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in privoxy before 3.0.32. An assertion failure could be triggered with a crafted CGI
    request leading to server crash. (CVE-2021-20272)

  - A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is
    toggled off. (CVE-2021-20273)

  - A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks
    server misbehaves. (CVE-2021-20274)

  - A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in
    chunked_body_is_complete() leading to denial of service. (CVE-2021-20275)

  - A flaw was found in privoxy before 3.0.32. Invalid memory access with an invalid pattern passed to
    pcre_compile() may lead to denial of service. (CVE-2021-20276)

The remote host is affected by the vulnerability described in GLSA-202107-16 (Privoxy: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in privoxy. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could cause a possible Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for privoxy fixes the following issues :

Update to version 3.0.32 :

  - Security/Reliability (boo#1183129)

  - ssplit(): Remove an assertion that could be triggered     with a crafted CGI request. Commit 2256d7b4d67.
    OVE-20210203-0001. CVE-2021-20272 Reported by: Joshua     Rogers (Opera)

  - cgi_send_banner(): Overrule invalid image types.
    Prevents a crash with a crafted CGI request if Privoxy     is toggled off. Commit e711c505c48. OVE-20210206-0001.
    CVE-2021-20273 Reported by: Joshua Rogers (Opera)

  - socks5_connect(): Don't try to send credentials when     none are configured. Fixes a crash due to a NULL pointer     dereference when the socks server misbehaves. Commit     85817cc55b9. OVE-20210207-0001. CVE-2021-20274 Reported     by: Joshua Rogers (Opera)

  - chunked_body_is_complete(): Prevent an invalid read of     size two. Commit a912ba7bc9c. OVE-20210205-0001.
    CVE-2021-20275 Reported by: Joshua Rogers (Opera)

  - Obsolete pcre: Prevent invalid memory accesses with an     invalid pattern passed to pcre_compile(). Note that the     obsolete pcre code is scheduled to be removed before the     3.0.33 release. There has been a warning since 2008     already. Commit 28512e5b624. OVE-20210222-0001.
    CVE-2021-20276 Reported by: Joshua Rogers (Opera)

  - Bug fixes :

  - Properly parse the client-tag-lifetime directive.
    Previously it was not accepted as an obsolete hash value     was being used. Reported by: Joshua Rogers (Opera)

  - decompress_iob(): Prevent reading of uninitialized data.
    Reported by: Joshua Rogers (Opera).

  - decompress_iob(): Don't advance cur past eod when     looking for the end of the file name and comment.

  - decompress_iob(): Cast value to unsigned char before     shifting. Prevents a left-shift of a negative value     which is undefined behaviour. Reported by: Joshua Rogers     (Opera)

  - gif_deanimate(): Confirm that that we have enough data     before doing any work. Fixes a crash when fuzzing with     an empty document. Reported by: Joshua Rogers (Opera).

  - buf_copy(): Fail if there's no data to write or nothing     to do. Prevents undefined behaviour 'applying zero     offset to NULL pointer'. Reported by: Joshua Rogers     (Opera)

  - log_error(): Treat LOG_LEVEL_FATAL as fatal even when
    --stfu is being used while fuzzing. Reported by: Joshua     Rogers (Opera).

  - Respect DESTDIR when considering whether or not to     install config files with '.new' extension.

  - OpenSSL ssl_store_cert(): Fix two error messages.

  - Fix a couple of format specifiers.

  - Silence compiler warnings when compiling with NDEBUG.

  - fuzz_server_header(): Fix compiler warning.

  - fuzz_client_header(): Fix compiler warning.

  - cgi_send_user_manual(): Also reject requests if the     user-manual directive specifies a https:// URL.
    Previously Privoxy would try and fail to open a local     file.

  - General improvements :

  - Log the TLS version and the the cipher when debug 2 is     enabled.

  - ssl_send_certificate_error(): Respect HEAD requests by     not sending a body.

  - ssl_send_certificate_error(): End the body with a single     new line.

  - serve(): Increase the chances that the host is logged     when closing a server socket.

  - handle_established_connection(): Add parentheses to     clarify an expression Suggested by: David Binderman

  - continue_https_chat(): Explicitly unset     CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE if     process_encrypted_request() fails. This makes it more     obvious that the connection will not be reused.
    Previously serve() relied on     CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED     being unset. Inspired by a patch from Joshua Rogers     (Opera).

  - decompress_iob(): Add periods to a couple of log     messages

  - Terminate the body of the HTTP snipplets with a single     new line instead of '\r\n'.

  - configure: Add --with-assertions option and only enable     assertions when it is used

  - windows build: Use --with-brotli and --with-mbedtls by     default and enable dynamic error checking.

  - gif_deanimate(): Confirm we've got an image before     trying to write it Saves a pointless buf_copy() call.

  - OpenSSL ssl_store_cert(): Remove a superfluous space     before the serial number.

  - Action file improvements :

  - Disable fast-redirects for .golem.de/

  - Unblock requests to adri*.

  - Block requests for trc*.taboola.com/

  - Disable fast-redirects for .linkedin.com/

  - Filter file improvements :

  - Make the second pcrs job of the img-reorder filter     greedy again. The ungreedy version broke the img tags     on: https://bulk.fefe.de/scalability/.

  - Privoxy-Log-Parser :

  - Highlight a few more messages.

  - Clarify the --statistics output. The shown 'Reused     connections' are server connections so name them     appropriately.

  - Bump version to 0.9.3.

  - Privoxy-Regression-Test :

  - Add the --check-bad-ssl option to the --help output.

  - Bump version to 0.7.3.

  - Documentation :

  - Add pushing the created tag to the release steps in the     developer manual.

  - Clarify that 'debug 32768' should be used in addition to     the other debug directives when reporting problems.

  - Add a 'Third-party licenses and copyrights' section to     the user manual.

ID	Name	Product	Family	Severity
424365	Alpine: multiple privoxy packages: security update to 3.0.32-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424365	Alpine: multiple privoxy packages: security update to 3.0.32-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
157017	GLSA-202107-16 : Privoxy: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
147925	openSUSE Security Update : privoxy (openSUSE-2021-443)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-20274

high

Tenable Plugins

high

high

high

high