A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3583 advisory.

    createrepo_c     [0.11.0-3]
    - Backport patch to switch off timestamps on documentation in order to remove       file conflicts (RhBug:1738788)

    [0.11.0-2]
    - Consistently produce valid URLs by prepending protocol. (RhBug:1632121)
    - modifyrepo_c: Prevent doubling of compression (test.gz.gz) (RhBug:1639287)
    - Correct pkg count in headers if there were invalid pkgs (RhBug:1596211)
    - Add support for modular errata (RhBug:1656584)

    dnf     [4.2.7-6]
    - Remove patch to not fail when installing modular RPMs without modular metadata

    [4.2.7-5]
    - Fix: --setopt and repo with dots (RhBug:1746349)

    [4.2.7-4]
    - Prevent printing empty Error Summary (RhBug:1690414)

    [4.2.7-3]
    - Update localizations from zanata (RhBug:1689982)
    - Accept multiple specs in repoquery options (RhBug:1667898,1656801)
    - Prevent switching modules in all cases (RhBug:1706215)
    - Change synchronization of rpm transaction to swdb (RhBug:1737328)
    - Print rpm error messages during transaction (RhBug:1677199)
    - Report missing default profile as an error (RhBug:1669527,1724564)
    - Describe a behavior when plugin is removed (RhBug:1700741)

    [4.2.7-2]
    - Add patch to not fail when installing modular RPMs without modular metadata

    [4.2.7-1]
    - Update to 4.2.7
    - Fix package reinstalls during yum module remove (RhBug:1700529)
    - Fail when '-c' option is given nonexistent file (RhBug:1512457)
    - Reuse empty lock file instead of stopping dnf (RhBug:1581824)
    - Propagate comps 'default' value correctly (RhBug:1674562)
    - Better search of provides in /(s)bin/ (RhBug:1657993)
    - Add detection for armv7hcnl (RhBug:1691430)
    - Fix group install/upgrade when group is not available (RhBug:1707624)
    - Report not matching plugins when using --enableplugin/--disableplugin       (RhBug:1673289) (RhBug:1467304)
    - Add support of modular FailSafe (RhBug:1623128)
    - Replace logrotate with build-in log rotation for dnf.log and dnf.rpm.log       (RhBug:1702690)

    [4.2.6-1]
    - Update to 4.2.6
    - Use improved config parser that preserves order of data
    - Follow RPM security policy for package verification
    - Update modules regardless of installed profiles
    - [conf] Use environment variables prefixed with DNF_VAR_
    - Allow adjustment of repo from --repofrompath (RhBug:1689591)
    - Allow globs in setopt in repoid part
    - Add command abbreviations (RhBug:1634232)
    - Installroot now requires absolute path
    - librepo: Turn on debug logging only if debuglevel is greater than 2 (RhBug:1355764,1580022)
    - Document cachedir option (RhBug:1691365)
    - Enhance documentation - API examples
    - Enhance documentation of --whatdepends option (RhBug:1687070)
    - Update documentation: implemented plugins; options; deprecated commands (RhBug:1670835,1673278)
    - [doc] Add info of relation update_cache with fill_sack (RhBug:1658694)
    - Rename man page from dnf.automatic to dnf-automatic to match command name
    - Fix alias list command (RhBug:1666325)
    - Fix behavior  of --bz option when specifying more values
    - Add protection of yum package (RhBug:1639363)
    - Fix list --showduplicates (RhBug:1655605)
    - Retain order of headers in search results (RhBug:1613860)
    - Solve traceback with the 'dnf install @module' (RhBug:1688823)
    - Fix multilib obsoletes (RhBug:1672947)
    - Do not remove group package if other packages depend on it
    - Remove duplicates from 'dnf list' and 'dnf info' outputs
    - Fix the installation of completion_helper.py
    - Fix formatting of message about free space required
    - Fix installation failiure when duplicit RPMs are specified (RhBug:1687286)
    - Fix issues with terminal hangs when attempting bash completion (RhBug:1702854)
    - Allow plugins to terminate dnf (RhBug:1701807)
    - [provides] Enhanced detecting of file provides (RhBug:1702621)
    - [provides] Sort the output packages alphabetically

    [4.0.9.2-6]
    - Backport patch to unify --help with man for module-spec (RhBug:1678689)

    dnf-plugins-core     [4.0.8-3]
    - Generate yum-utils(1) instead of symlinking (RhBug:1676418)

    [4.0.8-2]
    - Update localizations from zanata (RhBug:1689984)
    - Rename dnf-utils to yum-utils (RhBug:1722093)
    - [builddep] Report all rpm errors (RhBug:1724668)
    - [config-manager] Behaviour of --setopt (RhBug:1702678)

    [4.0.8-1]
    - Update to 4.0.8
    - [reposync] Enable timestamp preserving for downloaded data (RhBug:1688537)
    - [reposync] Download packages from all streams (RhBug:1714788)
    - Make yum-copr manpage available (RhBug:1673902)
    - [needs-restarting] Add --reboothint option (RhBug:1192946) (RhBug:1639468)
    - Set the cost of _dnf_local repo to 500, to make it preferred to normal       repos

