1. Forum
  2. Usenet
  3. LINUX.GENTOO.ANNOUNCE

  • [gentoo-announce] [ GLSA 202210-11 ] schroot: Denial of Service

    From glsamaker@gentoo.org@21:1/5 to All on Mon Oct 31 03:10:02 2022
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 202210-11
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    https://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Severity: Low
    Title: schroot: Denial of Service
    Date: October 31, 2022
    Bugs: #867016
    ID: 202210-11

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    A vulnerability has been discovered in schroot which could result in
    denial of service of the schroot service.

    Background
    ==========

    schroot is a utility to execute commands in a chroot environment.

    Affected packages
    =================

    -------------------------------------------------------------------
    Package / Vulnerable / Unaffected
    -------------------------------------------------------------------
    1 dev-util/schroot < 1.6.13_p2 >= 1.6.13_p2

    Description
    ===========

    schroot is unecessarily permissive in rules regarding chroot and session
    names.

    Impact
    ======

    A crafted chroot or session name can break the internal state of the
    schroot service, leading to denial of service.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All schroot users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-util/schroot-1.6.13"

    References
    ==========

    [ 1 ] CVE-2022-2787
    https://nvd.nist.gov/vuln/detail/CVE-2022-2787

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

    https://security.gentoo.org/glsa/202210-11

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users' machines is of utmost
    importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

    License
    =======

    Copyright 2022 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    https://creativecommons.org/licenses/by-sa/2.5
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmNfICwACgkQFMQkOaVy +9kZhg/9GYPIZvspBdDcgQLgAuoggszl9hLN7nyvITWCIG7fgZ7pMLJP2o8W+il9 PI62zXJ1aE9BZJ1KCh0H85wAnIPTNfHwkwHEwvclP0qgTGmAflIBIgPcJSp16mJK YkAJDQh9kwTeWuFb4vEVMRdhIA8s9X7MWbi04OfwpCaD+9h3/Ny96pyzd5BZlQu1 fJPvKo8JPEsxNErf9tmVGcclRrfq8KpzY5jff5wStVo/0Wv80l/ELyzVjA4RahgN YRxeaYCSYYXoIp/Po+F2W/aRFopith+UvsQ4/3951+AI6IF9UhK3tJJr+LIVmIzA KKfyxYRUW+b58c0mOCJpAzE84Y8W+GiQyToynMwWqGUNh8tDr2z9ZTlx8BcHwDYF duK0fwg97gh5KjiSFlhIKjOG+SgNRGTm529C7o8AHQs29Ob8UFh6iZ/K2t9IO/za 7wJgMchzEqPYqKAdlhc1YIAl70bVn0vAOrHlk76zosjsE9axubYsMQqME4ad1kD8 h1V4I8/2BLXp+omnjrvIaFSYQva2NH1W6S02nhhmpqsYVxNEzeR3j7Wyw3XVwUih G//Qwbly7UK9yZEVEgabnVksp5ioHAlfveQL3tdgbdrjOYl1Z6IgVGPLL1DZwu5H tshgKegDK+Qk8IAiV8+mbU1aF/mKrqJgBUULyc+Iw9qP5JpGetc=
    =YB4F
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)