Bug 1161181 - VUL-0: CVE-2020-7211: xen: potential directory traversal using relative paths via tftp server on Windows host
VUL-0: CVE-2020-7211: xen: potential directory traversal using relative paths...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/251288/
CVSSv2:NVD:CVE-2020-7211:5.0:(AV:N/AC...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-01-17 12:14 UTC by Alexandros Toptsoglou
Modified: 2022-06-10 09:35 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandros Toptsoglou 2020-01-17 12:14:13 UTC
+++ This bug was initially created as a clone of Bug #1161180 +++

CVE-2020-7211

A potential directory traversal issue was found in the tftp server
of the SLiRP user-mode networking implementation used by QEMU.
It could occur on Windows host, as it allows to use both forward ('/')
and backward slash('\') tokens as separators in a file path.

A user able to access the tftp server could use this flaw to access
undue files by using relative paths.

Upstream patch:
---------------
  -> https://gitlab.freedesktop.org/slirp/libslirp/commit/14ec36e107a8c9af7d0a80c3571fe39b291ff1d4

Reference:
----------
  -> https://www.openwall.com/lists/oss-security/2020/01/17/2

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1792130
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-7211
http://seclists.org/oss-sec/2020/q1/15
https://gitlab.freedesktop.org/slirp/libslirp/commit/14ec36e107a8c9af7d0a80c3571fe39b291ff1d4
Comment 1 Alexandros Toptsoglou 2020-01-17 12:22:02 UTC
Tracked as affected:

SLE11-SP1-TD
SLE11-SP3-TD
SLE11-SP4
SLE12-SP1,2,3,4,5
Comment 5 Swamp Workflow Management 2020-02-06 14:15:37 UTC
SUSE-SU-2020:0334-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1152497,1154448,1154456,1154458,1154461,1155945,1157888,1158003,1158004,1158005,1158006,1158007,1161181
CVE References: CVE-2018-12207,CVE-2019-11135,CVE-2019-18420,CVE-2019-18421,CVE-2019-18424,CVE-2019-18425,CVE-2019-19577,CVE-2019-19578,CVE-2019-19579,CVE-2019-19580,CVE-2019-19581,CVE-2019-19583,CVE-2020-7211
Sources used:
SUSE OpenStack Cloud 7 (src):    xen-4.7.6_06-43.59.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    xen-4.7.6_06-43.59.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    xen-4.7.6_06-43.59.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    xen-4.7.6_06-43.59.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Swamp Workflow Management 2020-02-17 17:14:15 UTC
SUSE-SU-2020:0388-1: An update that fixes 25 vulnerabilities is now available.

Category: security (important)
Bug References: 1115045,1126140,1126141,1126192,1126195,1126196,1126201,1135905,1143797,1145652,1146874,1149813,1152497,1154448,1154456,1154458,1154461,1155945,1157888,1158003,1158004,1158005,1158006,1158007,1161181
CVE References: CVE-2018-12207,CVE-2018-19965,CVE-2019-11135,CVE-2019-12067,CVE-2019-12068,CVE-2019-12155,CVE-2019-14378,CVE-2019-15890,CVE-2019-17340,CVE-2019-17341,CVE-2019-17342,CVE-2019-17343,CVE-2019-17344,CVE-2019-17347,CVE-2019-18420,CVE-2019-18421,CVE-2019-18424,CVE-2019-18425,CVE-2019-19577,CVE-2019-19578,CVE-2019-19579,CVE-2019-19580,CVE-2019-19581,CVE-2019-19583,CVE-2020-7211
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    xen-4.5.5_28-22.64.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    xen-4.5.5_28-22.64.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Swamp Workflow Management 2020-04-29 16:28:30 UTC
SUSE-SU-2020:1138-1: An update that solves 6 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1027519,1155200,1160932,1161181,1167152,1168140,1168142,1168143,1169392
CVE References: CVE-2020-11739,CVE-2020-11740,CVE-2020-11741,CVE-2020-11742,CVE-2020-11743,CVE-2020-7211
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    xen-4.11.3_04-2.23.1
SUSE Linux Enterprise Server 12-SP4 (src):    xen-4.11.3_04-2.23.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2020-04-29 17:05:04 UTC
SUSE-SU-2020:1139-1: An update that solves 6 vulnerabilities and has 8 fixes is now available.

Category: security (important)
Bug References: 1027519,1134506,1155200,1157490,1160932,1161181,1162040,1165206,1167007,1167152,1168140,1168142,1168143,1169392
CVE References: CVE-2020-11739,CVE-2020-11740,CVE-2020-11741,CVE-2020-11742,CVE-2020-11743,CVE-2020-7211
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    xen-4.12.2_04-3.11.1
SUSE Linux Enterprise Server 12-SP5 (src):    xen-4.12.2_04-3.11.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2020-06-16 19:13:06 UTC
SUSE-SU-2020:1630-1: An update that fixes 12 vulnerabilities is now available.

Category: security (important)
Bug References: 1157888,1158003,1158004,1158005,1158006,1158007,1161181,1167152,1168140,1168142,1169392,1172205
CVE References: CVE-2019-19577,CVE-2019-19578,CVE-2019-19579,CVE-2019-19580,CVE-2019-19581,CVE-2019-19583,CVE-2020-0543,CVE-2020-11739,CVE-2020-11740,CVE-2020-11741,CVE-2020-11742,CVE-2020-7211
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    xen-4.9.4_06-3.62.1
SUSE OpenStack Cloud 8 (src):    xen-4.9.4_06-3.62.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    xen-4.9.4_06-3.62.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    xen-4.9.4_06-3.62.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    xen-4.9.4_06-3.62.1
SUSE Enterprise Storage 5 (src):    xen-4.9.4_06-3.62.1
HPE Helion Openstack 8 (src):    xen-4.9.4_06-3.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2020-08-04 19:40:36 UTC
SUSE-SU-2020:14444-1: An update that fixes 16 vulnerabilities is now available.

Category: security (important)
Bug References: 1152497,1154448,1154456,1154458,1154461,1155945,1157888,1158004,1158005,1158006,1158007,1161181,1163019,1168140,1169392,1174543
CVE References: CVE-2018-12207,CVE-2019-11135,CVE-2019-18420,CVE-2019-18421,CVE-2019-18424,CVE-2019-18425,CVE-2019-19577,CVE-2019-19578,CVE-2019-19579,CVE-2019-19580,CVE-2019-19583,CVE-2020-11740,CVE-2020-11741,CVE-2020-11742,CVE-2020-7211,CVE-2020-8608
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    xen-4.4.4_42-61.52.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    xen-4.4.4_42-61.52.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2020-08-11 16:18:31 UTC
SUSE-SU-2020:14448-1: An update that fixes 7 vulnerabilities is now available.

Category: security (important)
Bug References: 1154456,1154458,1161181,1163019,1168140,1169392,1174543
CVE References: CVE-2019-18421,CVE-2019-18425,CVE-2020-11740,CVE-2020-11741,CVE-2020-11742,CVE-2020-7211,CVE-2020-8608
JIRA References: 
Sources used:
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    xen-4.2.5_22-45.36.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    xen-4.2.5_22-45.36.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 17 Charles Arnold 2021-01-22 19:36:15 UTC
Backported and released to 11-SP1.
Comment 18 Carlos López 2022-06-10 09:35:04 UTC
Done, closing.