    [4.0.7-1]
    - Update to 4.0.7
    - Use improved config parser that preserves order of data
    - Fix: copr disable command traceback (RhBug:1693551)
    - [doc] state repoid as repo identifier of config-manager (RhBug:1686779)
    - [leaves] Show multiply satisfied dependencies as leaves
    - [download] Fix downloading an rpm from a URL (RhBug:1678582)
    - [download] Do not download src without --source (RhBug:1666648)
    - [download] Fix problem with downloading src pkgs (RhBug:1649627)
    - [download] Fix download of src when not the latest requested (RhBug:1649627)

    libcomps     [0.1.11-2]
    - Backport patch: Fix order of asserts in unit test (RhBug:1713220)

    [0.1.11-1]
    - Update to 0.1.11

    libdnf     [0.35.1-8.0.1]
    - Disable rhsm [Orabug: 29901202]
    - Replaced bugzilla.redhat.com with bugzilla.oracle.com in config [Orabug: 29656932]
    - Add support for apps that use libdnf to access yum url with 'ociregion' variable [Orabug: 30121584]     (Frank Deng)

    [0.35.1-8]
    - Enhanced fix of moving directories in minimal container (RhBug:1700341)

    [0.35.1-7]
    - Remove patch to not fail when installing modular RPMs without modular metadata

    [0.35.1-6]
    - Fix moving directories in minimal container (RhBug:1700341)

    [0.35.1-5]
    - Add suport for query sequence conversions

    [0.35.1-4]
    - Fix typo in error message (RhBug:1726661)
    - Update localizations from zanata (RhBug:1689991)
    - Dont disable nonexistent but required repositories (RhBug:1689331)
    - Ignore trailing blank lines of multiline value (RhBug:1722493)
    - Re-size includes map before re-computation (RhBug:1725213)

    [0.35.1-3]
    - Fix attaching and detaching of libsolvRepo and repo_internalize_trigger()       (RhBug:1730224)

    [0.35.1-2]
    - Add patch to not fail when installing modular RPMs without modular metadata

    [0.35.1-1]
    - Update to 0.35.1
    - Skip invalid key files in '/etc/pki/rpm-gpg' with warning (RhBug:1644040)
    - Enable timestamp preserving for downloaded data (RhBug:1688537)
    - Fix 'database is locked' error (RhBug:1631533)
    - Replace the 'Failed to synchronize cache' message (RhBug:1712055)
    - Fix 'no such table: main.trans_cmdline' error (RhBug:1596540)
    - Fix: skip_if_unavailable=true for local repositories (RhBug:1716313)
    - Add support of modular FailSafe (RhBug:1623128)
    - Add support of DNF main config file in context; used by PackageKit and       microdnf (RhBug:1689331)
    - Exit gpg-agent after repokey import (RhBug:1650266)

    [0.33.0-1]
    - Update to 0.33.0
    - Enhance sorting for module list (RhBug:1590358)
    - [DnfRepo] Add methods for alternative repository metadata type and download (RhBug:1656314)
    - Remove installed profile on module enable or disable (RhBug:1653623)
    - Enhance modular solver to handle enabled and default module streams differently (RhBug:1648839)
    - Add support of wild cards for modules (RhBug:1644588)
    - Exclude module pkgs that have conflict
    - Enhance config parser to preserve order of data, and keep comments and format
    - Improve ARM detection
    - Add support for SHA-384
    - Return empty query if incorrect reldep (RhBug:1687135)
    - ConfigParser: Improve compatibility with Python ConfigParser and dnf-plugin-spacewalk (RhBug:1692044)
    - ConfigParser: Unify default set of string represenation of boolean values
    - Fix segfault when interrupting dnf process (RhBug:1610456)
    - Installroot now requires absolute path
    - Support '_none_' value for repo option 'proxy' (RhBug:1680272)
    - Add support for Module advisories
    - Add support for xml:base attribute from primary.xml (RhBug:1691315)
    - Improve detection of Platform ID (RhBug:1688462)

    [0.22.5-6]
    - Rebuild for libsolv soname bump (in libsolve update to 0.7.4)

    librepo     [1.10.3-3]
    - Backport patch: Fix: Verification of checksum from file attr

    [1.10.3-2]
    - Backport patch: Define LRO_SUPPORTS_CACHEDIR only with zchunk (RhBug:1726141,1719830)

    [1.10.3-1]
    - Update to 1.10.3
    - Exit gpg-agent after repokey import (RhBug:1650266)

    [1.10.1-1]
    - Update to 1.10.1
    - Reduce download delays
    - Add an option to preserve timestamps of the downloaded files (RhBug:1688537)
    - Append the '?' part of repo URL after the path
    - Fix memory leaks

    librhsm     [0.0.3-3]
    - Generate repofile for any architecture if 'ALL' is specified

    libsolv     [0.7.4-3]
    - Backport patches: Use OpenSSL for computing hashes (RhBug:1630300)

    [0.7.4-2]
    - Backport patch: Not considered excluded packages as a best candidate (RhBug:1677583)

    [0.7.4-1]
    - soname bump to '1'
    - incompatible API changes:
      * bindings: Selection.flags is now an attribute
      * repodata_lookup_num now works like the other lookup_num functions
    - new functions:
      * selection_make_matchsolvable
      * selection_make_matchsolvablelist
      * pool_whatmatchessolvable
      * repodata_search_arrayelement
      * repodata_lookup_kv_uninternalized
      * repodata_search_uninternalized
      * repodata_translate_dir
    - new repowriter interface to write solv files allowing better       control over what gets written
    - support for filtered file lists with a custom filter
    - dropped support of (since a long time unused) REPOKEY_TYPE_U32
    - selected bug fixes:
      * fix nasty off-by-one error in repo_write
      * do not autouninstall packages because of forcebest updates
      * fixed a couple of null pointer derefs and potential memory         leaks
      * made disfavoring recommended packages work if strong recommends         is enabled
      * no longer disable infarch rules when they dont conflict with         the job
      * repo_add_rpmdb: do not copy bad solvables from the old solv file
      * fix cleandeps updates not updating all packages
    - new features:
      * support rpms new '^' version separator
      * support set/get_considered_list in bindings
      * new experimental SOLVER_FLAG_ONLY_NAMESPACE_RECOMMENDED flag
      * do favor evaluation before pruning allowing to (dis)favor         specific package versions
      * bindings: support pool.matchsolvable(), pool.whatmatchessolvable()         pool.best_solvables() and selection.matchsolvable()
      * experimental DISTTYPE_CONDA and REL_CONDA support

    microdnf     [3.0.1-3]
    - Fix microdnf --help coredump (RhBug:1744979)

    [3.0.1-2]
    - Fix minor memory leaks (RhBug:1702283)
    - Use help2man to generate a man page (RhBug:1612520)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2019:3583 advisory.

  - ** DISPUTED ** There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2     that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects     the test suite and not the underlying library. It cannot be exploited in any real-world application.
    (CVE-2018-20534)

  - A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are     merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to     crash the application or execute malicious code. (CVE-2019-3817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3583 advisory.

  - libsolv: illegal address access in pool_whatprovides in src/pool.h (CVE-2018-20534)

  - libcomps: use after free when merging two objmrtrees (CVE-2019-3817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libcomps packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free flaw has been discovered in libcomps     before version 0.1.10 in the way ObjMRTrees are merged.
    An attacker, who is able to make an application read a     crafted comps XML file, may be able to crash the     application or execute malicious code.(CVE-2019-3817)

  - libseccomp before 2.4.0 did not correctly generate     64-bit syscall argument comparisons using the     arithmetic operators (LT, GT, LE, GE), which might able     to lead to bypassing seccomp filters and potential     privilege escalations.(CVE-2019-9893)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3898 advisory.

    Libcomps is library for structure-like manipulation with content of comps XML files. Supports read/write     XML file, structure(s) modification.

    Security Fix(es):

    * libcomps: use after free when merging two objmrtrees (CVE-2019-3817)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3583 advisory.

    Yum is a command-line utility that allows the user to check for updates and automatically download and     install updated RPM packages. Yum automatically obtains and downloads dependencies, prompting the user for     permission as necessary.

    The following packages have been upgraded to a later upstream version: dnf (4.2.7), dnf-plugins-core     (4.0.8), libcomps (0.1.11), libdnf (0.35.1), librepo (1.10.3), libsolv (0.7.4). (BZ#1690288, BZ#1690289,     BZ#1690299, BZ#1692402, BZ#1694019, BZ#1697946)

    Security Fix(es):

    * libcomps: use after free when merging two objmrtrees (CVE-2019-3817)

    * libsolv: illegal address access in pool_whatprovides in src/pool.h (CVE-2018-20534)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libcomps fixes the following issue: &#9; Security issue fixed :

  - CVE-2019-3817: Fixed a use-after-free vulnerability in     comps_objmradix.c:comps_objmrtree_unite() function where     could allow to application crash or code execution     (bsc#1122841).

ID	Name	Product	Family	Severity
180746	Oracle Linux 8 : yum (ELSA-2019-3583)	Nessus	Oracle Linux Local Security Checks	high
157691	AlmaLinux 8 : yum (ALSA-2019:3583)	Nessus	Alma Linux Local Security Checks	high
145590	CentOS 8 : yum (CESA-2019:3583)	Nessus	CentOS Local Security Checks	high
134785	EulerOS 2.0 SP8 : libcomps (EulerOS-SA-2020-1293)	Nessus	Huawei Local Security Checks	critical
131152	RHEL 7 : libcomps (RHSA-2019:3898)	Nessus	Red Hat Local Security Checks	high
130555	RHEL 8 : yum (RHSA-2019:3583)	Nessus	Red Hat Local Security Checks	high
122772	openSUSE Security Update : libcomps (openSUSE-2019-323)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-3817

high

Tenable Plugins

high

high

high

critical

high

high

high